Analysis
- max time kernel
360s - max time network
325s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
28/04/2024, 16:04
Behavioral task
behavioral1
Sample
Limewire_5.5.16.exe
Resource
win10-20240404-en
windows10-1703-x64
26 signatures
300 seconds
Behavioral task
behavioral2
Sample
Limewire_5.5.16.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
25 signatures
300 seconds
General
- Target Limewire_5.5.16.exe
- Size 28.8MB
- Sample240428-th496sbf21
- SHA256 f6ca4c41fceab0cb136ad06eaa0a4c82e209948238e6873ed7ea4022ad41c54b
- MD5 f5ff2057c5cdbb6dc15e43ee4ffe4526
- SHA1 2562bffe3eecc91ca17316ca127d0eba63fe9b8c
- SHA512 280f1d27d8a69ed1ffdda419ec224c7280d099a77c8a4d124ae2169ada808bfd76fc8fe0236129ac24c839352f6077da6c6d4dc7054b91323a3def001dee1346
- SSDEEP 786432:xUtL12zR8JB66fGSPOX9TtfnAN3/920A3r20aeKI3:xUV10R34GSYP2/9tAfKI3
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Modifies Installed Components in the registry 2 TTPs 7 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}\Version = "5,0,5000,0" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}\Locale = "EN" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}\ = "Java (Sun)" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}\ComponentID = "JAVAVM" MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}\IsInstalled = "1" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}\KeyFileName = "C:\\Program Files (x86)\\Java\\jre6\\bin\\regutils.dll" MsiExec.exe - Executes dropped EXE 16 IoCs
pid Process 4528 FP_PL_MSI_INSTALLER.exe 2780 jrestub.exe 556 zipper.exe 692 unpack200.exe 1720 unpack200.exe 860 unpack200.exe 4420 unpack200.exe 2924 unpack200.exe 3964 unpack200.exe 4504 unpack200.exe 2624 javaw.exe 3904 javaw.exe 3552 execNoWindow.exe 4872 unpack200.exe 1996 toolbarChecker.exe 384 LimeWire.exe - Loads dropped DLL 64 IoCs
pid Process 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 464 MsiExec.exe 4528 FP_PL_MSI_INSTALLER.exe 4528 FP_PL_MSI_INSTALLER.exe 4528 FP_PL_MSI_INSTALLER.exe 4528 FP_PL_MSI_INSTALLER.exe 4528 FP_PL_MSI_INSTALLER.exe 4528 FP_PL_MSI_INSTALLER.exe 4528 FP_PL_MSI_INSTALLER.exe 4528 FP_PL_MSI_INSTALLER.exe 4528 FP_PL_MSI_INSTALLER.exe 4528 FP_PL_MSI_INSTALLER.exe 4528 FP_PL_MSI_INSTALLER.exe 4528 FP_PL_MSI_INSTALLER.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 2780 jrestub.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3760 MsiExec.exe 3760 MsiExec.exe 3760 MsiExec.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3760 MsiExec.exe 3760 MsiExec.exe 3760 MsiExec.exe 3760 MsiExec.exe 3760 MsiExec.exe 3760 MsiExec.exe 3760 MsiExec.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/files/0x000a000000023418-366.dat upx behavioral2/memory/2780-368-0x0000000000400000-0x00000000005D2000-memory.dmp upx behavioral2/memory/2780-481-0x0000000000400000-0x00000000005D2000-memory.dmp upx behavioral2/memory/2780-1176-0x0000000000400000-0x00000000005D2000-memory.dmp upx behavioral2/memory/2780-1322-0x0000000000400000-0x00000000005D2000-memory.dmp upx - Blocklisted process makes network request 2 IoCs
flow pid Process 39 3760 MsiExec.exe 41 3760 MsiExec.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe - Installs/modifies Browser Helper Object 2 TTPs 5 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\NoExplorer = "1" MsiExec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9} MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\NoExplorer = "1" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} MsiExec.exe - Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\javaws.exe MsiExec.exe File opened for modification C:\Windows\SysWOW64\Macromed\Flash\install.log FP_PL_MSI_INSTALLER.exe File created C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll FP_PL_MSI_INSTALLER.exe File created C:\Windows\SysWOW64\Macromed\Flash\uninstall_plugin.exe FP_PL_MSI_INSTALLER.exe File created C:\Windows\SysWOW64\java.exe MsiExec.exe File created C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_FlashUtil.exe FP_PL_MSI_INSTALLER.exe File created C:\Windows\SysWOW64\Macromed\Flash\flashplayer.xpt FP_PL_MSI_INSTALLER.exe File created C:\Windows\SysWOW64\javaw.exe MsiExec.exe File created C:\Windows\SysWOW64\deploytk.dll MsiExec.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Java\jre6\bin\npjpi160_18.dll zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\plugin.pack zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Africa\Bissau zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\America\Yellowknife zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Asia\Aqtau zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Europe\Simferopol zipper.exe File opened for modification C:\Program Files (x86)\LimeWire\lib\autoupdate-windows.exe Limewire_5.5.16.exe File created C:\Program Files (x86)\LimeWire\LimeWire.jar.tmp unpack200.exe File created C:\Program Files (x86)\Java\jre6\lib\ext\meta-index zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\America\Santo_Domingo zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Asia\Riyadh88 zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Asia\Sakhalin zipper.exe File created C:\Program Files (x86)\Java\jre6\bin\instrument.dll zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\SystemV\YST9 zipper.exe File created C:\Program Files (x86)\LimeWire\pmf.ico Limewire_5.5.16.exe File created C:\Program Files (x86)\Java\jre6\bin\javacpl.exe zipper.exe File created C:\Program Files (x86)\Java\jre6\bin\java_crw_demo.dll zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Africa\Khartoum zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Atlantic\Bermuda zipper.exe File created C:\Program Files (x86)\LimeWire\lib\avg\Microsoft.VC80.ATL.manifest Limewire_5.5.16.exe File opened for modification C:\Program Files (x86)\LimeWire\root Limewire_5.5.16.