Analysis
- max time kernel
356s - max time network
347s - platform
windows11-21h2_x64 - resource
win11-20240426-en - resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system - submitted
28/04/2024, 16:04
Behavioral task
behavioral1
Sample
Limewire_5.5.16.exe
Resource
win10-20240404-en
windows10-1703-x64
26 signatures
300 seconds
Behavioral task
behavioral2
Sample
Limewire_5.5.16.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
25 signatures
300 seconds
General
- Target Limewire_5.5.16.exe
- Size 28.8MB
- Sample240428-th496sbf21
- SHA256 f6ca4c41fceab0cb136ad06eaa0a4c82e209948238e6873ed7ea4022ad41c54b
- MD5 f5ff2057c5cdbb6dc15e43ee4ffe4526
- SHA1 2562bffe3eecc91ca17316ca127d0eba63fe9b8c
- SHA512 280f1d27d8a69ed1ffdda419ec224c7280d099a77c8a4d124ae2169ada808bfd76fc8fe0236129ac24c839352f6077da6c6d4dc7054b91323a3def001dee1346
- SSDEEP 786432:xUtL12zR8JB66fGSPOX9TtfnAN3/920A3r20aeKI3:xUV10R34GSYP2/9tAfKI3
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Modifies Installed Components in the registry 2 TTPs 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}\ = "Java (Sun)" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}\ComponentID = "JAVAVM" MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}\IsInstalled = "1" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}\KeyFileName = "C:\\Program Files (x86)\\Java\\jre6\\bin\\regutils.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}\Version = "5,0,5000,0" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}\Locale = "EN" MsiExec.exe - Executes dropped EXE 16 IoCs
pid Process 4368 FP_PL_MSI_INSTALLER.exe 1584 jrestub.exe 4188 zipper.exe 3520 unpack200.exe 5076 unpack200.exe 4040 unpack200.exe 3812 unpack200.exe 4852 unpack200.exe 4368 unpack200.exe 2408 unpack200.exe 4936 javaw.exe 2844 javaw.exe 3744 execNoWindow.exe 4744 unpack200.exe 1604 toolbarChecker.exe 2036 LimeWire.exe - Loads dropped DLL 64 IoCs
pid Process 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 2760 MsiExec.exe 4368 FP_PL_MSI_INSTALLER.exe 4368 FP_PL_MSI_INSTALLER.exe 4368 FP_PL_MSI_INSTALLER.exe 4368 FP_PL_MSI_INSTALLER.exe 4368 FP_PL_MSI_INSTALLER.exe 4368 FP_PL_MSI_INSTALLER.exe 4368 FP_PL_MSI_INSTALLER.exe 4368 FP_PL_MSI_INSTALLER.exe 4368 FP_PL_MSI_INSTALLER.exe 4368 FP_PL_MSI_INSTALLER.exe 4368 FP_PL_MSI_INSTALLER.exe 4368 FP_PL_MSI_INSTALLER.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 1584 jrestub.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 4228 MsiExec.exe 4228 MsiExec.exe 4228 MsiExec.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 4228 MsiExec.exe 4228 MsiExec.exe 4228 MsiExec.exe 4228 MsiExec.exe 4228 MsiExec.exe 4228 MsiExec.exe 4228 MsiExec.exe 4228 MsiExec.exe 4228 MsiExec.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral3/files/0x000400000002a9e2-365.dat upx behavioral3/memory/1584-367-0x0000000000400000-0x00000000005D2000-memory.dmp upx behavioral3/memory/1584-435-0x0000000000400000-0x00000000005D2000-memory.dmp upx behavioral3/memory/1584-1283-0x0000000000400000-0x00000000005D2000-memory.dmp upx behavioral3/memory/1584-1315-0x0000000000400000-0x00000000005D2000-memory.dmp upx - Blocklisted process makes network request 3 IoCs
flow pid Process 2 3320 msiexec.exe 14 4228 MsiExec.exe 15 4228 MsiExec.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe - Installs/modifies Browser Helper Object 2 TTPs 5 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9} MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\NoExplorer = "1" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\NoExplorer = "1" MsiExec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} MsiExec.exe - Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll FP_PL_MSI_INSTALLER.exe File created C:\Windows\SysWOW64\java.exe MsiExec.exe File created C:\Windows\SysWOW64\javaw.exe MsiExec.exe File created C:\Windows\SysWOW64\deploytk.dll MsiExec.exe File opened for modification C:\Windows\SysWOW64\Macromed\Flash\install.log FP_PL_MSI_INSTALLER.exe File created C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_FlashUtil.exe FP_PL_MSI_INSTALLER.exe File created C:\Windows\SysWOW64\Macromed\Flash\flashplayer.xpt FP_PL_MSI_INSTALLER.exe File created C:\Windows\SysWOW64\Macromed\Flash\uninstall_plugin.exe FP_PL_MSI_INSTALLER.exe File created C:\Windows\SysWOW64\javaws.exe MsiExec.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Java\jre6\bin\j2pkcs11.dll zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Europe\Gibraltar zipper.exe File created C:\Program Files (x86)\LimeWire\LimeWire.pack Limewire_5.5.16.exe File opened for modification C:\Program Files (x86)\LimeWire\unpack200.exe Limewire_5.5.16.