Analysis
- max time kernel
360s - max time network
326s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system - submitted
28/04/2024, 16:04
Behavioral task
behavioral1
Sample
Limewire_5.5.16.exe
Resource
win10-20240404-en
windows10-1703-x64
26 signatures
300 seconds
Behavioral task
behavioral2
Sample
Limewire_5.5.16.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
25 signatures
300 seconds
General
- Target Limewire_5.5.16.exe
- Size 28.8MB
- Sample240428-th496sbf21
- SHA256 f6ca4c41fceab0cb136ad06eaa0a4c82e209948238e6873ed7ea4022ad41c54b
- MD5 f5ff2057c5cdbb6dc15e43ee4ffe4526
- SHA1 2562bffe3eecc91ca17316ca127d0eba63fe9b8c
- SHA512 280f1d27d8a69ed1ffdda419ec224c7280d099a77c8a4d124ae2169ada808bfd76fc8fe0236129ac24c839352f6077da6c6d4dc7054b91323a3def001dee1346
- SSDEEP 786432:xUtL12zR8JB66fGSPOX9TtfnAN3/920A3r20aeKI3:xUV10R34GSYP2/9tAfKI3
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Modifies Installed Components in the registry 2 TTPs 7 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}\Locale = "EN" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}\ = "Java (Sun)" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}\ComponentID = "JAVAVM" MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}\IsInstalled = "1" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}\KeyFileName = "C:\\Program Files (x86)\\Java\\jre6\\bin\\regutils.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}\Version = "5,0,5000,0" MsiExec.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Control Panel\International\Geo\Nation LimeWire.exe - Executes dropped EXE 15 IoCs
pid Process 4440 jrestub.exe 3256 zipper.exe 1360 unpack200.exe 4312 unpack200.exe 5072 unpack200.exe 4144 unpack200.exe 944 unpack200.exe 428 unpack200.exe 1532 unpack200.exe 1768 javaw.exe 4160 javaw.exe 4288 execNoWindow.exe 376 unpack200.exe 996 toolbarChecker.exe 2152 LimeWire.exe - Loads dropped DLL 64 IoCs
pid Process 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 4440 jrestub.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 648 MsiExec.exe 648 MsiExec.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 648 MsiExec.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 648 MsiExec.exe 648 MsiExec.exe 648 MsiExec.exe 648 MsiExec.exe 648 MsiExec.exe 648 MsiExec.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/files/0x000700000001abe4-274.dat upx behavioral1/memory/4440-276-0x0000000000400000-0x00000000005D2000-memory.dmp upx behavioral1/memory/4440-345-0x0000000000400000-0x00000000005D2000-memory.dmp upx behavioral1/memory/4440-434-0x0000000000400000-0x00000000005D2000-memory.dmp upx behavioral1/memory/4440-1368-0x0000000000400000-0x00000000005D2000-memory.dmp upx - Blocklisted process makes network request 2 IoCs
flow pid Process 31 648 MsiExec.exe 32 648 MsiExec.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe - Installs/modifies Browser Helper Object 2 TTPs 5 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\NoExplorer = "1" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\NoExplorer = "1" MsiExec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9} MsiExec.exe - Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\javaws.exe MsiExec.exe File created C:\Windows\SysWOW64\deploytk.dll MsiExec.exe File created C:\Windows\SysWOW64\java.exe MsiExec.exe File created C:\Windows\SysWOW64\javaw.exe MsiExec.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Java\jre6\lib\zi\Pacific\Kiritimati zipper.exe File created C:\Program Files (x86)\LimeWire\lib\avg\avgsdkcom.dll Limewire_5.5.16.exe File created C:\Program Files (x86)\Java\jre6\bin\dt_socket.dll zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Africa\Mbabane zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\America\Edmonton zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Asia\Tokyo zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Europe\Amsterdam zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Europe\Minsk zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Pacific\Funafuti zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\ZoneInfoMappings zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Africa\Asmara zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\America\Bogota zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\America\Phoenix zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Atlantic\St_Helena zipper.exe File created C:\Program Files (x86)\Java\jre6\bin\ssvagent.exe zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Africa\Gaborone zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Pacific\Kosrae zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Indian\Antananarivo zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Pacific\Norfolk zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\deploy\messages.properties zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\deploy\messages_ja.properties zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\fontconfig.98.bfc zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Africa\Harare zipper.exe File created C:\Program Files (x86)\Java\jre6\bin\zip.dll zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Etc\GMT+12 zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Pacific\Tahiti zipper.exe File created C:\Program Files (x86)\LimeWire\lib\msvcp90.dll Limewire_5.5.16.exe File created C:\Program Files (x86)\Java\jre6\bin\java_crw_demo.dll zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\images\cursors\win32_MoveNoDrop32x32.gif zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Asia\Karachi zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Asia\Kolkata zipper.exe File created C:\Program Files (x86)\Java\jre6\bin\servertool.exe zipper.exe File created C:\Program Files (x86)\LimeWire\unpack200.exe Limewire_5.5.16.