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\America\Antigua zipper.exe File created C:\Program Files (x86)\Java\jre6\bin\rmi.dll zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\America\Araguaina zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\America\St_Kitts zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Pacific\Kwajalein zipper.exe File created C:\Program Files (x86)\LimeWire\lib\jacob-1.15-M1-lw-x86.dll Limewire_5.5.16.exe File opened for modification C:\Program Files (x86)\LimeWire\lib\avg\ATL80.dll Limewire_5.5.16.exe File created C:\Program Files (x86)\Java\jre6\bin\ioser12.dll zipper.exe File created C:\Program Files (x86)\Java\jre6\bin\jp2iexp.dll zipper.exe File created C:\Program Files (x86)\Java\jre6\bin\mlib_image.dll zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\flavormap.properties zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\jsse.pack zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\rt.pack zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Asia\Almaty zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Asia\Dubai zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\plugin.jar unpack200.exe File created C:\Program Files (x86)\LimeWire\lib\avg\Microsoft.VC80.CRT.manifest Limewire_5.5.16.exe File created C:\Program Files (x86)\Java\jre6\lib\security\javaws.policy zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\America\Argentina\Ushuaia zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Etc\GMT+3 zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Etc\GMT-12 zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Etc\GMT-8 zipper.exe File created C:\Program Files (x86)\LimeWire\spacer.gif Limewire_5.5.16.exe File created C:\Program Files (x86)\LimeWire\lib\avg\ATL80.dll Limewire_5.5.16.exe File created C:\Program Files (x86)\Java\jre6\lib\deploy\messages_zh_TW.properties zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Etc\GMT+9 zipper.exe File created C:\Program Files (x86)\LimeWire\Buy LimeWire PRO.url Limewire_5.5.16.exe File created C:\Program Files (x86)\Java\jre6\lib\deploy\messages_es.properties zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\management\jmxremote.password.template zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Africa\Monrovia zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\America\Los_Angeles zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\America\Menominee zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\America\St_Vincent zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Etc\GMT+8 zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Pacific\Ponape zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\ext\localedata.jar unpack200.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Africa\Sao_Tome zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Atlantic\St_Helena zipper.exe File created C:\Program Files (x86)\LimeWire\lib\torrent-wrapper.dll Limewire_5.5.16.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Australia\Adelaide zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Pacific\Kosrae zipper.exe File opened for modification C:\Program Files (x86)\LimeWire\lib Limewire_5.5.16.exe File opened for modification C:\Program Files (x86)\LimeWire\root\magnet10\limewire.gif Limewire_5.5.16.exe - Drops file in Windows directory 49 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{26A24AE4-039D-4CA4-87B4-2F83216018FF} msiexec.exe File opened for modification C:\Windows\Installer\MSI8AFD.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9868.tmp msiexec.exe File opened for modification C:\Windows\Installer\{AF36CE1D-FD2C-4BA0-93FA-1196785DD610}\ARPPRODUCTICON.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI885C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8A65.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8A97.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8B20.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI93D1.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI67B4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI88BB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8FA6.tmp msiexec.exe File created C:\Windows\Installer\{AF36CE1D-FD2C-4BA0-93FA-1196785DD610}\ARPPRODUCTICON.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI8AFC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9285.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{AF36CE1D-FD2C-4BA0-93FA-1196785DD610} msiexec.exe File created C:\Windows\Installer\e57653b.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI9363.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8B30.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8A86.tmp msiexec.exe File opened for modification C:\Windows\Installer\e576537.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI8AB9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8AEC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI92F5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9402.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\e576536.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI8A64.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8B0E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8987.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8A98.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI92C5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8AA8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8AC9.tmp msiexec.exe File created C:\Windows\Installer\e576537.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI8ACA.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI66D8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9898.tmp msiexec.exe File opened for modification C:\Windows\Installer\e57653c.msi msiexec.exe File created C:\Windows\Installer\e576532.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI8A75.tmp msiexec.exe File created C:\Windows\Installer\e57653c.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI89D6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8ADB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8B0F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI93F2.tmp msiexec.exe File opened for modification C:\Windows\Installer\e576532.msi msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- NSIS installer 1 IoCs
resource yara_rule behavioral2/files/0x0007000000023423-270.dat nsis_installer_1 - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msiexec.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msiexec.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppPath = "C:\\Program Files (x86)\\Java\\jre6\\bin" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3B9A6E32-36C9-4946-B78C-3F58E3785EC1} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3B9A6E32-36C9-4946-B78C-3F58E3785EC1}\AppPath = "C:\\Program Files (x86)\\Java\\jre6\\bin" MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\Policy = "3" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppName = "ssvagent.exe" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppName = "jp2launcher.exe" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppPath = "C:\\Program Files (x86)\\Java\\jre6\\bin" MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3B9A6E32-36C9-4946-B78C-3F58E3785EC1}\Policy = "3" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284} MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\Policy = "3" MsiExec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3B9A6E32-36C9-4946-B78C-3F58E3785EC1}\AppName = "unpack200.exe" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppName = "javaws.exe" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A} MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\Policy = "3" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppPath = "C:\\Program Files (x86)\\Java\\jre6\\bin" MsiExec.