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Africa\Kigali zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\America\Eirunepe zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\America\Hermosillo zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\America\Monterrey zipper.exe File opened for modification C:\Program Files (x86)\LimeWire\lib\jdshow.dll Limewire_5.5.16.exe File created C:\Program Files (x86)\Java\jre6\LICENSE zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\America\Thunder_Bay zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Asia\Dhaka zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\SystemV\EST5EDT zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\management-agent.jar zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Africa\Johannesburg zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\America\Anchorage zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\America\Barbados zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Asia\Brunei zipper.exe File created C:\Program Files (x86)\Java\jre6\bin\jp2launcher.exe zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Etc\GMT+7 zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\javaws.jar unpack200.exe File created C:\Program Files (x86)\LimeWire\msvcr71.dll Limewire_5.5.16.exe File created C:\Program Files (x86)\Java\jre6\core.zip msiexec.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\America\Indiana\Vincennes zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\America\Yellowknife zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Asia\Taipei zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Europe\Lisbon zipper.exe File created C:\Program Files (x86)\LimeWire\lib\msvcm90.dll Limewire_5.5.16.exe File created C:\Program Files (x86)\Java\jre6\zipper.exe msiexec.exe File created C:\Program Files (x86)\Java\jre6\lib\deploy\ffjcext.zip zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\America\Port-au-Prince zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\America\Yakutat zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Asia\Kuching zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Pacific\Wake zipper.exe File opened for modification C:\Program Files (x86)\LimeWire\lib\SystemUtilities.dll Limewire_5.5.16.exe File created C:\Program Files (x86)\Java\jre6\bin\jp2iexp.dll zipper.exe File created C:\Program Files (x86)\Java\jre6\bin\jsoundds.dll zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\America\Grenada zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Europe\Bucharest zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Indian\Maldives zipper.exe File created C:\Program Files (x86)\Java\jre6\bin\new_plugin\msvcr71.dll MsiExec.exe File created C:\Program Files (x86)\Java\jre6\lib\tzmappings zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\America\Dawson zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\MST zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Asia\Qatar zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Australia\Melbourne zipper.exe File created C:\Program Files (x86)\Java\jre6\bin\dt_socket.dll zipper.exe File created C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll zipper.exe File created C:\Program Files (x86)\Java\jre6\bin\tnameserv.exe zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\deploy\jqs\ff\chrome.manifest zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\America\Asuncion zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Asia\Almaty zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Pacific\Gambier zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Pacific\Ponape zipper.exe File opened for modification C:\Program Files (x86)\LimeWire\lib\JMediaFoundation.dll Limewire_5.5.16.exe File created C:\Program Files (x86)\LimeWire\lib\log4j.properties Limewire_5.5.16.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Australia\Lord_Howe zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\rt.jar unpack200.exe File created C:\Program Files (x86)\Java\jre6\bin\jpinscp.dll zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\security\java.security zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\servicetag\jdk_header.png zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Africa\Monrovia zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Asia\Novokuznetsk zipper.exe File created C:\Program Files (x86)\Java\jre6\lib\zi\Asia\Tashkent zipper.exe - Drops file in Windows directory 57 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e577355.