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\America\Montserrat zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\fontconfig.properties.src zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Africa\Johannesburg zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\America\Anguilla zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\America\Dawson zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Asia\Muscat zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Europe\Rome zipper.exe File created C:\Program Files (x86)\Java\jre6\bin\regutils.dll msiexec.exe File created C:\Program Files (x86)\Java\jre6\lib\security\cacerts zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\America\Rio_Branco zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Asia\Kuala_Lumpur zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\ext\meta-index zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\America\Montreal zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Europe\Kiev zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Etc\GMT-12 zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Europe\Moscow zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\SystemV\PST8PDT zipper.exe File opened for modification C:\Program Files (x86)\LimeWire\root\magnet10\badge.img Limewire_5.5.16.exe File created C:\Program Files (x86)\Java\jre6\README.txt zipper.exe File created C:\Program Files (x86)\Java\jre6\bin\jawt.dll zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\America\Campo_Grande zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\America\Monterrey zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Asia\Brunei zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Asia\Riyadh87 zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Asia\Singapore zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Europe\London zipper.exe File created C:\Program Files (x86)\Java\jre6\bin\jqs.exe zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\images\cursors\win32_LinkDrop32x32.gif zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\America\Chihuahua zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\America\Eirunepe zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Etc\GMT+5 zipper.exe - Drops file in Windows directory 45 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{26A24AE4-039D-4CA4-87B4-2F83216018FF} msiexec.exe File opened for modification C:\Windows\Installer\MSI41C4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI54E9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5BFE.tmp msiexec.exe File opened for modification C:\Windows\Installer\e583563.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI3FE6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6B0A.tmp msiexec.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\Installer\MSI3A06.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4234.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4391.tmp msiexec.exe File created C:\Windows\Installer\e583567.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI3DF1.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\e583563.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI4194.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI41F4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4244.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5C6D.tmp msiexec.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\Installer\MSI3B40.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI40F5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4323.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5EE1.tmp msiexec.exe File opened for modification C:\Windows\Installer\e583568.msi msiexec.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdge.exe File opened for modification C:\Windows\Installer\MSI4086.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4007.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4037.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI40C5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4155.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4274.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI42B4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI42D4.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI5F4F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5F60.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5CBC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3D25.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4125.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5DE6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6B1B.tmp msiexec.exe File created C:\Windows\Installer\e583568.msi msiexec.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\Installer\ msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msiexec.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msiexec.exe -
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppName = "jp2launcher.exe" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3B9A6E32-36C9-4946-B78C-3F58E3785EC1}\AppName = "unpack200.exe" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppName = "javaws.exe" MsiExec.exe Key created \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppName = "ssvagent.exe" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppPath = "C:\\Program Files (x86)\\Java\\jre6\\bin" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppPath = "C:\\Program Files (x86)\\Java\\jre6\\bin" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3B9A6E32-36C9-4946-B78C-3F58E3785EC1}\AppPath = "C:\\Program Files (x86)\\Java\\jre6\\bin" MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\Policy = "3" MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\Policy = "3" MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\Policy = "3" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3B9A6E32-36C9-4946-B78C-3F58E3785EC1} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppPath = "C:\\Program Files (x86)\\Java\\jre6\\bin" MsiExec.exe Key created \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A} MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3B9A6E32-36C9-4946-B78C-3F58E3785EC1}\Policy = "3" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284} MsiExec.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_15" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.2_21" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBC} MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBB} MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBC}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBC}\InprocServer32 MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_09" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_09" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBA}\ = "Java Plug-in 1.4.2_15" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBC}\InprocServer32 MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBA} MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_26" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA} MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBC} MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA} MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBA} MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBC} MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBB} MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBB} MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.2_25" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC} MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBB} MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBB} MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}\ = "Java Plug-in 1.3.1_26" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBA} MsiExec.