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA}\ = "Java Plug-in 1.4.2_01" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBB} MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBC}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBC} MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBB} MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC} MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_15" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB} MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB} MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBB} MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBC} MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_22" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBC} MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.0_05" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBC} MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC} MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA} MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBB} MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBC}\InprocServer32 MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBA} MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_11" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_21" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_14" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBC} MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBB} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBA} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBA}\ = "Java Plug-in 1.4.2_23" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBA} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-FFFF-ABCDEFFEDCBA}\ = "Java Plug-in 1.4.2" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBB} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.1_24" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\Programmable MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2A356413-7990-4D57-B190-66E598688699}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" Limewire_5.5.16.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-FFFF-ABCDEFFEDCBA}\MiscStatus\1\ = "2449" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBC}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.1_07" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{101C3C04-F61D-437A-92F5-FB52D88CEE95}\ProxyStubClsid Limewire_5.5.16.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LimeWire\DefaultIcon\ = "C:\\Program Files (x86)\\LimeWire\\LimeWire.exe,1" LimeWire.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBB} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBB} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\magnet\DefaultIcon\ = "\"C:\\Program Files (x86)\\LimeWire\\LimeWire.exe\",0" LimeWire.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-FFFF-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBB} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBC} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.1_19" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{5745A111-323D-423C-B7FB-74C4C19F47D9} Limewire_5.5.16.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4299124F-F2C3-41b4-9C73-9236B2AD0E8F}\System.ControlPanel.Category = "8" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JavaPlugin.160_18\CLSID MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.1_06" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}\ = "Java Plug-in 1.3.1_04" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.2_26" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_04" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_07" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.1_03" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\magnet\shell\open\command LimeWire.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_14" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\InprocServer32 MsiExec.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85371CA6E550143DCE2803471BDE3A09E8F8770F jrestub.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85371CA6E550143DCE2803471BDE3A09E8F8770F\Blob = 0f0000000100000014000000d95944f5bd92127092218f9f02c719c42386b49909000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030162000000010000002000000083ce3c1229688a593d485f81973c0f9195431eda37cc5e36430e79c7a888638b1400000001000000140000001a21b4952b6293ce18b365ec9c0e934cb381e6d40b000000010000001200000056006500720069005300690067006e0000001d00000001000000100000007173fa7247886438eb10b0f4e8a0cc186800000001000000080000000000876ace99d10103000000010000001400000085371ca6e550143dce2803471bde3a09e8f8770f200000000100000006030000308203023082026b02107dd9fe07cfa81eb7107967fba78934c6300d06092a864886f70d01010505003081c1310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e313c303a060355040b1333436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204732313a3038060355040b1331286329203139393820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d060355040b1316566572695369676e205472757374204e6574776f726b301e170d3938303531383030303030305a170d3238303830313233353935395a3081c1310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e313c303a060355040b1333436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204732313a3038060355040b1331286329203139393820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d060355040b1316566572695369676e205472757374204e6574776f726b30819f300d06092a864886f70d010101050003818d0030818902818100cc5ed1115d5c69d0abd3b96a4c991f5998308e168520466d473fd4852084e16db3f8a4ed0cf1170f3bf9a7f925d7c1cf8463f27c63cfa247f2c65b338e64400468c180b9641c4577c7d86ef595293c50e834d7781fa8ba6d4391958f45575e7ec5fbcaa404ebea973754306fbb01473233cddc579b646961f89b1d1c894f5c670203010001300d06092a864886f70d010105050003818100514dcdbe5ccb98199c15b20139782e4d0f67707099c6105a94a4534d546d2baf0d5d408b64d3d7eede5661925fa6c41d106136d32c273ce82909b9116474ccb5739f1c48a9bc6101eee217a60ce340083b0ee7eb44732a9af16992ef7114c339ac71a791096fe47106b3ba5957267900f6f80da2333028d4aa58a09d9d6991fd jrestub.