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI75FC.tmp msiexec.exe File created C:\Windows\Installer\{AF36CE1D-FD2C-4BA0-93FA-1196785DD610}\ARPPRODUCTICON.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI9465.tmp msiexec.exe File created C:\Windows\Installer\e577355.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI9523.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9DE3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA23D.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF88C73FEFDE94670F.TMP msiexec.exe File created C:\Windows\Installer\e577350.msi msiexec.exe File created C:\Windows\SystemTemp\~DFD2AC3E784853FD21.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI9544.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI95D9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9CC6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9595.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9E14.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{AF36CE1D-FD2C-4BA0-93FA-1196785DD610} msiexec.exe File opened for modification C:\Windows\Installer\MSI94F3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI95C8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI95EB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI95FD.tmp msiexec.exe File created C:\Windows\Installer\e577354.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI99E7.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF560BEA2ECA52A919.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF5BF300409741FBDA.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI9398.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9426.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA22C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9339.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9533.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI95A6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI95DA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9E04.tmp msiexec.exe File opened for modification C:\Windows\Installer\{AF36CE1D-FD2C-4BA0-93FA-1196785DD610}\ARPPRODUCTICON.exe msiexec.exe File created C:\Windows\SystemTemp\~DFFAB64E88025E58D5.TMP msiexec.exe File created C:\Windows\Installer\e57734b.msi msiexec.exe File created C:\Windows\Installer\e57734f.msi msiexec.exe File created C:\Windows\SystemTemp\~DFEB7A2B15395945CD.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI95EA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9D26.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF2380B4EFB02F3ACA.TMP msiexec.exe File opened for modification C:\Windows\Installer\e577350.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI9584.tmp msiexec.exe File opened for modification C:\Windows\Installer\e57734b.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI7530.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI95FC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI960D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9D85.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF382E3837C36DA90C.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{26A24AE4-039D-4CA4-87B4-2F83216018FF} msiexec.exe File opened for modification C:\Windows\Installer\MSI9574.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI95C7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9CF6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI95B6.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- NSIS installer 1 IoCs
resource yara_rule behavioral3/files/0x000100000002a9ec-271.dat nsis_installer_1 - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msiexec.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msiexec.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\Policy = "3" MsiExec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3B9A6E32-36C9-4946-B78C-3F58E3785EC1} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3B9A6E32-36C9-4946-B78C-3F58E3785EC1}\AppPath = "C:\\Program Files (x86)\\Java\\jre6\\bin" MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3B9A6E32-36C9-4946-B78C-3F58E3785EC1}\Policy = "3" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppPath = "C:\\Program Files (x86)\\Java\\jre6\\bin" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppName = "javaws.exe" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppPath = "C:\\Program Files (x86)\\Java\\jre6\\bin" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppName = "ssvagent.exe" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppPath = "C:\\Program Files (x86)\\Java\\jre6\\bin" MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\Policy = "3" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppName = "jp2launcher.exe" MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\Policy = "3" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3B9A6E32-36C9-4946-B78C-3F58E3785EC1}\AppName = "unpack200.exe" MsiExec.