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{5745A111-323D-423C-B7FB-74C4C19F47D9}\TypeLib Limewire_5.5.16.exe Set value (data) \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 6ed13c238699da01 MicrosoftEdge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_18" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_30" MsiExec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\MIME\DATABASE\CONTENT TYPE\APPLICATION/X-JAVA-JNLP-FILE MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBC}\InprocServer32 MsiExec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\JavaPlugin.160_18 MsiExec.exe Key created \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation MicrosoftEdge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.1_11" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBC}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2CA9801A-EA1F-4D23-9A4E-46904E4F2966}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" Limewire_5.5.16.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_07" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\jarfile\ = "Executable Jar File" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_09" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBB} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBB} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgSdkCom.AvgSdk.1\CLSID\ = "{5745A111-323D-423C-B7FB-74C4C19F47D9}" Limewire_5.5.16.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgSdkCom.AvgSdk\CLSID\ = "{5745A111-323D-423C-B7FB-74C4C19F47D9}" Limewire_5.5.16.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Set value (data) \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBB} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB3990DE-0FD7-412e-A0E8-875300BE08FA}\ProgID\ = "AvgSdkCom.AvgVdbUpd.1" Limewire_5.5.16.exe Set value (data) \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-FFFF-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}\ = "Deployment Toolkit" MsiExec.exe Set value (int) \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0" MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBB} MsiExec.exe Key created \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{D011DC75-F8E1-462B-88D9-F01BA47AADE7}\ProgID Limewire_5.5.16.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.2_03" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBB} MsiExec.exe Set value (str) \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix MicrosoftEdge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6C5ADB75C34456D42B338232391206FF\4EA42A62D9304AC4784BF238120681FF msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\TreatAs MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.2_25" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{5E03A3EA-2CB6-4E23-8A77-601AD5646296}\1.0\FLAGS Limewire_5.5.16.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85371CA6E550143DCE2803471BDE3A09E8F8770F jrestub.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85371CA6E550143DCE2803471BDE3A09E8F8770F\Blob = 0f0000000100000014000000d95944f5bd92127092218f9f02c719c42386b49909000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030162000000010000002000000083ce3c1229688a593d485f81973c0f9195431eda37cc5e36430e79c7a888638b1400000001000000140000001a21b4952b6293ce18b365ec9c0e934cb381e6d40b000000010000001200000056006500720069005300690067006e0000001d00000001000000100000007173fa7247886438eb10b0f4e8a0cc186800000001000000080000000000876ace99d10103000000010000001400000085371ca6e550143dce2803471bde3a09e8f8770f200000000100000006030000308203023082026b02107dd9fe07cfa81eb7107967fba78934c6300d06092a864886f70d01010505003081c1310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e313c303a060355040b1333436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204732313a3038060355040b1331286329203139393820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d060355040b1316566572695369676e205472757374204e6574776f726b301e170d3938303531383030303030305a170d3238303830313233353935395a3081c1310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e313c303a060355040b1333436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204732313a3038060355040b1331286329203139393820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d060355040b1316566572695369676e205472757374204e6574776f726b30819f300d06092a864886f70d010101050003818d0030818902818100cc5ed1115d5c69d0abd3b96a4c991f5998308e168520466d473fd4852084e16db3f8a4ed0cf1170f3bf9a7f925d7c1cf8463f27c63cfa247f2c65b338e64400468c180b9641c4577c7d86ef595293c50e834d7781fa8ba6d4391958f45575e7ec5fbcaa404ebea973754306fbb01473233cddc579b646961f89b1d1c894f5c670203010001300d06092a864886f70d010105050003818100514dcdbe5ccb98199c15b20139782e4d0f67707099c6105a94a4534d546d2baf0d5d408b64d3d7eede5661925fa6c41d106136d32c273ce82909b9116474ccb5739f1c48a9bc6101eee217a60ce340083b0ee7eb44732a9af16992ef7114c339ac71a791096fe47106b3ba5957267900f6f80da2333028d4aa58a09d9d6991fd jrestub.