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85371CA6E550143DCE2803471BDE3A09E8F8770F\Blob = 190000000100000010000000b24f9926afcb335d4349d24b71f41a6703000000010000001400000085371ca6e550143dce2803471bde3a09e8f8770f6800000001000000080000000000876ace99d1011d00000001000000100000007173fa7247886438eb10b0f4e8a0cc180b000000010000001200000056006500720069005300690067006e0000001400000001000000140000001a21b4952b6293ce18b365ec9c0e934cb381e6d462000000010000002000000083ce3c1229688a593d485f81973c0f9195431eda37cc5e36430e79c7a888638b09000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703010f0000000100000014000000d95944f5bd92127092218f9f02c719c42386b499200000000100000006030000308203023082026b02107dd9fe07cfa81eb7107967fba78934c6300d06092a864886f70d01010505003081c1310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e313c303a060355040b1333436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204732313a3038060355040b1331286329203139393820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d060355040b1316566572695369676e205472757374204e6574776f726b301e170d3938303531383030303030305a170d3238303830313233353935395a3081c1310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e313c303a060355040b1333436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204732313a3038060355040b1331286329203139393820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d060355040b1316566572695369676e205472757374204e6574776f726b30819f300d06092a864886f70d010101050003818d0030818902818100cc5ed1115d5c69d0abd3b96a4c991f5998308e168520466d473fd4852084e16db3f8a4ed0cf1170f3bf9a7f925d7c1cf8463f27c63cfa247f2c65b338e64400468c180b9641c4577c7d86ef595293c50e834d7781fa8ba6d4391958f45575e7ec5fbcaa404ebea973754306fbb01473233cddc579b646961f89b1d1c894f5c670203010001300d06092a864886f70d010105050003818100514dcdbe5ccb98199c15b20139782e4d0f67707099c6105a94a4534d546d2baf0d5d408b64d3d7eede5661925fa6c41d106136d32c273ce82909b9116474ccb5739f1c48a9bc6101eee217a60ce340083b0ee7eb44732a9af16992ef7114c339ac71a791096fe47106b3ba5957267900f6f80da2333028d4aa58a09d9d6991fd jrestub.exe - Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 2484 msiexec.exe 2484 msiexec.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe 3048 Limewire_5.5.16.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3048 Limewire_5.5.16.exe Token: SeShutdownPrivilege 3664 msiexec.exe Token: SeIncreaseQuotaPrivilege 3664 msiexec.exe Token: SeSecurityPrivilege 2484 msiexec.exe Token: SeCreateTokenPrivilege 3664 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3664 msiexec.exe Token: SeLockMemoryPrivilege 3664 msiexec.exe Token: SeIncreaseQuotaPrivilege 3664 msiexec.exe Token: SeMachineAccountPrivilege 3664 msiexec.exe Token: SeTcbPrivilege 3664 msiexec.exe Token: SeSecurityPrivilege 3664 msiexec.exe Token: SeTakeOwnershipPrivilege 3664 msiexec.exe Token: SeLoadDriverPrivilege 3664 msiexec.exe Token: SeSystemProfilePrivilege 3664 msiexec.exe Token: SeSystemtimePrivilege 3664 msiexec.exe Token: SeProfSingleProcessPrivilege 3664 msiexec.exe Token: SeIncBasePriorityPrivilege 3664 msiexec.exe Token: SeCreatePagefilePrivilege 3664 msiexec.exe Token: SeCreatePermanentPrivilege 3664 msiexec.exe Token: SeBackupPrivilege 3664 msiexec.exe Token: SeRestorePrivilege 3664 msiexec.exe Token: SeShutdownPrivilege 3664 msiexec.exe Token: SeDebugPrivilege 3664 msiexec.exe Token: SeAuditPrivilege 3664 msiexec.exe Token: SeSystemEnvironmentPrivilege 3664 msiexec.exe Token: SeChangeNotifyPrivilege 3664 msiexec.exe Token: SeRemoteShutdownPrivilege 3664 msiexec.exe Token: SeUndockPrivilege 3664 msiexec.exe Token: SeSyncAgentPrivilege 3664 msiexec.exe Token: SeEnableDelegationPrivilege 3664 msiexec.exe Token: SeManageVolumePrivilege 3664 msiexec.exe Token: SeImpersonatePrivilege 3664 msiexec.exe Token: SeCreateGlobalPrivilege 3664 msiexec.exe Token: SeRestorePrivilege 2484 msiexec.exe Token: SeTakeOwnershipPrivilege 2484 msiexec.exe Token: SeRestorePrivilege 2484 msiexec.exe Token: SeTakeOwnershipPrivilege 2484 msiexec.exe Token: SeRestorePrivilege 2484 msiexec.exe Token: SeTakeOwnershipPrivilege 2484 msiexec.exe Token: SeRestorePrivilege 2484 msiexec.exe Token: SeTakeOwnershipPrivilege 2484 msiexec.exe Token: SeRestorePrivilege 2484 msiexec.exe Token: SeTakeOwnershipPrivilege 2484 msiexec.exe Token: SeRestorePrivilege 2484 msiexec.exe Token: SeTakeOwnershipPrivilege 2484 msiexec.exe Token: SeRestorePrivilege 2484 msiexec.exe Token: SeTakeOwnershipPrivilege 2484 msiexec.exe Token: SeRestorePrivilege 2484 msiexec.exe Token: SeTakeOwnershipPrivilege 2484 msiexec.exe Token: SeRestorePrivilege 2484 msiexec.exe Token: SeTakeOwnershipPrivilege 2484 msiexec.exe Token: SeRestorePrivilege 2484 msiexec.exe Token: SeTakeOwnershipPrivilege 2484 msiexec.exe Token: SeRestorePrivilege 2484 msiexec.exe Token: SeTakeOwnershipPrivilege 2484 msiexec.exe Token: SeRestorePrivilege 2484 msiexec.exe Token: SeTakeOwnershipPrivilege 2484 msiexec.exe Token: SeRestorePrivilege 2484 msiexec.exe Token: SeTakeOwnershipPrivilege 2484 msiexec.exe Token: SeRestorePrivilege 2484 msiexec.exe Token: SeTakeOwnershipPrivilege 2484 msiexec.exe Token: SeRestorePrivilege 2484 msiexec.exe Token: SeTakeOwnershipPrivilege 2484 msiexec.exe Token: SeRestorePrivilege 2484 msiexec.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 384 LimeWire.exe 384 LimeWire.exe 384 LimeWire.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 384 LimeWire.exe 384 LimeWire.exe 384 LimeWire.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 3048 Limewire_5.5.16.exe 384 LimeWire.exe 384 LimeWire.exe 384 LimeWire.exe 384 LimeWire.exe 384 LimeWire.exe 384 LimeWire.exe 384 LimeWire.exe 384 LimeWire.exe 384 LimeWire.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3048 wrote to memory of 3664 3048 Limewire_5.5.16.exe 87 PID 3048 wrote to memory of 3664 3048 Limewire_5.5.16.exe 87 PID 3048 wrote to memory of 3664 3048 Limewire_5.5.16.exe 87 PID 2484 wrote to memory of 464 2484 msiexec.exe 90 PID 2484 wrote to memory of 464 2484 msiexec.exe 90 PID 2484 wrote to memory of 464 2484 msiexec.exe 90 PID 2484 wrote to memory of 4528 2484 msiexec.exe 91 PID 2484 wrote to memory of 4528 2484 msiexec.exe 91 PID 2484 wrote to memory of 4528 2484 msiexec.exe 91 PID 3048 wrote to memory of 2780 3048 Limewire_5.5.16.exe 92 PID 3048 wrote to memory of 2780 3048 Limewire_5.5.16.exe 92 PID 3048 wrote to memory of 2780 3048 Limewire_5.5.16.exe 92 PID 2780 wrote to memory of 1156 2780 jrestub.exe 93 PID 2780 wrote to memory of 1156 2780 jrestub.exe 93 PID 2780 wrote to memory of 1156 2780 jrestub.exe 93 PID 2484 wrote to memory of 3760 2484 msiexec.exe 94 PID 2484 wrote to memory of 3760 2484 msiexec.exe 94 PID 2484 wrote to memory of 3760 2484 msiexec.exe 94 PID 2484 wrote to memory of 1996 2484 msiexec.exe 95 PID 2484 wrote to memory of 1996 2484 msiexec.exe 95 PID 2484 wrote to memory of 1996 2484 msiexec.exe 95 PID 1996 wrote to memory of 556 1996 MsiExec.exe 96 PID 1996 wrote to memory of 556 1996 MsiExec.exe 96 PID 1996 wrote to memory of 556 1996 MsiExec.exe 96 PID 1996 wrote to memory of 692 