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA}\ = "Java Plug-in 1.4.0_03" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBB} MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBA}\ = "Java Plug-in 1.4.1_04" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_01" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}\ = "Java Plug-in 1.3.1_16" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBB} MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA} MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_02" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBB} MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.1_17" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.1_01" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_12" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.2_30" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBB} MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBA}\ = "Java Plug-in 1.4.2_14" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBC} MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBC}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}\ = "Java Plug-in 1.3.1_21" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.2_07" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.2_05" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.1_16" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.2_24" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBC}\InprocServer32 MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-FFFF-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA} MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB} MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_30" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBB}\ = "Java Plug-in 1.6.0_02" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBC}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.1_08" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBA} MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA} MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} MsiExec.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBB} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4EA42A62D9304AC4784BF238120681FF\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBC}\InprocServer32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\Programmable MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBB}\ = "Java Plug-in 1.6.0_02" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LimeWire\ = "LimeWire Torrent" LimeWire.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBB} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2A05BC03-C2D3-45A2-B3D2-FF9AA6FE3DF4}\ = "IAvgScanResult2" Limewire_5.5.16.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Windows\\SysWow64\\deploytk.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBA}\ = "Java Plug-in 1.4.2_26" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC} MsiExec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\MiscStatus\1 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{5745A111-323D-423C-B7FB-74C4C19F47D9}\ = "AvgSdk Class" Limewire_5.5.16.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBA} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBA} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBC}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.2_23" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.1_01" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.1_07" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-FFFF-ABCDEFFEDCBA} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBC} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBC}\InprocServer32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBA} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JavaWebStart.isInstalled\ = "isInstalled Class" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-FFFF-ABCDEFFEDCBA}\MiscStatus MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.2_20" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre6\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_05" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_07" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\javaw.exe\IsHostApp MsiExec.