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85371CA6E550143DCE2803471BDE3A09E8F8770F\Blob = 190000000100000010000000b24f9926afcb335d4349d24b71f41a6703000000010000001400000085371ca6e550143dce2803471bde3a09e8f8770f6800000001000000080000000000876ace99d1011d00000001000000100000007173fa7247886438eb10b0f4e8a0cc180b000000010000001200000056006500720069005300690067006e0000001400000001000000140000001a21b4952b6293ce18b365ec9c0e934cb381e6d462000000010000002000000083ce3c1229688a593d485f81973c0f9195431eda37cc5e36430e79c7a888638b09000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703010f0000000100000014000000d95944f5bd92127092218f9f02c719c42386b499200000000100000006030000308203023082026b02107dd9fe07cfa81eb7107967fba78934c6300d06092a864886f70d01010505003081c1310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e313c303a060355040b1333436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204732313a3038060355040b1331286329203139393820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d060355040b1316566572695369676e205472757374204e6574776f726b301e170d3938303531383030303030305a170d3238303830313233353935395a3081c1310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e313c303a060355040b1333436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204732313a3038060355040b1331286329203139393820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d060355040b1316566572695369676e205472757374204e6574776f726b30819f300d06092a864886f70d010101050003818d0030818902818100cc5ed1115d5c69d0abd3b96a4c991f5998308e168520466d473fd4852084e16db3f8a4ed0cf1170f3bf9a7f925d7c1cf8463f27c63cfa247f2c65b338e64400468c180b9641c4577c7d86ef595293c50e834d7781fa8ba6d4391958f45575e7ec5fbcaa404ebea973754306fbb01473233cddc579b646961f89b1d1c894f5c670203010001300d06092a864886f70d010105050003818100514dcdbe5ccb98199c15b20139782e4d0f67707099c6105a94a4534d546d2baf0d5d408b64d3d7eede5661925fa6c41d106136d32c273ce82909b9116474ccb5739f1c48a9bc6101eee217a60ce340083b0ee7eb44732a9af16992ef7114c339ac71a791096fe47106b3ba5957267900f6f80da2333028d4aa58a09d9d6991fd jrestub.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe 2776 Limewire_5.5.16.exe - Suspicious behavior: MapViewOfSection 4 IoCs
pid Process 3000 MicrosoftEdgeCP.exe 3000 MicrosoftEdgeCP.exe 3000 MicrosoftEdgeCP.exe 3000 MicrosoftEdgeCP.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2776 Limewire_5.5.16.exe Token: SeShutdownPrivilege 2820 msiexec.exe Token: SeIncreaseQuotaPrivilege 2820 msiexec.exe Token: SeSecurityPrivilege 4628 msiexec.exe Token: SeCreateTokenPrivilege 2820 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2820 msiexec.exe Token: SeLockMemoryPrivilege 2820 msiexec.exe Token: SeIncreaseQuotaPrivilege 2820 msiexec.exe Token: SeMachineAccountPrivilege 2820 msiexec.exe Token: SeTcbPrivilege 2820 msiexec.exe Token: SeSecurityPrivilege 2820 msiexec.exe Token: SeTakeOwnershipPrivilege 2820 msiexec.exe Token: SeLoadDriverPrivilege 2820 msiexec.exe Token: SeSystemProfilePrivilege 2820 msiexec.exe Token: SeSystemtimePrivilege 2820 msiexec.exe Token: SeProfSingleProcessPrivilege 2820 msiexec.exe Token: SeIncBasePriorityPrivilege 2820 msiexec.exe Token: SeCreatePagefilePrivilege 2820 msiexec.exe Token: SeCreatePermanentPrivilege 2820 msiexec.exe Token: SeBackupPrivilege 2820 msiexec.exe Token: SeRestorePrivilege 2820 msiexec.exe Token: SeShutdownPrivilege 2820 msiexec.exe Token: SeDebugPrivilege 2820 msiexec.exe Token: SeAuditPrivilege 2820 msiexec.exe Token: SeSystemEnvironmentPrivilege 2820 msiexec.exe Token: SeChangeNotifyPrivilege 2820 msiexec.exe Token: SeRemoteShutdownPrivilege 2820 msiexec.exe Token: SeUndockPrivilege 2820 msiexec.exe Token: SeSyncAgentPrivilege 2820 msiexec.exe Token: SeEnableDelegationPrivilege 2820 msiexec.exe Token: SeManageVolumePrivilege 2820 msiexec.exe Token: SeImpersonatePrivilege 2820 msiexec.exe Token: SeCreateGlobalPrivilege 2820 msiexec.exe Token: SeRestorePrivilege 4628 msiexec.exe Token: SeTakeOwnershipPrivilege 4628 msiexec.exe Token: SeRestorePrivilege 4628 msiexec.exe Token: SeTakeOwnershipPrivilege 4628 msiexec.exe Token: SeRestorePrivilege 4628 msiexec.exe Token: SeTakeOwnershipPrivilege 4628 msiexec.exe Token: SeRestorePrivilege 4628 msiexec.exe Token: SeTakeOwnershipPrivilege 4628 msiexec.exe Token: SeRestorePrivilege 4628 msiexec.exe Token: SeTakeOwnershipPrivilege 4628 msiexec.exe Token: SeRestorePrivilege 4628 msiexec.exe Token: SeTakeOwnershipPrivilege 4628 msiexec.exe Token: SeRestorePrivilege 4628 msiexec.exe Token: SeTakeOwnershipPrivilege 4628 msiexec.exe Token: SeRestorePrivilege 4628 msiexec.exe Token: SeTakeOwnershipPrivilege 4628 msiexec.exe Token: SeRestorePrivilege 4628 msiexec.exe Token: SeTakeOwnershipPrivilege 4628 msiexec.exe Token: SeRestorePrivilege 4628 msiexec.exe Token: SeTakeOwnershipPrivilege 4628 msiexec.exe Token: SeRestorePrivilege 4628 msiexec.exe Token: SeTakeOwnershipPrivilege 4628 msiexec.exe Token: SeRestorePrivilege 4628 msiexec.exe Token: SeTakeOwnershipPrivilege 4628 msiexec.exe Token: SeRestorePrivilege 4628 msiexec.exe Token: SeTakeOwnershipPrivilege 4628 msiexec.exe Token: SeRestorePrivilege 4628 msiexec.exe Token: SeTakeOwnershipPrivilege 4628 msiexec.exe Token: SeRestorePrivilege 4628 msiexec.exe Token: SeTakeOwnershipPrivilege 4628 msiexec.exe Token: SeRestorePrivilege 4628 msiexec.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2152 LimeWire.exe 2152 LimeWire.exe 2152 LimeWire.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2152 LimeWire.exe 2152 LimeWire.exe 2152 LimeWire.exe - Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 2776 Limewire_5.5.16.exe 2152 LimeWire.exe 2152 LimeWire.exe 2152 LimeWire.exe 2152 LimeWire.exe 2152 LimeWire.exe 2152 LimeWire.exe 2152 LimeWire.exe 2152 LimeWire.exe 2152 LimeWire.exe 5000 MicrosoftEdge.exe 3000 MicrosoftEdgeCP.exe 1080 MicrosoftEdgeCP.exe 3000 MicrosoftEdgeCP.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2776 wrote to memory of 4440 2776 Limewire_5.5.16.exe 72 PID 2776 wrote to memory of 4440 2776 Limewire_5.5.16.exe 72 PID 2776 wrote to memory of 4440 2776 Limewire_5.5.16.exe 72 PID 4440 wrote to memory of 2820 4440 jrestub.exe 73 PID 4440 wrote to memory of 2820 4440 jrestub.exe 73 PID 4440 wrote to memory of 2820 4440 jrestub.exe 73 PID 4628 wrote to memory of 648 4628 msiexec.exe 76 PID 4628 wrote to memory of 648 4628 msiexec.exe 76 PID 4628 wrote to memory of 648 4628 msiexec.exe 76 PID 4628 wrote to memory of 4432 4628 msiexec.exe 77 PID 4628 wrote to memory of 4432 4628 msiexec.exe 77 PID 4628 wrote to memory of 4432 4628 msiexec.exe 77 PID 4432 wrote to memory of 3256 4432 MsiExec.exe 78 PID 4432 wrote to memory of 3256 4432 MsiExec.exe 78 PID 4432 wrote to memory of 3256 4432 MsiExec.exe 78 PID 4432 wrote to memory of 1360 4432 MsiExec.exe 79 PID 4432 wrote to memory of 1360 4432 MsiExec.exe 79 PID 4432 wrote to memory of 1360 4432 MsiExec.exe 79 PID 4432 wrote to memory of 4312 4432 MsiExec.exe 80 PID 4432 wrote to memory of 4312 4432 MsiExec.exe 80 PID 4432 wrote to memory of 4312 4432 MsiExec.exe 80 PID 4432 wrote to memory of 5072 4432 MsiExec.exe 81 PID 4432 wrote to memory of 5072 4432 MsiExec.exe 81 PID 4432 wrote to memory of 5072 4432 MsiExec.exe 81 PID 4432 wrote to memory of 4144 4432 MsiExec.exe 82 PID 4432 wrote to memory of 4144 4432 MsiExec.exe 82 PID 4432 wrote to memory of 4144 4432 MsiExec.exe 