1996 MsiExec.exe 97 PID 1996 wrote to memory of 692 1996 MsiExec.exe 97 PID 1996 wrote to memory of 692 1996 MsiExec.exe 97 PID 1996 wrote to memory of 1720 1996 MsiExec.exe 98 PID 1996 wrote to memory of 1720 1996 MsiExec.exe 98 PID 1996 wrote to memory of 1720 1996 MsiExec.exe 98 PID 1996 wrote to memory of 860 1996 MsiExec.exe 99 PID 1996 wrote to memory of 860 1996 MsiExec.exe 99 PID 1996 wrote to memory of 860 1996 MsiExec.exe 99 PID 1996 wrote to memory of 4420 1996 MsiExec.exe 100 PID 1996 wrote to memory of 4420 1996 MsiExec.exe 100 PID 1996 wrote to memory of 4420 1996 MsiExec.exe 100 PID 1996 wrote to memory of 2924 1996 MsiExec.exe 101 PID 1996 wrote to memory of 2924 1996 MsiExec.exe 101 PID 1996 wrote to memory of 2924 1996 MsiExec.exe 101 PID 1996 wrote to memory of 3964 1996 MsiExec.exe 102 PID 1996 wrote to memory of 3964 1996 MsiExec.exe 102 PID 1996 wrote to memory of 3964 1996 MsiExec.exe 102 PID 1996 wrote to memory of 4504 1996 MsiExec.exe 103 PID 1996 wrote to memory of 4504 1996 MsiExec.exe 103 PID 1996 wrote to memory of 4504 1996 MsiExec.exe 103 PID 2484 wrote to memory of 2624 2484 msiexec.exe 104 PID 2484 wrote to memory of 2624 2484 msiexec.exe 104 PID 2484 wrote to memory of 2624 2484 msiexec.exe 104 PID 2484 wrote to memory of 3904 2484 msiexec.exe 105 PID 2484 wrote to memory of 3904 2484 msiexec.exe 105 PID 2484 wrote to memory of 3904 2484 msiexec.exe 105 PID 3904 wrote to memory of 4532 3904 javaw.exe 106 PID 3904 wrote to memory of 4532 3904 javaw.exe 106 PID 3904 wrote to memory of 4532 3904 javaw.exe 106 PID 4532 wrote to memory of 5088 4532 cmd.exe 108 PID 4532 wrote to memory of 5088 4532 cmd.exe 108 PID 4532 wrote to memory of 5088 4532 cmd.exe 108 PID 3904 wrote to memory of 1000 3904 javaw.exe 110 PID 3904 wrote to memory of 1000 3904 javaw.exe 110 PID 3904 wrote to memory of 1000 3904 javaw.exe 110 PID 1000 wrote to memory of 3032 1000 cmd.exe 112 PID 1000 wrote to memory of 3032 1000 cmd.exe 112 PID 1000 wrote to memory of 3032 1000 cmd.exe 112 PID 2780 wrote to memory of 5060 2780 jrestub.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\Limewire_5.5.16.exe"C:\Users\Admin\AppData\Local\Temp\Limewire_5.5.16.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\msiexec.exemsiexec /i C:\Users\Admin\AppData\Local\Temp\install_flash_player_10_plugin.msi /qn2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:3664
-
-
C:\Users\Admin\AppData\Local\Temp\jrestub.exeC:\Users\Admin\AppData\Local\Temp\jrestub.exe /s /L C:\Users\Admin\AppData\Local\Temp\jrelog.txt IEXPLORER=0 MOZILLA=0 REBOOT=Suppress2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\\msiexec.exe" /i "C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.6.0_18\jre1.6.0_18-c-l.msi" /qn ED=0 SP1OFF=1 SP2OFF=1 SP3OFF=1 SP4OFF=1 SP5OFF=1 SP6OFF=1 SP7OFF=1 SP8OFF=1 SP9OFF=1 SP10OFF=1 SPWEB=http://javadl-esd.sun.com/update/1.6.0/sp-1.6.0_18-b74 /L C:\Users\Admin\AppData\Local\Temp\jrelog.txt IEXPLORER=0 MOZILLA=0 REBOOT=Suppress METHOD=jother PROG=03⤵PID:1156
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\\msiexec.exe" /i "C:\Users\Admin\AppData\LocalLow\Sun\Java\AU\au.msi" ALLUSERS=1 /qn PROG=03⤵PID:5060
-
-
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe"C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe" -r jre 1.6.0_18-b743⤵PID:5000
-
-
-
C:\Program Files (x86)\LimeWire\execNoWindow.exe"C:\Program Files (x86)\LimeWire\execNoWindow.exe" "C:\Program Files (x86)\LimeWire\unpack200.exe" -v -l "C:\Program Files (x86)\LimeWire\unpack.log" "C:\Program Files (x86)\LimeWire\LimeWire.pack" "C:\Program Files (x86)\LimeWire\LimeWire.jar.tmp"2⤵
- Executes dropped EXE
PID:3552 -
C:\Program Files (x86)\LimeWire\unpack200.exe"C:\Program Files (x86)\LimeWire\unpack200.exe" -v -l "C:\Program Files (x86)\LimeWire\unpack.log" "C:\Program Files (x86)\LimeWire\LimeWire.pack" "C:\Program Files (x86)\LimeWire\LimeWire.jar.tmp"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4872
-
-
-
C:\Users\Admin\AppData\Local\Temp\toolbarChecker.exe"C:\Users\Admin\AppData\Local\Temp\toolbarChecker.exe" LMW42⤵
- Executes dropped EXE
PID:1996
-
-
C:\Program Files (x86)\LimeWire\LimeWire.exe"C:\Program Files (x86)\LimeWire\LimeWire.exe"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:384
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D44FB35CC339CE85098E8E0F5179C1CE2⤵
- Loads dropped DLL
PID:464
-
-
C:\Users\Admin\AppData\Local\Temp\FP_PL_MSI_INSTALLER.exe"C:\Users\Admin\AppData\Local\Temp\FP_PL_MSI_INSTALLER.exe" /s2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:4528
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 12AD8DACC7EB4289908F3EC9112CEDB82⤵
- Loads dropped DLL
- Blocklisted process makes network request
PID:3760
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6F5E1D7E77701D1305BD57234B25EEEC E Global\MSI00002⤵
- Modifies Installed Components in the registry
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Program Files (x86)\Java\jre6\zipper.exe"C:\Program Files (x86)\Java\jre6\zipper.exe" "C:\Program Files (x86)\Java\jre6\core.zip" "C:\Program Files (x86)\Java\jre6\" "C:\Users\Admin\AppData\Local\Temp\java_install.log"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:556
-
-
C:\Program Files (x86)\Java\jre6\bin\unpack200.exe"C:\Program Files (x86)\Java\jre6\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre6\lib\rt.pack" "C:\Program Files (x86)\Java\jre6\lib\rt.jar"3⤵
- Executes dropped EXE
PID:692
-
-
C:\Program Files (x86)\Java\jre6\bin\unpack200.exe"C:\Program Files (x86)\Java\jre6\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre6\lib\jsse.pack" "C:\Program Files (x86)\Java\jre6\lib\jsse.jar"3⤵
- Executes dropped EXE
PID:1720
-
-
C:\Program Files (x86)\Java\jre6\bin\unpack200.exe"C:\Program Files (x86)\Java\jre6\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre6\lib\plugin.pack" "C:\Program Files (x86)\Java\jre6\lib\plugin.jar"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:860
-
-
C:\Program Files (x86)\Java\jre6\bin\unpack200.exe"C:\Program Files (x86)\Java\jre6\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre6\lib\javaws.pack" "C:\Program Files (x86)\Java\jre6\lib\javaws.jar"3⤵
- Executes dropped EXE
PID:4420
-
-
C:\Program Files (x86)\Java\jre6\bin\unpack200.exe"C:\Program Files (x86)\Java\jre6\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre6\lib\deploy.pack" "C:\Program Files (x86)\Java\jre6\lib\deploy.jar"3⤵
- Executes dropped EXE
PID:2924
-
-
C:\Program Files (x86)\Java\jre6\bin\unpack200.exe"C:\Program Files (x86)\Java\jre6\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre6\lib\charsets.pack" "C:\Program Files (x86)\Java\jre6\lib\charsets.jar"3⤵
- Executes dropped EXE
PID:3964
-
-