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85371CA6E550143DCE2803471BDE3A09E8F8770F jrestub.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85371CA6E550143DCE2803471BDE3A09E8F8770F\Blob = 0f0000000100000014000000d95944f5bd92127092218f9f02c719c42386b49909000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030162000000010000002000000083ce3c1229688a593d485f81973c0f9195431eda37cc5e36430e79c7a888638b1400000001000000140000001a21b4952b6293ce18b365ec9c0e934cb381e6d40b000000010000001200000056006500720069005300690067006e0000001d00000001000000100000007173fa7247886438eb10b0f4e8a0cc186800000001000000080000000000876ace99d10103000000010000001400000085371ca6e550143dce2803471bde3a09e8f8770f200000000100000006030000308203023082026b02107dd9fe07cfa81eb7107967fba78934c6300d06092a864886f70d01010505003081c1310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e313c303a060355040b1333436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204732313a3038060355040b1331286329203139393820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d060355040b1316566572695369676e205472757374204e6574776f726b301e170d3938303531383030303030305a170d3238303830313233353935395a3081c1310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e313c303a060355040b1333436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204732313a3038060355040b1331286329203139393820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d060355040b1316566572695369676e205472757374204e6574776f726b30819f300d06092a864886f70d010101050003818d0030818902818100cc5ed1115d5c69d0abd3b96a4c991f5998308e168520466d473fd4852084e16db3f8a4ed0cf1170f3bf9a7f925d7c1cf8463f27c63cfa247f2c65b338e64400468c180b9641c4577c7d86ef595293c50e834d7781fa8ba6d4391958f45575e7ec5fbcaa404ebea973754306fbb01473233cddc579b646961f89b1d1c894f5c670203010001300d06092a864886f70d010105050003818100514dcdbe5ccb98199c15b20139782e4d0f67707099c6105a94a4534d546d2baf0d5d408b64d3d7eede5661925fa6c41d106136d32c273ce82909b9116474ccb5739f1c48a9bc6101eee217a60ce340083b0ee7eb44732a9af16992ef7114c339ac71a791096fe47106b3ba5957267900f6f80da2333028d4aa58a09d9d6991fd jrestub.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85371CA6E550143DCE2803471BDE3A09E8F8770F\Blob = 190000000100000010000000b24f9926afcb335d4349d24b71f41a6703000000010000001400000085371ca6e550143dce2803471bde3a09e8f8770f6800000001000000080000000000876ace99d1011d00000001000000100000007173fa7247886438eb10b0f4e8a0cc180b000000010000001200000056006500720069005300690067006e0000001400000001000000140000001a21b4952b6293ce18b365ec9c0e934cb381e6d462000000010000002000000083ce3c1229688a593d485f81973c0f9195431eda37cc5e36430e79c7a888638b09000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703010f0000000100000014000000d95944f5bd92127092218f9f02c719c42386b499200000000100000006030000308203023082026b02107dd9fe07cfa81eb7107967fba78934c6300d06092a864886f70d01010505003081c1310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e313c303a060355040b1333436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204732313a3038060355040b1331286329203139393820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d060355040b1316566572695369676e205472757374204e6574776f726b301e170d3938303531383030303030305a170d3238303830313233353935395a3081c1310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e313c303a060355040b1333436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204732313a3038060355040b1331286329203139393820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d060355040b1316566572695369676e205472757374204e6574776f726b30819f300d06092a864886f70d010101050003818d0030818902818100cc5ed1115d5c69d0abd3b96a4c991f5998308e168520466d473fd4852084e16db3f8a4ed0cf1170f3bf9a7f925d7c1cf8463f27c63cfa247f2c65b338e64400468c180b9641c4577c7d86ef595293c50e834d7781fa8ba6d4391958f45575e7ec5fbcaa404ebea973754306fbb01473233cddc579b646961f89b1d1c894f5c670203010001300d06092a864886f70d010105050003818100514dcdbe5ccb98199c15b20139782e4d0f67707099c6105a94a4534d546d2baf0d5d408b64d3d7eede5661925fa6c41d106136d32c273ce82909b9116474ccb5739f1c48a9bc6101eee217a60ce340083b0ee7eb44732a9af16992ef7114c339ac71a791096fe47106b3ba5957267900f6f80da2333028d4aa58a09d9d6991fd jrestub.exe - Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 3320 msiexec.exe 3320 msiexec.