82 PID 4432 wrote to memory of 944 4432 MsiExec.exe 83 PID 4432 wrote to memory of 944 4432 MsiExec.exe 83 PID 4432 wrote to memory of 944 4432 MsiExec.exe 83 PID 4432 wrote to memory of 428 4432 MsiExec.exe 84 PID 4432 wrote to memory of 428 4432 MsiExec.exe 84 PID 4432 wrote to memory of 428 4432 MsiExec.exe 84 PID 4432 wrote to memory of 1532 4432 MsiExec.exe 85 PID 4432 wrote to memory of 1532 4432 MsiExec.exe 85 PID 4432 wrote to memory of 1532 4432 MsiExec.exe 85 PID 4628 wrote to memory of 1768 4628 msiexec.exe 86 PID 4628 wrote to memory of 1768 4628 msiexec.exe 86 PID 4628 wrote to memory of 1768 4628 msiexec.exe 86 PID 4628 wrote to memory of 4160 4628 msiexec.exe 87 PID 4628 wrote to memory of 4160 4628 msiexec.exe 87 PID 4628 wrote to memory of 4160 4628 msiexec.exe 87 PID 4160 wrote to memory of 1812 4160 javaw.exe 88 PID 4160 wrote to memory of 1812 4160 javaw.exe 88 PID 4160 wrote to memory of 1812 4160 javaw.exe 88 PID 1812 wrote to memory of 4932 1812 cmd.exe 90 PID 1812 wrote to memory of 4932 1812 cmd.exe 90 PID 1812 wrote to memory of 4932 1812 cmd.exe 90 PID 4440 wrote to memory of 3512 4440 jrestub.exe 92 PID 4440 wrote to memory of 3512 4440 jrestub.exe 92 PID 4440 wrote to memory of 3512 4440 jrestub.exe 92 PID 4160 wrote to memory of 4116 4160 javaw.exe 93 PID 4160 wrote to memory of 4116 4160 javaw.exe 93 PID 4160 wrote to memory of 4116 4160 javaw.exe 93 PID 4116 wrote to memory of 2488 4116 cmd.exe 95 PID 4116 wrote to memory of 2488 4116 cmd.exe 95 PID 4116 wrote to memory of 2488 4116 cmd.exe 95 PID 4440 wrote to memory of 4212 4440 jrestub.exe 96 PID 4440 wrote to memory of 4212 4440 jrestub.exe 96 PID 4440 wrote to memory of 4212 4440 jrestub.exe 96 PID 4160 wrote to memory of 2280 4160 javaw.exe 98 PID 4160 wrote to memory of 2280 4160 javaw.exe 98 PID 4160 wrote to memory of 2280 4160 javaw.exe 98 PID 2280 wrote to memory of 1008 2280 cmd.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\Limewire_5.5.16.exe"C:\Users\Admin\AppData\Local\Temp\Limewire_5.5.16.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\jrestub.exeC:\Users\Admin\AppData\Local\Temp\jrestub.exe /s /L C:\Users\Admin\AppData\Local\Temp\jrelog.txt IEXPLORER=0 MOZILLA=0 REBOOT=Suppress2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\\msiexec.exe" /i "C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.6.0_18\jre1.6.0_18-c-l.msi" /qn ED=0 SP1OFF=1 SP2OFF=1 SP3OFF=1 SP4OFF=1 SP5OFF=1 SP6OFF=1 SP7OFF=1 SP8OFF=1 SP9OFF=1 SP10OFF=1 SPWEB=http://javadl-esd.sun.com/update/1.6.0/sp-1.6.0_18-b74 /L C:\Users\Admin\AppData\Local\Temp\jrelog.txt IEXPLORER=0 MOZILLA=0 REBOOT=Suppress METHOD=jother PROG=03⤵
- Suspicious use of AdjustPrivilegeToken
PID:2820
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\\msiexec.exe" /i "C:\Users\Admin\AppData\LocalLow\Sun\Java\AU\au.msi" ALLUSERS=1 /qn PROG=03⤵PID:3512
-
-
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe"C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe" -r jre 1.6.0_18-b743⤵PID:4212
-
-
-
C:\Program Files (x86)\LimeWire\execNoWindow.exe"C:\Program Files (x86)\LimeWire\execNoWindow.exe" "C:\Program Files (x86)\LimeWire\unpack200.exe" -v -l "C:\Program Files (x86)\LimeWire\unpack.log" "C:\Program Files (x86)\LimeWire\LimeWire.pack" "C:\Program Files (x86)\LimeWire\LimeWire.jar.tmp"2⤵
- Executes dropped EXE
PID:4288 -
C:\Program Files (x86)\LimeWire\unpack200.exe"C:\Program Files (x86)\LimeWire\unpack200.exe" -v -l "C:\Program Files (x86)\LimeWire\unpack.log" "C:\Program Files (x86)\LimeWire\LimeWire.pack" "C:\Program Files (x86)\LimeWire\LimeWire.jar.tmp"3⤵
- Executes dropped EXE
PID:376
-
-
-
C:\Users\Admin\AppData\Local\Temp\toolbarChecker.exe"C:\Users\Admin\AppData\Local\Temp\toolbarChecker.exe" LMW42⤵
- Executes dropped EXE
PID:996
-
-
C:\Program Files (x86)\LimeWire\LimeWire.exe"C:\Program Files (x86)\LimeWire\LimeWire.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2152
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 06DD9C76AFF01B50B61B39C087451D592⤵
- Loads dropped DLL
- Blocklisted process makes network request
PID:648
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 307DB1812A11E890E94027ACF2303925 E Global\MSI00002⤵
- Modifies Installed Components in the registry
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Program Files (x86)\Java\jre6\zipper.exe"C:\Program Files (x86)\Java\jre6\zipper.exe" "C:\Program Files (x86)\Java\jre6\core.zip" "C:\Program Files (x86)\Java\jre6\" "C:\Users\Admin\AppData\Local\Temp\java_install.log"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3256
-
-
C:\Program Files (x86)\Java\jre6\bin\unpack200.exe"C:\Program Files (x86)\Java\jre6\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre6\lib\rt.pack" "C:\Program Files (x86)\Java\jre6\lib\rt.jar"3⤵
- Executes dropped EXE
PID:1360
-
-
C:\Program Files (x86)\Java\jre6\bin\unpack200.exe"C:\Program Files (x86)\Java\jre6\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre6\lib\jsse.pack" "C:\Program Files (x86)\Java\jre6\lib\jsse.jar"3⤵
- Executes dropped EXE
PID:4312
-
-
C:\Program Files (x86)\Java\jre6\bin\unpack200.exe"C:\Program Files (x86)\Java\jre6\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre6\lib\plugin.pack" "C:\Program Files (x86)\Java\jre6\lib\plugin.jar"3⤵
- Executes dropped EXE
PID:5072
-
-
C:\Program Files (x86)\Java\jre6\bin\unpack200.exe"C:\Program Files (x86)\Java\jre6\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre6\lib\javaws.pack" "C:\Program Files (x86)\Java\jre6\lib\javaws.jar"3⤵
- Executes dropped EXE
PID:4144
-
-
C:\Program Files (x86)\Java\jre6\bin\unpack200.exe"C:\Program Files (x86)\Java\jre6\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre6\lib\deploy.pack" "C:\Program Files (x86)\Java\jre6\lib\deploy.jar"3⤵
- Executes dropped EXE
PID:944
-
-
C:\Program Files (x86)\Java\jre6\bin\unpack200.exe"C:\Program Files (x86)\Java\jre6\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre6\lib\charsets.pack" "C:\Program Files (x86)\Java\jre6\lib\charsets.jar"3⤵
- Executes dropped EXE
PID:428
-
-
C:\Program Files (x86)\Java\jre6\bin\unpack200.exe"C:\Program Files (x86)\Java\jre6\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre6\lib\ext\localedata.pack" "C:\Program Files (x86)\Java\jre6\lib\ext\localedata.jar"3⤵
- Executes dropped EXE
PID:1532
-
-
-
C:\Program Files (x86)\Java\jre6\bin\javaw.exe"C:\Program Files (x86)\Java\jre6\bin\javaw.exe" -Xshare:dump2⤵
- Executes dropped EXE
PID:1768
-
-