C:\Program Files (x86)\Java\jre6\bin\unpack200.exe"C:\Program Files (x86)\Java\jre6\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre6\lib\ext\localedata.pack" "C:\Program Files (x86)\Java\jre6\lib\ext\localedata.jar"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4504
-
-
-
C:\Program Files (x86)\Java\jre6\bin\javaw.exe"C:\Program Files (x86)\Java\jre6\bin\javaw.exe" -Xshare:dump2⤵
- Executes dropped EXE
PID:2624
-
-
C:\Program Files (x86)\Java\jre6\bin\javaw.exe"C:\Program Files (x86)\Java\jre6\bin\javaw.exe" com.sun.servicetag.Installer -source "Windows JRE installer"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Windows\SysWOW64\cmd.execmd /C WMIC computersystem get model3⤵
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC computersystem get model4⤵PID:5088
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C WMIC computersystem get model3⤵
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC computersystem get model4⤵PID:3032
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C WMIC computersystem get manufacturer3⤵PID:224
-
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC computersystem get manufacturer4⤵PID:4528
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C WMIC bios get serialnumber3⤵PID:2564
-
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC bios get serialnumber4⤵PID:5108
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C WMIC cpu get manufacturer3⤵PID:3036
-
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC cpu get manufacturer4⤵PID:4800
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e576535.rbs
- Size 8KB
- SHA256 d1d508588ce936d21d5b683b9213eba53d846aa3dbf5a389515c854c75e07bd2
- MD5 931d0c7d21613d76c715dac4116478d6
- SHA1 0ca9385e31fae973c7b850a0147ccc76dd0c7f05
- SHA512 78e5c5618d16f3bb5e94c9b5e19344a7b8fc615be375dd8ddfd86ca0ddeb510965699fefa34918afccdb3be833739a3e548acd3ca42c49f071d92c96d6001159
- SSDEEP 192:AMDC0EeQciGsAel+D0Y8IAr+D0Y8IAyxZS0sopzl:A7HTHTCh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Config.Msi\e57653a.rbs
- Size 10KB
- SHA256 ad335e8e1b5447cf95c4ee44601d913908689d626806534e5c08e4dfb9b57edb
- MD5 b9a501d3efc02f992b95091a89de4378
- SHA1 4e5b98e551a65bfb28cfcfb64579f4c688045c49
- SHA512 29ce694bc143fb348fc79dc94135fc3f6124c2db98f4d46c2121bd4055615d6c073142d880da33403ed8c3b267a9f2503d52240edc07c4aa1a490edda68bd857
- SSDEEP 192:wsEE7XiG9AePMBYfZG0G5MBYfZd02K2u3Xpt+htLUbY5:w8yWlfxClf0wuf+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Java\jre6\lib\zi\GMT
- Size 27B
- SHA256 0a526439ed04845ce94f7e9ae55c689ad01e1493f3b30c5c2b434a31fa33a43d
- MD5 7da9aa0de33b521b3399a4ffd4078bdb
- SHA1 f188a712f77103d544d4acf91d13dbc664c67034
- SHA512 9d2170571a58aed23f29fc465c2b14db3511e88907e017c010d452ecdf7a77299020d71f8b621a86e94dd2774a5418612d381e39335f92e287a4f451ee90cfb6
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\LimeWire\LimeWire.exe
- Size 492KB
- SHA256 1ff8c71e2b4931cc62a624b465d6623ec41d8f457b81b71d2d38474513ffb86d
- MD5 2b7f2dc5741bb18f7f5ec7558da68197
- SHA1 850d6c91c1b0114e6585f5f7924ca7e8cb9ec97c
- SHA512 9de16fb7facb3cb7a959cd28eee572fdd03dd4fc62c8ee8603bc1d38b84e7369195eb12ce7f8a0997a69b6d30af716b8f81d4faa9893f72a711f87024719e012
- SSDEEP 6144:/r9QR0c4dF6U9GTBgFEViPySU5P6blpp7EWcd0+jJnvHuw4x7QCfs5H++80LS:/r9ZdEUMT6FEoKS6CbqWwjJZ4Tf6lLS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\LimeWire\LimeWire.ico
- Size 24KB
- SHA256 30657b82f1caa63d6a74e7f87df8882cf6162ef56c6d89f26830886842e84923
- MD5 933fa742ef155bbe47c5b603eb390694
- SHA1 5440590c53cba80d24ff282d1f1051c881a2530a
- SHA512 2e43b97a46ae843dee1efa0298c90539bc7ac7f0f56b4cb5cf8e82eb9b51d7a7793d8e0254d5998075e916c0a3e722d9306a68e807d8b4230be6faa274eea3a5
- SSDEEP 384:fbvp5VxDbu2gHUM2qpCVAodZxPckXNt+jX66sYuM+wXVDkch:Dx5VxDbu50IiVL+HsLM+GBl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A92F33496848CFF4F115ED04BCDD933A_6C14F82F698E40985D569864739DB21B
- Size 5B
- SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
- MD5 5bfa51f3a417b98e7443eca90fc94703
- SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
- SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A92F33496848CFF4F115ED04BCDD933A_6C14F82F698E40985D569864739DB21B
- Size 408B
- SHA256 e9a2b264821c8c3e9f71a55f9dbc8e15aa29759916d83aa103c6bd7f5d585298
- MD5 f2a758b37f94ba15d778a9004a18e914
- SHA1 f7455a69f1d8d4ae8769bf1c5d3d3dccc4c20283
- SHA512 75e6d2ce26535aa53e14f6fbc0042d8234a7bffcaf3d3eb53923202a3ae75477416622a9a241e1765d9801d8af3db531fa5bd5d1004d34fe330dedd96c467401
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.6.0_18\jre1.6.0_18-c-l.msi
- Size 11.8MB
- SHA256 d8dbf634e775d8fdcb6891758520cf8ab80a32de2c94e9493ceab93cedf5ecf8
- MD5 53df295a99335d837423249e600c78ac
- SHA1 7266661133fd1a4e5566ed876b94b600fbdc27bf
- SHA512 ff0404f87453be69331411043e76b09aba87e6d7abefd3f70af421cf04103aff0ed226eaae4aad75b04118cde1cbf5257bbb82f830965a9953a7ceada7162db7
- SSDEEP 196608:hiWNu3TtObiolIQZsdJ1imJEyrSPh67FWuvgfftTVD2/4d5OTp9q98cR/PhG/:ICuDtxM5iJ8mWy2O4ZntTVD2/4dE9ej
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.6.0_18\lzma.dll
- Size 149KB
- SHA256 eb3471cf995199aebab00bf98cd2aaa5ba9afed8b85cdf1e82ffb98b288fa8ec
- MD5 3e87b9412a214afeed6603382c81ca49
- SHA1 501acfcb9959d77a9afbc058749d8f4bb4bc5cc7
- SHA512 13ee969236feffce696d04fb2106de8457f8c3aad40cea4211ee2595bbf1d657506b0e88e8c32d1626f0bec85d84cf71ad4f5410c8fb99a9bbbd0a5d157209c6
- SSDEEP 3072:A4gmoAZplSUS5IIiqbukO/3msvJv7DDpNePhFpnVlEC2:BgmoADlSUSWIlbuks3mGvnDpNohzkC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\FP_PL_MSI_INSTALLER.exe
- Size 1.8MB
- SHA256 575d59cef8075085f223896a980125f5faa5ee3c42bc59725cadaa5ef6c4217f
- MD5 ff637bfa17992211f0aa14120ce70283
- SHA1 b7f3143f0a852258c93dc73d0ade6fa50b69b0cd
- SHA512 d7d8ff2857b56d74941ca79d6a2354ba13d9972f4428cf9845d314cb97c7d005bf56f953bfdd6c27f3520d009909ea0011c8f59b2b5bf674a1981390fc76ffee
- SSDEEP 49152:o911UOp06NYFfsR4m16Hf8CnDL1btxIBvxO:olU966FfsR42af8If1bgBM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI764a5.LOG
- Size 1KB
- SHA256 97a3a57dbfc643bc1fab61b76ab12f727c067bfe417339a72ee147b8ad299988
- MD5 b99575f5c0f5b73545f9bf03bc40968e
- SHA1 ad0eb68ff8cc193fa24ccba78636340b6c743db4
- SHA512 aabaffeb53b731aee8bcbb4ba57c35508f79e7baef212b0bf108f1cff613261e7ffa9cdcee4b0a819bfecec9ca273f3c085511e82ea9583faeb4226f4deb60e6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\install_flash_player_10_plugin.msi
- Size 2.8MB
- SHA256 9845e1e471be93781a0a7e934883f9e1502eabcf16cdd3d5a5dcf5c2ea6defa7
- MD5 ba1b533302caddf37e352c3599311be3
- SHA1 ea9cd7dd6ffbb7b2249870e42785ac1d0728c770
- SHA512 6e697808a375ca611527d1f1b9c64b68edef913a51c2e74ab46b7417aa5c7faa198c88994720ed82dc2d9e7513fa680e0720ebb865417afb18e08eb838ec10b6