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe 5056 Limewire_5.5.16.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5056 Limewire_5.5.16.exe Token: SeShutdownPrivilege 3848 msiexec.exe Token: SeIncreaseQuotaPrivilege 3848 msiexec.exe Token: SeSecurityPrivilege 3320 msiexec.exe Token: SeCreateTokenPrivilege 3848 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3848 msiexec.exe Token: SeLockMemoryPrivilege 3848 msiexec.exe Token: SeIncreaseQuotaPrivilege 3848 msiexec.exe Token: SeMachineAccountPrivilege 3848 msiexec.exe Token: SeTcbPrivilege 3848 msiexec.exe Token: SeSecurityPrivilege 3848 msiexec.exe Token: SeTakeOwnershipPrivilege 3848 msiexec.exe Token: SeLoadDriverPrivilege 3848 msiexec.exe Token: SeSystemProfilePrivilege 3848 msiexec.exe Token: SeSystemtimePrivilege 3848 msiexec.exe Token: SeProfSingleProcessPrivilege 3848 msiexec.exe Token: SeIncBasePriorityPrivilege 3848 msiexec.exe Token: SeCreatePagefilePrivilege 3848 msiexec.exe Token: SeCreatePermanentPrivilege 3848 msiexec.exe Token: SeBackupPrivilege 3848 msiexec.exe Token: SeRestorePrivilege 3848 msiexec.exe Token: SeShutdownPrivilege 3848 msiexec.exe Token: SeDebugPrivilege 3848 msiexec.exe Token: SeAuditPrivilege 3848 msiexec.exe Token: SeSystemEnvironmentPrivilege 3848 msiexec.exe Token: SeChangeNotifyPrivilege 3848 msiexec.exe Token: SeRemoteShutdownPrivilege 3848 msiexec.exe Token: SeUndockPrivilege 3848 msiexec.exe Token: SeSyncAgentPrivilege 3848 msiexec.exe Token: SeEnableDelegationPrivilege 3848 msiexec.exe Token: SeManageVolumePrivilege 3848 msiexec.exe Token: SeImpersonatePrivilege 3848 msiexec.exe Token: SeCreateGlobalPrivilege 3848 msiexec.exe Token: SeRestorePrivilege 3320 msiexec.exe Token: SeTakeOwnershipPrivilege 3320 msiexec.exe Token: SeRestorePrivilege 3320 msiexec.exe Token: SeTakeOwnershipPrivilege 3320 msiexec.exe Token: SeRestorePrivilege 3320 msiexec.exe Token: SeTakeOwnershipPrivilege 3320 msiexec.exe Token: SeRestorePrivilege 3320 msiexec.exe Token: SeTakeOwnershipPrivilege 3320 msiexec.exe Token: SeRestorePrivilege 3320 msiexec.exe Token: SeTakeOwnershipPrivilege 3320 msiexec.exe Token: SeRestorePrivilege 3320 msiexec.exe Token: SeTakeOwnershipPrivilege 3320 msiexec.exe Token: SeRestorePrivilege 3320 msiexec.exe Token: SeTakeOwnershipPrivilege 3320 msiexec.exe Token: SeRestorePrivilege 3320 msiexec.exe Token: SeTakeOwnershipPrivilege 3320 msiexec.exe Token: SeRestorePrivilege 3320 msiexec.exe Token: SeTakeOwnershipPrivilege 3320 msiexec.exe Token: SeRestorePrivilege 3320 msiexec.exe Token: SeTakeOwnershipPrivilege 3320 msiexec.exe Token: SeRestorePrivilege 3320 msiexec.exe Token: SeTakeOwnershipPrivilege 3320 msiexec.exe Token: SeRestorePrivilege 3320 msiexec.exe Token: SeTakeOwnershipPrivilege 3320 msiexec.exe Token: SeRestorePrivilege 3320 msiexec.exe Token: SeTakeOwnershipPrivilege 3320 msiexec.exe Token: SeRestorePrivilege 3320 msiexec.exe Token: SeTakeOwnershipPrivilege 3320 msiexec.exe Token: SeRestorePrivilege 3320 msiexec.exe Token: SeTakeOwnershipPrivilege 3320 msiexec.exe Token: SeRestorePrivilege 3320 msiexec.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2036 LimeWire.exe 2036 LimeWire.exe 2036 LimeWire.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2036 LimeWire.exe 2036 LimeWire.exe 2036 LimeWire.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 5056 Limewire_5.5.16.exe 2036 LimeWire.exe 2036 LimeWire.exe 2036 LimeWire.exe 2036 LimeWire.exe 2036 LimeWire.exe 2036 LimeWire.exe 2036 LimeWire.exe 2036 LimeWire.exe 2036 LimeWire.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5056 wrote to memory of 3848 5056 Limewire_5.5.16.exe 81 PID 5056 wrote to memory of 3848 5056 Limewire_5.5.16.exe 81 PID 5056 wrote to memory of 3848 5056 Limewire_5.5.16.exe 81 PID 3320 wrote to memory of 2760 3320 msiexec.exe 85 PID 3320 wrote to memory of 2760 3320 msiexec.exe 85 PID 3320 wrote to memory of 2760 3320 msiexec.exe 85 PID 3320 wrote to memory of 4368 3320 msiexec.exe 86 PID 3320 wrote to memory of 4368 3320 msiexec.exe 86 PID 3320 wrote to memory of 4368 3320 msiexec.exe 86 PID 5056 wrote to memory of 1584 5056 Limewire_5.5.16.exe 87 PID 5056 wrote to memory of 1584 5056 Limewire_5.5.16.exe 87 PID 5056 wrote to memory of 1584 5056 Limewire_5.5.16.exe 87 PID 1584 wrote to memory of 3124 1584 jrestub.exe 88 PID 1584 wrote to memory of 3124 1584 jrestub.exe 88 PID 1584 wrote to memory of 3124 1584 jrestub.exe 88 PID 3320 wrote to memory of 4228 3320 msiexec.exe 89 PID 3320 wrote to memory of 4228 