C:\Program Files (x86)\Java\jre6\bin\javaw.exe"C:\Program Files (x86)\Java\jre6\bin\javaw.exe" com.sun.servicetag.Installer -source "Windows JRE installer"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\SysWOW64\cmd.execmd /C WMIC computersystem get model3⤵
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC computersystem get model4⤵PID:4932
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C WMIC computersystem get model3⤵
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC computersystem get model4⤵PID:2488
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C WMIC computersystem get manufacturer3⤵
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC computersystem get manufacturer4⤵PID:1008
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C WMIC bios get serialnumber3⤵PID:4056
-
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC bios get serialnumber4⤵PID:2008
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C WMIC cpu get manufacturer3⤵PID:2732
-
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC cpu get manufacturer4⤵PID:4864
-
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5000
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:2024
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:3000
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1080
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3328
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:2144
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e583566.rbs
- Size 10KB
- SHA256 6e88bc158c1e9b84332bcf22647a15d37f6497a990b45a89c0004887fa7f9427
- MD5 a24adcdced6b6e400d1a6b7dd53a1f70
- SHA1 c7288154e3583bb119d568c8306f166494662d0f
- SHA512 c0e4e2914df732dff522bb00f88a398be49dcff5bb069aa0e5ecf9e284743c0f9ea0805db1c5bccd01f4d46d58948444a8f3a9c1784ab4860d8050b0453bd5f0
- SSDEEP 192:ssEE7XiG9AeJMBYfZHWMBYfZy2K2u3Xpt+htLUbY5:s8yslflWlfAwuf+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Java\jre6\lib\zi\GMT
- Size 27B
- SHA256 0a526439ed04845ce94f7e9ae55c689ad01e1493f3b30c5c2b434a31fa33a43d
- MD5 7da9aa0de33b521b3399a4ffd4078bdb
- SHA1 f188a712f77103d544d4acf91d13dbc664c67034
- SHA512 9d2170571a58aed23f29fc465c2b14db3511e88907e017c010d452ecdf7a77299020d71f8b621a86e94dd2774a5418612d381e39335f92e287a4f451ee90cfb6
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\LimeWire\LimeWire.exe
- Size 492KB
- SHA256 1ff8c71e2b4931cc62a624b465d6623ec41d8f457b81b71d2d38474513ffb86d
- MD5 2b7f2dc5741bb18f7f5ec7558da68197
- SHA1 850d6c91c1b0114e6585f5f7924ca7e8cb9ec97c
- SHA512 9de16fb7facb3cb7a959cd28eee572fdd03dd4fc62c8ee8603bc1d38b84e7369195eb12ce7f8a0997a69b6d30af716b8f81d4faa9893f72a711f87024719e012
- SSDEEP 6144:/r9QR0c4dF6U9GTBgFEViPySU5P6blpp7EWcd0+jJnvHuw4x7QCfs5H++80LS:/r9ZdEUMT6FEoKS6CbqWwjJZ4Tf6lLS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\LimeWire\LimeWire.ico
- Size 24KB
- SHA256 30657b82f1caa63d6a74e7f87df8882cf6162ef56c6d89f26830886842e84923
- MD5 933fa742ef155bbe47c5b603eb390694
- SHA1 5440590c53cba80d24ff282d1f1051c881a2530a
- SHA512 2e43b97a46ae843dee1efa0298c90539bc7ac7f0f56b4cb5cf8e82eb9b51d7a7793d8e0254d5998075e916c0a3e722d9306a68e807d8b4230be6faa274eea3a5
- SSDEEP 384:fbvp5VxDbu2gHUM2qpCVAodZxPckXNt+jX66sYuM+wXVDkch:Dx5VxDbu50IiVL+HsLM+GBl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\45781A86D7D79A4E3FE6F4DF8CDF171D_E0B7CDE0B6AB7ABECB214E5A7A028B64
- Size 5B
- SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
- MD5 5bfa51f3a417b98e7443eca90fc94703
- SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
- SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C554DCF706A5AAB8B360FAD227EAB9C7
- Size 1KB
- SHA256 b674ab1941b315b897fb0d0cf91facfe75f268af88a8473795e3588b278b7eee
- MD5 63f207bab54520e443af5f5d879666ca
- SHA1 ae4d1aa61e3de3db80c8c7f41e9bce526fb05693
- SHA512 77a6db3c7dbb138e5d5bb2fc001c56797a399c0cd22195c9878865d16f38fea5712cd892b04ac97c8fdee82990244ad7a9822d3eecf5102c4c49b27dd250f089
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E8974A4669383843486E5AFDB09650F5
- Size 565B
- SHA256 14d7b24c3d6902f2e476326138d07466819c6a8562649aeea76eec9a64b64ba0
- MD5 6435b3ac227d7622759dbdbc5cbf8520
- SHA1 d6d19c9df56d588ebeb077e1c569f04115ff2a25
- SHA512 54f6b15e87b64204e5aa38c8fd170f8d36cf2a43585379f38bb1593955b30af713a72af697f78f9384f18e4eea3a8c0dce484ad15ecdd6236df0ff22fa07e995
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\45781A86D7D79A4E3FE6F4DF8CDF171D_E0B7CDE0B6AB7ABECB214E5A7A028B64
- Size 408B
- SHA256 e5da0ca8b60db7170dc9a68bcb1e347325cd1ea1efa1be1e9ca1d3663855f7d5
- MD5 3901db29150aeae817321226acb5726f
- SHA1 7666e957d382098c45e4296d21ec5d9d907107eb
- SHA512 e3bcdd55cc3a322eea0879fca8aedf051023c4ebdee73520894a5ecbcedd96f7e82b7fb70f095ba4dd55a8948387df47c9484b31ffdafe3e74e353166524744e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A92F33496848CFF4F115ED04BCDD933A_6C14F82F698E40985D569864739DB21B
- Size 408B
- SHA256 e842d8a49a1177a749613541a0d7c78d8d06a5e3290e4ebee4bff1b89b6f3080
- MD5 4c9cf7833a32395837af8b39143c7922
- SHA1 79e0db0b08ca03b178b8fb8efba29d3d85f47401
- SHA512 a1c3be2b3b6b075dc175896812803bb6519e5dbd8862ec4a912f992279ec4676dac3bd5316c29ae9e30d08c6352008345d8b47ceac1104550aea79cf09f8afb0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C554DCF706A5AAB8B360FAD227EAB9C7
- Size 188B
- SHA256 44b56e545fd5605084e0b0112ddf0b50b31e088163536d36ab92dc6eeee55b29
- MD5 5af53ed23fdb8d01ed746e359a73b962
- SHA1 d6f7ae9d7032acf643e4d226181eec8fe2011225
- SHA512 0875a291e6e46dea88680feeb4d25e1824e8358d0159e8eb12e1f08cc6cc1a1c335d9dcd2f8261f348a274a1e2823d8bb308fcbadf6f8a604f497266b6ae9338
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E8974A4669383843486E5AFDB09650F5
- Size 212B
- SHA256 278ea04f9b992b240af7bce03e276af6b6e3051c4aaa8a9eb2e1d285c0fbefab
- MD5 ba7e10b48546b0f0b323b7793f9b6fd4
- SHA1 fa4ee6e182db917e9906158b423d8c050a551388
- SHA512 91e4173aa20ad770659aa5cdb353f2069e57645384f1662e7014ebdaebe7a6d6c92e6bbb516692c5e58709f39aca08071b2f672d3895f96b72d1533167fa78af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.6.0_18\jre1.6.0_18-c-l.msi
- Size 11.8MB
- SHA256 d8dbf634e775d8fdcb6891758520cf8ab80a32de2c94e9493ceab93cedf5ecf8
- MD5 53df295a99335d837423249e600c78ac
- SHA1 7266661133fd1a4e5566ed876b94b600fbdc27bf
- SHA512 ff0404f87453be69331411043e76b09aba87e6d7abefd3f70af421cf04103aff0ed226eaae4aad75b04118cde1cbf5257bbb82f830965a9953a7ceada7162db7
- SSDEEP 196608:hiWNu3TtObiolIQZsdJ1imJEyrSPh67FWuvgfftTVD2/4d5OTp9q98cR/PhG/:ICuDtxM5iJ8mWy2O4ZntTVD2/4dE9ej