- SSDEEP 49152:PF3Yyq1BhI11pM70HK4VBzu3Oi6OA8hnH49j5VgujT:1Yyq1Bhmp5HPVBzu3x/A8BY9jMu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\java_install.log
- Size 26KB
- SHA256 d901223d74038ee199057aa0713abf6d3d649d51a2105f02bcd452d7e2bb7901
- MD5 85d3f69800e117514f2e915f3a8d1905
- SHA1 b2d1675bcbf566bea7ff9a10a43f9621f678f62b
- SHA512 79f44c34027c7dc64da9eccf71b9bc7c36abc736088557fc329a45cc4c4a8c79f6e26dd79e87d61ef8e25fad19dec4ad4086d3b0f115d6693fb4b3a1792d47d1
- SSDEEP 384:5RgY2YadAYD1TYgiT3EH5SG0BxU/nikHL:/gY2YYAEheEH5S9YnikHL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\jrelog.txt
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\jrestub.exe
- Size 898KB
- SHA256 8278a6df47d4f55b1e7fb8108fd0ddcb77dad78d0bf9b2c76829d091a902f012
- MD5 0f2e650297a42c029811192a45d11bde
- SHA1 d87ae041a3379e1e3f7c9f2391bbe1b7ce28e5d0
- SHA512 f577614bb5180261d51d46f811ecf484d7881c24b92bab37f3d06c1cbecb7ad209672502dc39714821195cb8db15b4743552129b1ecfa8056e6d8f3b3a1821ba
- SSDEEP 12288:Ipj7+ckMu5KRYlXhAOqdOP2kVj9yqsqFZe31QtN+iUpNN1IXfi4oQr/GRo8toSxP:ptKR2XhLFIFQtN4pNN1A6BQ6Ro8J
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\jusched.log
- Size 296KB
- SHA256 d861399f836c9d59cb944517d15f17bea90325b22ff83f9125edcb1e957cf753
- MD5 a03839ff1e0b4ed11fcba5e851e86625
- SHA1 201284a1775fbac3615cc8cb86e92c05713a4301
- SHA512 b2b770572e77e21c4b6640665354b767fe426094c47d3efa989d2d8ad436acecda273a09a16c98237f1c04001600d330661cdc4d03036d265a7afcb6d8fdb51a
- SSDEEP 3072:94FdOrlz192dwp0J2Qtve/28BtDEESYLN++SBKsfb4M2N147wmTrbNsd2wRrunGs:3Qbnqly
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsk3903.tmp\Banner.dll
- Size 4KB
- SHA256 05838c8f81efbb98679010158f29cefd88a34fb1fe5d603e839dd406235ddf29
- MD5 91c9ee5005ac6cb4ec79a3b039b4c8df
- SHA1 95a9c018b501b6697beca846a33955909c3f97be
- SHA512 41cc45a64fbe64cd83e704e87193004245f5d29f4f880921d041e5f2ceec86ca0653146e6477642eba73875b9d5f0d773b540436b19e4797def9c15d7618474b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsk3903.tmp\ExtractDLLEx.dll
- Size 7KB
- SHA256 73acba7dd477dfd6cf4249911f4e3c781196c7cf6b28425761dcb2d4f90c36c5
- MD5 ba4063f437abb349aa9120e9c320c467
- SHA1 b045d785f6041e25d6be031ae2af4d4504e87b12
- SHA512 48a813f55834069f8c6b90740de3df01564a136b0fe637f9f85cc1a19d7f32b1f70205ff2462526508fe3c1962d7c1e8e384c40463e328538aeba28e8d0fb92a
- SSDEEP 96:lyEPmi/06iLbX8SIP59L1MmqPbgkk/eWKCHGojGYYIF/ggiomsTeZUzI:lyEPmymbMbPZOz+/eWJmoUItiopTeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsk3903.tmp\FindProcDLL.dll
- Size 3KB
- SHA256 0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
- MD5 8614c450637267afacad1645e23ba24a
- SHA1 e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
- SHA512 af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsk3903.tmp\InstallOptions.dll
- Size 14KB
- SHA256 8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c
- MD5 0dc0cc7a6d9db685bf05a7e5f3ea4781
- SHA1 5d8b6268eeec9d8d904bc9d988a4b588b392213f
- SHA512 814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0
- SSDEEP 192:n6d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jPK72dwF7dBEnbok:n6UdHXcIiY535zBt2jP+BEnbo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsk3903.tmp\KillProcDLL.dll
- Size 4KB
- SHA256 c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93
- MD5 99f345cf51b6c3c317d20a81acb11012
- SHA1 b3d0355f527c536ea14a8ff51741c8739d66f727
- SHA512 937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsk3903.tmp\LangDLL.dll
- Size 5KB
- SHA256 2a7f33ef64d666a42827c4dc377806ad97bc233819197adf9696aed5be5efac0
- MD5 a401e590877ef6c928d2a97c66157094
- SHA1 75e24799cf67e789fadcc8b7fddefc72fdc4cd61
- SHA512 6093415cd090e69cdcb52b5d381d0a8b3e9e5479dac96be641e0071f1add26403b27a453febd8ccfd16393dc1caa03404a369c768a580781aba3068415ee993f
- SSDEEP 48:iV6sAvmNC6iMPUptxEZK65x/AmvycNSmwVsOYJyvrpXptp/JvR0Joof5d2:2V11GED5ZTvycNSmwVsTJuftpZR0Ld2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsk3903.tmp\LockedList.dll
- Size 18KB
- SHA256 c79c0b410049411a70293f1657a2144d71a647753785f5134f47f1f977f90fd3
- MD5 acb2534a2b90fcdc079966203abb83a6
- SHA1 36e6842e78d8f1c6e2f3a6d93667bef1cfa5d3d6
- SHA512 e77b6b1d09b59af51e3f98debdd8eb472778c339be71849e19b5ad3f262c037bf050d3fd892d194ca24b9fd43c682d1a903629318792a2fd9fee4582d316b959
- SSDEEP 192:8X3aaH6S1xA9hTSrlnUieI65sD1BIYF3uzyBLff3lhOh18iaLI+AmOZrfCTliZPO:sKQzln7xrPlhOh1Xa05fCTlUPf5hXuz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsk3903.tmp\RunProcess.dll
- Size 180KB
- SHA256 ad31aa34cf3371c522b58ba7cc4958d6ea98f96510896cf680c313d21925bac5
- MD5 6f05acd8d0b80754534355437cfa4f0b
- SHA1 956f7048b41db52585ae663872e5a35cb9d72f3c
- SHA512 84d2322ace21adbb8404cb1adbaa05684afa3014005e504fbfed614f42fa170ce917bd6418db95be732f1e1923ce9da9e5b0cca51e76497d8e76e37d14de3be6
- SSDEEP 3072:+7cpps5NLaOXCo/QrBdiE3l9R0QVLjqS9PtlDAm1tDKso:+us5JFXrIrBYY9OEzMmro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsk3903.tmp\System.dll
- Size 11KB
- SHA256 dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
- MD5 00a0194c20ee912257df53bfe258ee4a
- SHA1 d7b4e319bc5119024690dc8230b9cc919b1b86b2
- SHA512 3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsk3903.tmp\UserInfo.dll
- Size 4KB
- SHA256 7d099352c82612ab27ddfd7310c1aa049b58128fb04ea6ea55816a40a6f6487b
- MD5 1e8e11f465afdabe97f529705786b368
- SHA1 ea42bed65df6618c5f5648567d81f3935e70a2a0
- SHA512 16566a8c1738e26962139aae893629098dc759e4ac87df3e8eb9819df4e0e422421836bb1e4240377e00fb2f4408ce40f40eee413d0f6dd2f3a4e27a52d49a0b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsk3903.tmp\ioSpecial.ini
- Size 768B
- SHA256 23b7dc882577bbc4516abeaf09c02787847d9d038c53efeebf354e32285b343d
- MD5 5c568da7300b496f006cc5e4124b41e5
- SHA1 6455265a049657a149d104d9a30721904d7ae746
- SHA512 5b1f1d064857ccacbdaf000dcb9eef9ec5b31ff1af6627683fc2a29b1bedd688652c741a59fb1b044b5204a58d4e08205adabab1976f22f6ac76874f88e520ec
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsk3903.tmp\ioSpecial.ini
- Size 777B
- SHA256 00aad186e896ffe79c5a8e3786a0adc3c85984c8b809b308f805dad27b7694f3
- MD5 7b8407b508ff8e579d9b738dbba634bf
- SHA1 6a66773277177265f422798da9f67be129fabaf3
- SHA512 f5035d765f5090dd270303fa3bdf55df25d4241fa413d76b3fd7b2d2ae616b372218262cfd4ac67c006240190f744c1a2c03b5dfecb0cf790e506b5ee69cc15f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsk3903.tmp\legal.ini
- Size 606B
- SHA256 8123d44a14bb6139cbc16a7eab694d2e0467199f7ccf3f9cc17cf3609e7ea9a9
- MD5 13d88d436d129637451a9137bde9c2cd
- SHA1 56c5884aa339747e5b581f661d4dfb89f11d9d3f
- SHA512 026337ab80a88d77ac520284c7741413cdb09ce0484229d113eb2d2dd08f0cfb32db703718e45738e4666f2384cc729080b45953cf4c0e0e46d1b345468dbf7c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsk3903.tmp\legal.ini