3320 msiexec.exe 89 PID 3320 wrote to memory of 4228 3320 msiexec.exe 89 PID 3320 wrote to memory of 4548 3320 msiexec.exe 90 PID 3320 wrote to memory of 4548 3320 msiexec.exe 90 PID 3320 wrote to memory of 4548 3320 msiexec.exe 90 PID 4548 wrote to memory of 4188 4548 MsiExec.exe 91 PID 4548 wrote to memory of 4188 4548 MsiExec.exe 91 PID 4548 wrote to memory of 4188 4548 MsiExec.exe 91 PID 4548 wrote to memory of 3520 4548 MsiExec.exe 92 PID 4548 wrote to memory of 3520 4548 MsiExec.exe 92 PID 4548 wrote to memory of 3520 4548 MsiExec.exe 92 PID 4548 wrote to memory of 5076 4548 MsiExec.exe 93 PID 4548 wrote to memory of 5076 4548 MsiExec.exe 93 PID 4548 wrote to memory of 5076 4548 MsiExec.exe 93 PID 4548 wrote to memory of 4040 4548 MsiExec.exe 94 PID 4548 wrote to memory of 4040 4548 MsiExec.exe 94 PID 4548 wrote to memory of 4040 4548 MsiExec.exe 94 PID 4548 wrote to memory of 3812 4548 MsiExec.exe 95 PID 4548 wrote to memory of 3812 4548 MsiExec.exe 95 PID 4548 wrote to memory of 3812 4548 MsiExec.exe 95 PID 4548 wrote to memory of 4852 4548 MsiExec.exe 96 PID 4548 wrote to memory of 4852 4548 MsiExec.exe 96 PID 4548 wrote to memory of 4852 4548 MsiExec.exe 96 PID 4548 wrote to memory of 4368 4548 MsiExec.exe 97 PID 4548 wrote to memory of 4368 4548 MsiExec.exe 97 PID 4548 wrote to memory of 4368 4548 MsiExec.exe 97 PID 4548 wrote to memory of 2408 4548 MsiExec.exe 98 PID 4548 wrote to memory of 2408 4548 MsiExec.exe 98 PID 4548 wrote to memory of 2408 4548 MsiExec.exe 98 PID 3320 wrote to memory of 4936 3320 msiexec.exe 99 PID 3320 wrote to memory of 4936 3320 msiexec.exe 99 PID 3320 wrote to memory of 4936 3320 msiexec.exe 99 PID 3320 wrote to memory of 2844 3320 msiexec.exe 100 PID 3320 wrote to memory of 2844 3320 msiexec.exe 100 PID 3320 wrote to memory of 2844 3320 msiexec.exe 100 PID 2844 wrote to memory of 2924 2844 javaw.exe 101 PID 2844 wrote to memory of 2924 2844 javaw.exe 101 PID 2844 wrote to memory of 2924 2844 javaw.exe 101 PID 2924 wrote to memory of 3884 2924 cmd.exe 103 PID 2924 wrote to memory of 3884 2924 cmd.exe 103 PID 2924 wrote to memory of 3884 2924 cmd.exe 103 PID 2844 wrote to memory of 3076 2844 javaw.exe 105 PID 2844 wrote to memory of 3076 2844 javaw.exe 105 PID 2844 wrote to memory of 3076 2844 javaw.exe 105 PID 3076 wrote to memory of 2040 3076 cmd.exe 107 PID 3076 wrote to memory of 2040 3076 cmd.exe 107 PID 3076 wrote to memory of 2040 3076 cmd.exe 107 PID 1584 wrote to memory of 1812 1584 jrestub.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\Limewire_5.5.16.exe"C:\Users\Admin\AppData\Local\Temp\Limewire_5.5.16.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\SysWOW64\msiexec.exemsiexec /i C:\Users\Admin\AppData\Local\Temp\install_flash_player_10_plugin.msi /qn2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:3848
-
-
C:\Users\Admin\AppData\Local\Temp\jrestub.exeC:\Users\Admin\AppData\Local\Temp\jrestub.exe /s /L C:\Users\Admin\AppData\Local\Temp\jrelog.txt IEXPLORER=0 MOZILLA=0 REBOOT=Suppress2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\\msiexec.exe" /i "C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.6.0_18\jre1.6.0_18-c-l.msi" /qn ED=0 SP1OFF=1 SP2OFF=1 SP3OFF=1 SP4OFF=1 SP5OFF=1 SP6OFF=1 SP7OFF=1 SP8OFF=1 SP9OFF=1 SP10OFF=1 SPWEB=http://javadl-esd.sun.com/update/1.6.0/sp-1.6.0_18-b74 /L C:\Users\Admin\AppData\Local\Temp\jrelog.txt IEXPLORER=0 MOZILLA=0 REBOOT=Suppress METHOD=jother PROG=03⤵PID:3124
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\\msiexec.exe" /i "C:\Users\Admin\AppData\LocalLow\Sun\Java\AU\au.msi" ALLUSERS=1 /qn PROG=03⤵PID:1812
-
-
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe"C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe" -r jre 1.6.0_18-b743⤵PID:2196
-
-
-
C:\Program Files (x86)\LimeWire\execNoWindow.exe"C:\Program Files (x86)\LimeWire\execNoWindow.exe" "C:\Program Files (x86)\LimeWire\unpack200.exe" -v -l "C:\Program Files (x86)\LimeWire\unpack.log" "C:\Program Files (x86)\LimeWire\LimeWire.pack" "C:\Program Files (x86)\LimeWire\LimeWire.jar.tmp"2⤵
- Executes dropped EXE
PID:3744 -
C:\Program Files (x86)\LimeWire\unpack200.exe"C:\Program Files (x86)\LimeWire\unpack200.exe" -v -l "C:\Program Files (x86)\LimeWire\unpack.log" "C:\Program Files (x86)\LimeWire\LimeWire.pack" "C:\Program Files (x86)\LimeWire\LimeWire.jar.tmp"3⤵
- Executes dropped EXE
PID:4744
-
-
-
C:\Users\Admin\AppData\Local\Temp\toolbarChecker.exe"C:\Users\Admin\AppData\Local\Temp\toolbarChecker.exe" LMW42⤵
- Executes dropped EXE
PID:1604
-
-