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\GRDFSSKH\favicon-32x32[1].ico
- Size 100KB
- SHA256 f734f5fe6ede956300bb223625832988cec068c5e8ffd8a531bae0be308589ce
- MD5 20e777566244ca1f689a4238987f889c
- SHA1 619a0ecea360da2860db8d59361aa8878658570c
- SHA512 f9532272d6dc17153a739a63175c5e3cffc6ee12eb20892c310f45d15ad6978240c01f23ea169b363ce278f83fc1cf092c4a700f5766d7b6e1b3c100586e004c
- SSDEEP 1536:MZm///3fff/////HHHPnnnf333QTHjzjjHj3bv95Ul3RlKIUw1gw:M4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\ImageStore\a07fpb4\imagestore.dat
- Size 109KB
- SHA256 8b2c08f0e473343f9c1f099ad0f668265cc79dc1689d89692888d77d0ae6d389
- MD5 f868db7dd1ff91158860f0f2ed4411a3
- SHA1 e8d047dc71d7efe2410e3b8b8732de49c7b81240
- SHA512 566722823456e630f05ad8ea2062e2107635443ef7d4070d8a1fca0ae03ee4031f0131b2e3fac417067bfa83cfd57a475ef6a16bf90e458d5c0d6fe136fd808b
- SSDEEP 1536:JumQ954eZD///3fff/////HHHPnnnf333hTHjzjjHj3bvM5Ul3RlHIUw1ga:JE+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF0E1B14FE6D6FA426.TMP
- Size 24KB
- SHA256 3e8c2095986b262ac8fccfabda2d021fc0d3504275e83cffe1f0a333f9efbe15
- MD5 d3cdb7663712ddb6ef5056c72fe69e86
- SHA1 f08bf69934fb2b9ca0aba287c96abe145a69366c
- SHA512 c0acd65db7098a55dae0730eb1dcd8aa94e95a71f39dd40b087be0b06afc5d1bb310f555781853b5a78a8803dba0fb44df44bd2bb14baeca29c7c7410dffc812
- SSDEEP 96:XE8EuyuJ8bCuQHlNvrqZTvw5mevtsxbNfIwz6jUW3e0NxT21KNY0AIFszZMUWjsg:XVuQfv+ZT2me0bhIwmwUxgmP3FeWjBn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\java_install.log
- Size 26KB
- SHA256 d901223d74038ee199057aa0713abf6d3d649d51a2105f02bcd452d7e2bb7901
- MD5 85d3f69800e117514f2e915f3a8d1905
- SHA1 b2d1675bcbf566bea7ff9a10a43f9621f678f62b
- SHA512 79f44c34027c7dc64da9eccf71b9bc7c36abc736088557fc329a45cc4c4a8c79f6e26dd79e87d61ef8e25fad19dec4ad4086d3b0f115d6693fb4b3a1792d47d1
- SSDEEP 384:5RgY2YadAYD1TYgiT3EH5SG0BxU/nikHL:/gY2YYAEheEH5S9YnikHL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\jrelog.txt
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\jrestub.exe
- Size 898KB
- SHA256 8278a6df47d4f55b1e7fb8108fd0ddcb77dad78d0bf9b2c76829d091a902f012
- MD5 0f2e650297a42c029811192a45d11bde
- SHA1 d87ae041a3379e1e3f7c9f2391bbe1b7ce28e5d0
- SHA512 f577614bb5180261d51d46f811ecf484d7881c24b92bab37f3d06c1cbecb7ad209672502dc39714821195cb8db15b4743552129b1ecfa8056e6d8f3b3a1821ba
- SSDEEP 12288:Ipj7+ckMu5KRYlXhAOqdOP2kVj9yqsqFZe31QtN+iUpNN1IXfi4oQr/GRo8toSxP:ptKR2XhLFIFQtN4pNN1A6BQ6Ro8J
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\jusched.log
- Size 154KB
- SHA256 b3aa76beda8ff69134924bf2b667ca6d4306be31d528611c693c997ca1cd06d1
- MD5 cefaa0b24d8c690e23a66be934a06ba3
- SHA1 d8dc4c987ff905e48a36d425a6559ead98f8cd0e
- SHA512 ce6328653fdd858d8b3f119d6eeff03a16ea0312028f5107cbd58a1c8ebc825dd3805bdd797073edd9244cdc6f277e36eb0c75a3fe2b8706870b316bdb4acca0
- SSDEEP 3072:kSyXvovQi26HQrKRsuVR8j0yVgyBBTyUDx3VJIOAX8:HyoM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsmE511.tmp\Banner.dll
- Size 4KB
- SHA256 05838c8f81efbb98679010158f29cefd88a34fb1fe5d603e839dd406235ddf29
- MD5 91c9ee5005ac6cb4ec79a3b039b4c8df
- SHA1 95a9c018b501b6697beca846a33955909c3f97be
- SHA512 41cc45a64fbe64cd83e704e87193004245f5d29f4f880921d041e5f2ceec86ca0653146e6477642eba73875b9d5f0d773b540436b19e4797def9c15d7618474b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsmE511.tmp\ExtractDLLEx.dll
- Size 7KB
- SHA256 73acba7dd477dfd6cf4249911f4e3c781196c7cf6b28425761dcb2d4f90c36c5
- MD5 ba4063f437abb349aa9120e9c320c467
- SHA1 b045d785f6041e25d6be031ae2af4d4504e87b12
- SHA512 48a813f55834069f8c6b90740de3df01564a136b0fe637f9f85cc1a19d7f32b1f70205ff2462526508fe3c1962d7c1e8e384c40463e328538aeba28e8d0fb92a
- SSDEEP 96:lyEPmi/06iLbX8SIP59L1MmqPbgkk/eWKCHGojGYYIF/ggiomsTeZUzI:lyEPmymbMbPZOz+/eWJmoUItiopTeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsmE511.tmp\KillProcDLL.dll
- Size 4KB
- SHA256 c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93
- MD5 99f345cf51b6c3c317d20a81acb11012
- SHA1 b3d0355f527c536ea14a8ff51741c8739d66f727
- SHA512 937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsmE511.tmp\RunProcess.dll
- Size 180KB
- SHA256 ad31aa34cf3371c522b58ba7cc4958d6ea98f96510896cf680c313d21925bac5
- MD5 6f05acd8d0b80754534355437cfa4f0b
- SHA1 956f7048b41db52585ae663872e5a35cb9d72f3c
- SHA512 84d2322ace21adbb8404cb1adbaa05684afa3014005e504fbfed614f42fa170ce917bd6418db95be732f1e1923ce9da9e5b0cca51e76497d8e76e37d14de3be6
- SSDEEP 3072:+7cpps5NLaOXCo/QrBdiE3l9R0QVLjqS9PtlDAm1tDKso:+us5JFXrIrBYY9OEzMmro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsmE511.tmp\System.dll
- Size 11KB
- SHA256 dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
- MD5 00a0194c20ee912257df53bfe258ee4a
- SHA1 d7b4e319bc5119024690dc8230b9cc919b1b86b2
- SHA512 3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsmE511.tmp\ioSpecial.ini
- Size 701B
- SHA256 780b40feb7fd8f6c1393ecd135ee161023095ac073b42523b9eaae074be94851
- MD5 f9bdf1fb26415571c9940cf7b298978e
- SHA1 66a25c2a8d51574048236b1a56ef4fa660cc0fbe
- SHA512 f8cbcc2baef7a09a3e27901070d1fba83e80753572398bd00d86fb74df2bd2c649a45130405085f64f36095e0530bf6894e7c1866a951b99068269baff4b1526
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsmE511.tmp\ioSpecial.ini
- Size 767B
- SHA256 338fc5984fa496c635c0602d340a2d153f620b989d485c10e9b48710c419d444
- MD5 92990293f2cffa56c04c66b4f6236f4b
- SHA1 952023ce67a9d01ebd184619b5c870c9846d6f9b
- SHA512 f2731934d7c00e59d792289cc260d2c6bef700b4e623ff1695ad260a4371bf105b53d2ad0423dd27bd580e1edd27786f651d8b83f7b2d1bb9c30c9311f9cf2e0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsmE511.tmp\ioSpecial.ini
- Size 776B
- SHA256 d4362d2203da044704d9ce21542ecd3771cc964240429556e400813bf592d77e
- MD5 60e6d8f9d5a74fad016fe28edb5b5e72
- SHA1 46e98d22eb3f19df78af004a35f81ffc384220ab
- SHA512 ec9c6e11e8c41ff61b24aa77a0ed3bbf4c81d550e0b5db3b16468b52e2f69ba029fe304d592a5c7633fa653851f25cd6de2f0b24227016016ef7b2c107e7244d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsmE511.tmp\legal.ini
- Size 1KB
- SHA256 1a4750f51590a94db0404fcd7921714c231663d15091a78503b71e18ed6a46be
- MD5 ddde964da6ebdcf511a82e27e350e24d
- SHA1 e9e3d0524f57b6803a2f1f3d4b45afad40b3423d
- SHA512 1032c8deb25b92cd9b3ab5fa0e8da2b45e6766914c1fbb74f704824e397e16883f64228aff99bdc2afc476a0c151ea6b776a41c4aab070c3d4d79f9be29163d9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsmE511.tmp\legal.ini
- Size 1KB
- SHA256 07008c1bb5bd3f81def5c7ddf0c7dedc5c0452447ba12630793034a8cfef65e3
- MD5 6441e601e893bf6cd45d128f2978fd54
- SHA1 8f161420752c293157c8c42058c3267154c172f3