- Size 1KB
- SHA256 de5b9a07ba57cddbe95248a151e9cc76e4ccb9bc3015f921a6dc792e57f255d8
- MD5 eb7c6fee233d82e6dc2c366a8dd25368
- SHA1 d50b79cd23a64d84f168479bd40963904708ee45
- SHA512 b994f599f4606e74199726b8b0e62c67c476a0bf0f003ac33036e97221f03793bf37af7d6d9c828c84fe37bfb17c1cefab06f975262b9be5c5e26737916d0fdb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsk3903.tmp\legal.ini
- Size 1KB
- SHA256 1a4750f51590a94db0404fcd7921714c231663d15091a78503b71e18ed6a46be
- MD5 ddde964da6ebdcf511a82e27e350e24d
- SHA1 e9e3d0524f57b6803a2f1f3d4b45afad40b3423d
- SHA512 1032c8deb25b92cd9b3ab5fa0e8da2b45e6766914c1fbb74f704824e397e16883f64228aff99bdc2afc476a0c151ea6b776a41c4aab070c3d4d79f9be29163d9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsy68CE.tmp\NSISArray.dll
- Size 17KB
- SHA256 38654eef0ee3715f4b1268f4b4176a6b487a0a9e53a27a4ec0b84550ea173564
- MD5 2b8574f6a8f5de9042baa43c069d20ba
- SHA1 07959da0c6b7715b51f70f1b0aea1f56ba7a4559
- SHA512 f034f71b6a18ee8024d40acd3c097d95c8fd8e128d75075cc452e71898c1c0322f21b54bd39ca72d053d7261ffbab0c5c1f820602d52fc85806513a6fe317e88
- SSDEEP 192:YAFuV2Ow8mbPNnDSnYJly4RX+VGeSDlsGUlyGaWNn3B3/WXZWsQs5PaqJ7En/5U3:YA4V2Jb1nDSnc+Zos1lP6Suhe/q9l
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsy68CE.tmp\System.dll
- Size 10KB
- SHA256 c11ffa087c6848f3870e6336d151f0ba6298c0e1e30ccddf2da25a06d36a61fc
- MD5 16ae54e23736352739d7ab156b1965ba
- SHA1 14f8f04bed2d6adc07565d5c064f6931b128568f
- SHA512 15dbfcdc5dc34cb20066120045e3250f8df9e50b91de043f2ada33ac0235907d98668e248828a7ed9c75e25dfb5103b7248867530ce73ee36f6a35c30b4afa9f
- SSDEEP 192:HO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1a8gMO:GKAFERdlxhGRYUzqZa8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsy68CE.tmp\UserInfo.dll
- Size 4KB
- SHA256 21a373c52aaecce52b41aebe6d0224f53760fc3e5c575e821175eee3a1f7f226
- MD5 68d73a95c628836b67ea5a717d74b38c
- SHA1 935372db4a66f9dfd6c938724197787688e141b0
- SHA512 0e804deab4e647213132add4173c1d2c554c628816f56e21e274a40e185d90254e29c8bfc6fbfdfea2a492d43d23c0bfa4b276252a3f5e1993ab80ff832c4914
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\LimeWire\browser\xulrunner\chrome\classic.jar
- Size 759KB
- SHA256 aa68c283a5a447b5d050a99fa780194a85ca5bda8d88ae1ce0ab524ca14ee8c1
- MD5 ee66b755fbe00931dfefb8b30869f6db
- SHA1 36f88c3380f6491c3cff5458197e2cf086079504
- SHA512 2770733be288a3cca503bf91c28821e30587354622e7c8854f2c849015df63cb9eb141c4888cdcec0d7f75ce28a307d0adc7170e448270a2b6e18cee3bed3ee4
- SSDEEP 12288:bIiQ6BMpgT9bl9xGdycTcEc4GVIziPOr7O7eUo6MzFwW1ZsQGMFR0/oLL2RSRoc4:toLL2NONQdEKrV1t
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\LimeWire\browser\xulrunner\chrome\en-US.jar
- Size 324KB
- SHA256 d7f81742dfe3d35cda6f22e449879bfa37c7a6abba560432d517792c5bf2adac
- MD5 5c1624554ce568d668f2e7bfc11151b9
- SHA1 51180b987c7305cfd176e4d92b936eff4e001f62
- SHA512 9947e985674e126285108ae1fc9f5fe75e04e9315937b01676a97ebfc8eae6f8d2933c5783b5c7b6507058cbec53fe3ea7f0d52ef5c36a7e47991935c953d6c7
- SSDEEP 6144:vx/FLt5zt1Y5sPue+6NGMaHGMQ0huN7DTTVTGsss5vtfxnB/JTE4bXdJIYAFw+oA:vx/FLt5zt1Y5sPue+6N3aHGGC/VTGssl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\LimeWire\browser\xulrunner\chrome\limewire.jar
- Size 8KB
- SHA256 ad06cbee7fb1bde10498b342a584e68d69d87bcad1e0b15fcc49ffe520709779
- MD5 964744738869ff5f4febae1b42c35da4
- SHA1 f2192d0453001ec9ffac1c29617aaf0ec5baffd4
- SHA512 191866e6c7292ca912cf19cdb824a42a7de0d5a28a55da49c1f26cb5d600345491e5e11a589b19dd307349e74f75bb865029df9f129ec6ff61c4d5eba2181117
- SSDEEP 192:5y8uM4QxwSIY+eLGpM2IhIilnvyZwdSmatTzAy5Gl/fNYk:zJ4sKHeLGphGIUnvyZ59zAy5a/f5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\LimeWire\browser\xulrunner\msvcr71.dll
- Size 340KB
- SHA256 8094af5ee310714caebccaeee7769ffb08048503ba478b879edfef5f1a24fefe
- MD5 86f1895ae8c5e8b17d99ece768a70732
- SHA1 d5502a1d00787d68f548ddeebbde1eca5e2b38ca
- SHA512 3b7ce2b67056b6e005472b73447d2226677a8cadae70428873f7efa5ed11a3b3dbf6b1a42c5b05b1f2b1d8e06ff50dfc6532f043af8452ed87687eefbf1791da
- SSDEEP 6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\LimeWire\browser\xulrunner\plugins\npnul32.dll
- Size 56KB
- SHA256 a14628fdb1808d760bd538b61c5fc6a1730c6c3c5c5e345470e1b68d789a4876
- MD5 6078bb60da0bc6d988d1cbc66a9072c6
- SHA1 40527bd71f83527b691497ca06f87f24a77b782a
- SHA512 2d7ec502a3d5bfeaec14e4480b07c1e17d9bf1430a8598438074e012e6883ffca2c5814567d752a82411c1b166278cf530b24eadfde16578ce857fa20f078f7c
- SSDEEP 768:pQbwuoA/mVUnB3nmQBIDRVkymwK7ILpsioEtWkHBESq24:0iA/mVkfIDTkymwfLgsPBEt24
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\LimeWire\library5.dat
- Size 454B
- SHA256 0ce6070e7d057f659863d84173204ba728e722abfcb94239a6c89c5b0ae66a57
- MD5 47863d0411b0b2c5290b26a8fc90f1fd
- SHA1 09d868de3e25b7f013a2b3902a9b8ea64e869642
- SHA512 b41df7eab11378e53a181a6dae1284a88960f7b56aa61343562995b8e6a3de6c3497b2835672079606c897ef3884603930761820f79532f50f4d127baece60a5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\LimeWire\update.cert4893668125197581784tmp
- Size 786B
- SHA256 35d67c73d6ee53c67acdac83473103084f15b4c92e1aca32d02751991ade1ea2
- MD5 320fea5fefa7201eb43aa333f6567e0b
- SHA1 2c1c065a48d0cbc19491c63c00d3982afa3010a3
- SHA512 14f5c47feece97af0ae256b9d2f1e5a451047ec101df080478c2eaaf68bd8877d8d76fb2b454af1d0107175e2d4899c061eedba5de0787060e7513878f3c42b2
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\MSI66D8.tmp
- Size 84KB
- SHA256 9dc871199cc9e96067a32401d225af50683ac14efaf35edc61aa45f346374494
- MD5 abb81f7897bb48a036686ccf840287ae
- SHA1 d6d648782584340bfa56c8e6d34fd70707af5d36
- SHA512 4769d555b95ad593eae41e1cb91a9c7539b1c115b9b19a4954dec791f4d662388b459e3b7ad2964d5e0db4270406816582986d5a184bf55fd6c067906c2e0b25
- SSDEEP 1536:Givk7DtT4NxMQxmWthib9C0X/niKJK+TcAyc/idw5eQ7:Pcnsx1FTidK+TcAyc/i25X
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI89D6.tmp
- Size 108KB
- SHA256 f824ddc055db061a77b0a0a4f2e7224c0df074aa60c0540f96724be416100c03
- MD5 a31e140d42571f7deadf5878aca17e0e
- SHA1 c3e4bb0550970f31711482cc02dafce025f1103d
- SHA512 61ddcfffa695dcee62b99df78a08c03946830e66fc732b1aaaec8311be771375bcc4f8932269a8db7f8565509a1cb6a9b4747aec046b7d5e00cb75048a21ee71
- SSDEEP 3072:OqvY98JJhNJpEgvObzeoAXEkjVsupDljX6:WEJhDvv+SoAXEkjmK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
- Size 3.7MB
- SHA256 710b2e4c71e73d4d0a99b786d22de56732cb7e358ee1e8254b0c26f069719efe
- MD5 f8efdcfc440a420d6c1ecd245ab20207
- SHA1 f47972cdc8ef6a1b6af7ebd6d04ef3bd6b1fc118
- SHA512 4fb54e4678f42e8beee57de6b450f95b1f8b201e5109d3ba72630b5204f7dd7f84e287ef7a0e48550515efe48344d27027a6329cc1aa8216ab738ac215cf728d
- SSDEEP 49152:fg5SCCzzvoUzTbg3LmuBkQt3fCETKhg5IvLMkwAwwCQ+IPmTcjsRt143Eg8WSr7L:fgRCzzvoU03LBF2gO3mTcGt14KWskHW
- MD5 SHA1 SHA512 SSDEEP