- SHA512 1ee900ca0e2f871ca7171fa551587a9c1c5b8955116cb7df63640f4dd8b1423e3b56d45f7076e32cd92b1bbc34ac775a649b0daab2b6b8f93a9626947c3a2582
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\LimeWire\browser\xulrunner\chrome\classic.jar
- Size 759KB
- SHA256 aa68c283a5a447b5d050a99fa780194a85ca5bda8d88ae1ce0ab524ca14ee8c1
- MD5 ee66b755fbe00931dfefb8b30869f6db
- SHA1 36f88c3380f6491c3cff5458197e2cf086079504
- SHA512 2770733be288a3cca503bf91c28821e30587354622e7c8854f2c849015df63cb9eb141c4888cdcec0d7f75ce28a307d0adc7170e448270a2b6e18cee3bed3ee4
- SSDEEP 12288:bIiQ6BMpgT9bl9xGdycTcEc4GVIziPOr7O7eUo6MzFwW1ZsQGMFR0/oLL2RSRoc4:toLL2NONQdEKrV1t
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\LimeWire\browser\xulrunner\chrome\en-US.jar
- Size 324KB
- SHA256 d7f81742dfe3d35cda6f22e449879bfa37c7a6abba560432d517792c5bf2adac
- MD5 5c1624554ce568d668f2e7bfc11151b9
- SHA1 51180b987c7305cfd176e4d92b936eff4e001f62
- SHA512 9947e985674e126285108ae1fc9f5fe75e04e9315937b01676a97ebfc8eae6f8d2933c5783b5c7b6507058cbec53fe3ea7f0d52ef5c36a7e47991935c953d6c7
- SSDEEP 6144:vx/FLt5zt1Y5sPue+6NGMaHGMQ0huN7DTTVTGsss5vtfxnB/JTE4bXdJIYAFw+oA:vx/FLt5zt1Y5sPue+6N3aHGGC/VTGssl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\LimeWire\browser\xulrunner\chrome\limewire.jar
- Size 8KB
- SHA256 ad06cbee7fb1bde10498b342a584e68d69d87bcad1e0b15fcc49ffe520709779
- MD5 964744738869ff5f4febae1b42c35da4
- SHA1 f2192d0453001ec9ffac1c29617aaf0ec5baffd4
- SHA512 191866e6c7292ca912cf19cdb824a42a7de0d5a28a55da49c1f26cb5d600345491e5e11a589b19dd307349e74f75bb865029df9f129ec6ff61c4d5eba2181117
- SSDEEP 192:5y8uM4QxwSIY+eLGpM2IhIilnvyZwdSmatTzAy5Gl/fNYk:zJ4sKHeLGphGIUnvyZ59zAy5a/f5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\LimeWire\browser\xulrunner\msvcr71.dll
- Size 340KB
- SHA256 8094af5ee310714caebccaeee7769ffb08048503ba478b879edfef5f1a24fefe
- MD5 86f1895ae8c5e8b17d99ece768a70732
- SHA1 d5502a1d00787d68f548ddeebbde1eca5e2b38ca
- SHA512 3b7ce2b67056b6e005472b73447d2226677a8cadae70428873f7efa5ed11a3b3dbf6b1a42c5b05b1f2b1d8e06ff50dfc6532f043af8452ed87687eefbf1791da
- SSDEEP 6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\LimeWire\browser\xulrunner\plugins\npnul32.dll
- Size 56KB
- SHA256 a14628fdb1808d760bd538b61c5fc6a1730c6c3c5c5e345470e1b68d789a4876
- MD5 6078bb60da0bc6d988d1cbc66a9072c6
- SHA1 40527bd71f83527b691497ca06f87f24a77b782a
- SHA512 2d7ec502a3d5bfeaec14e4480b07c1e17d9bf1430a8598438074e012e6883ffca2c5814567d752a82411c1b166278cf530b24eadfde16578ce857fa20f078f7c
- SSDEEP 768:pQbwuoA/mVUnB3nmQBIDRVkymwK7ILpsioEtWkHBESq24:0iA/mVkfIDTkymwfLgsPBEt24
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\LimeWire\library5.bak
- Size 454B
- SHA256 0ce6070e7d057f659863d84173204ba728e722abfcb94239a6c89c5b0ae66a57
- MD5 47863d0411b0b2c5290b26a8fc90f1fd
- SHA1 09d868de3e25b7f013a2b3902a9b8ea64e869642
- SHA512 b41df7eab11378e53a181a6dae1284a88960f7b56aa61343562995b8e6a3de6c3497b2835672079606c897ef3884603930761820f79532f50f4d127baece60a5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\LimeWire\update.cert9196990367231800939tmp
- Size 786B
- SHA256 35d67c73d6ee53c67acdac83473103084f15b4c92e1aca32d02751991ade1ea2
- MD5 320fea5fefa7201eb43aa333f6567e0b
- SHA1 2c1c065a48d0cbc19491c63c00d3982afa3010a3
- SHA512 14f5c47feece97af0ae256b9d2f1e5a451047ec101df080478c2eaaf68bd8877d8d76fb2b454af1d0107175e2d4899c061eedba5de0787060e7513878f3c42b2
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\MSI3A06.tmp
- Size 108KB
- SHA256 f824ddc055db061a77b0a0a4f2e7224c0df074aa60c0540f96724be416100c03
- MD5 a31e140d42571f7deadf5878aca17e0e
- SHA1 c3e4bb0550970f31711482cc02dafce025f1103d
- SHA512 61ddcfffa695dcee62b99df78a08c03946830e66fc732b1aaaec8311be771375bcc4f8932269a8db7f8565509a1cb6a9b4747aec046b7d5e00cb75048a21ee71
- SSDEEP 3072:OqvY98JJhNJpEgvObzeoAXEkjVsupDljX6:WEJhDvv+SoAXEkjmK
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\LocalLow\Sun\Java\JRE16~1.0_1\lzma.dll
- Size 149KB
- SHA256 eb3471cf995199aebab00bf98cd2aaa5ba9afed8b85cdf1e82ffb98b288fa8ec
- MD5 3e87b9412a214afeed6603382c81ca49
- SHA1 501acfcb9959d77a9afbc058749d8f4bb4bc5cc7
- SHA512 13ee969236feffce696d04fb2106de8457f8c3aad40cea4211ee2595bbf1d657506b0e88e8c32d1626f0bec85d84cf71ad4f5410c8fb99a9bbbd0a5d157209c6
- SSDEEP 3072:A4gmoAZplSUS5IIiqbukO/3msvJv7DDpNePhFpnVlEC2:BgmoADlSUSWIlbuks3mGvnDpNohzkC
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nsmE511.tmp\FindProcDLL.dll
- Size 3KB
- SHA256 0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
- MD5 8614c450637267afacad1645e23ba24a
- SHA1 e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
- SHA512 af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
- MD5 SHA1 SHA512
- Path \Users\Admin\AppData\Local\Temp\nsmE511.tmp\InstallOptions.dll
- Size 14KB
- SHA256 8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c
- MD5 0dc0cc7a6d9db685bf05a7e5f3ea4781
- SHA1 5d8b6268eeec9d8d904bc9d988a4b588b392213f
- SHA512 814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0
- SSDEEP 192:n6d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jPK72dwF7dBEnbok:n6UdHXcIiY535zBt2jP+BEnbo
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nsmE511.tmp\LangDLL.dll
- Size 5KB
- SHA256 2a7f33ef64d666a42827c4dc377806ad97bc233819197adf9696aed5be5efac0
- MD5 a401e590877ef6c928d2a97c66157094
- SHA1 75e24799cf67e789fadcc8b7fddefc72fdc4cd61
- SHA512 6093415cd090e69cdcb52b5d381d0a8b3e9e5479dac96be641e0071f1add26403b27a453febd8ccfd16393dc1caa03404a369c768a580781aba3068415ee993f
- SSDEEP 48:iV6sAvmNC6iMPUptxEZK65x/AmvycNSmwVsOYJyvrpXptp/JvR0Joof5d2:2V11GED5ZTvycNSmwVsTJuftpZR0Ld2
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nsmE511.tmp\LockedList.dll
- Size 18KB
- SHA256 c79c0b410049411a70293f1657a2144d71a647753785f5134f47f1f977f90fd3
- MD5 acb2534a2b90fcdc079966203abb83a6
- SHA1 36e6842e78d8f1c6e2f3a6d93667bef1cfa5d3d6
- SHA512 e77b6b1d09b59af51e3f98debdd8eb472778c339be71849e19b5ad3f262c037bf050d3fd892d194ca24b9fd43c682d1a903629318792a2fd9fee4582d316b959
- SSDEEP 192:8X3aaH6S1xA9hTSrlnUieI65sD1BIYF3uzyBLff3lhOh18iaLI+AmOZrfCTliZPO:sKQzln7xrPlhOh1Xa05fCTlUPf5hXuz
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nsmE511.tmp\UserInfo.dll
- Size 4KB
- SHA256 7d099352c82612ab27ddfd7310c1aa049b58128fb04ea6ea55816a40a6f6487b
- MD5 1e8e11f465afdabe97f529705786b368
- SHA1 ea42bed65df6618c5f5648567d81f3935e70a2a0
- SHA512 16566a8c1738e26962139aae893629098dc759e4ac87df3e8eb9819df4e0e422421836bb1e4240377e00fb2f4408ce40f40eee413d0f6dd2f3a4e27a52d49a0b
- MD5 SHA1 SHA512