C:\Program Files (x86)\LimeWire\LimeWire.exe"C:\Program Files (x86)\LimeWire\LimeWire.exe"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2036
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5D76ECD251CFFCACB269AFDEF9D57AE42⤵
- Loads dropped DLL
PID:2760
-
-
C:\Users\Admin\AppData\Local\Temp\FP_PL_MSI_INSTALLER.exe"C:\Users\Admin\AppData\Local\Temp\FP_PL_MSI_INSTALLER.exe" /s2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:4368
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A9222D7C180B96552C34F42AE11B5FB62⤵
- Loads dropped DLL
- Blocklisted process makes network request
PID:4228
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4A6DD70BFCD8F099987A5F5228AC4BD2 E Global\MSI00002⤵
- Modifies Installed Components in the registry
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Program Files (x86)\Java\jre6\zipper.exe"C:\Program Files (x86)\Java\jre6\zipper.exe" "C:\Program Files (x86)\Java\jre6\core.zip" "C:\Program Files (x86)\Java\jre6\" "C:\Users\Admin\AppData\Local\Temp\java_install.log"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4188
-
-
C:\Program Files (x86)\Java\jre6\bin\unpack200.exe"C:\Program Files (x86)\Java\jre6\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre6\lib\rt.pack" "C:\Program Files (x86)\Java\jre6\lib\rt.jar"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3520
-
-
C:\Program Files (x86)\Java\jre6\bin\unpack200.exe"C:\Program Files (x86)\Java\jre6\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre6\lib\jsse.pack" "C:\Program Files (x86)\Java\jre6\lib\jsse.jar"3⤵
- Executes dropped EXE
PID:5076
-
-
C:\Program Files (x86)\Java\jre6\bin\unpack200.exe"C:\Program Files (x86)\Java\jre6\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre6\lib\plugin.pack" "C:\Program Files (x86)\Java\jre6\lib\plugin.jar"3⤵
- Executes dropped EXE
PID:4040
-
-
C:\Program Files (x86)\Java\jre6\bin\unpack200.exe"C:\Program Files (x86)\Java\jre6\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre6\lib\javaws.pack" "C:\Program Files (x86)\Java\jre6\lib\javaws.jar"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3812
-
-
C:\Program Files (x86)\Java\jre6\bin\unpack200.exe"C:\Program Files (x86)\Java\jre6\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre6\lib\deploy.pack" "C:\Program Files (x86)\Java\jre6\lib\deploy.jar"3⤵
- Executes dropped EXE
PID:4852
-
-
C:\Program Files (x86)\Java\jre6\bin\unpack200.exe"C:\Program Files (x86)\Java\jre6\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre6\lib\charsets.pack" "C:\Program Files (x86)\Java\jre6\lib\charsets.jar"3⤵
- Executes dropped EXE
PID:4368
-
-
C:\Program Files (x86)\Java\jre6\bin\unpack200.exe"C:\Program Files (x86)\Java\jre6\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre6\lib\ext\localedata.pack" "C:\Program Files (x86)\Java\jre6\lib\ext\localedata.jar"3⤵
- Executes dropped EXE
PID:2408
-
-
-
C:\Program Files (x86)\Java\jre6\bin\javaw.exe"C:\Program Files (x86)\Java\jre6\bin\javaw.exe" -Xshare:dump2⤵
- Executes dropped EXE
PID:4936
-
-
C:\Program Files (x86)\Java\jre6\bin\javaw.exe"C:\Program Files (x86)\Java\jre6\bin\javaw.exe" com.sun.servicetag.Installer -source "Windows JRE installer"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\cmd.execmd /C WMIC computersystem get model3⤵
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC computersystem get model4⤵PID:3884
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C WMIC computersystem get model3⤵
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC computersystem get model4⤵PID:2040
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C WMIC computersystem get manufacturer3⤵PID:4416
-
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC computersystem get manufacturer4⤵PID:4172
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C WMIC bios get serialnumber3⤵PID:3520
-
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC bios get serialnumber4⤵PID:2184
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C WMIC cpu get manufacturer3⤵PID:2004
-
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC cpu get manufacturer4⤵PID:1104
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e57734e.rbs
- Size 8KB
- SHA256 3c8917244e4c876585e0e7f7663911f1ab74388464227e471fceecd9227f37fa
- MD5 7053ea70e7a38b14daf4247ea4d1d25c
- SHA1 17cbf3c3e4fd4d21d1bea5fb5a35c8faeb6da600
- SHA512 c5a406ad83e00ec443fdb184c2cbb33cc49eb8fe04792025977021b89732010dd1302949de2727b54b83c350070f6f1e6dd57c9efdae5ea9ebe3f86f221bf761
- SSDEEP 192:mMDC0EeQciGsAep+D0Y8IAr+D0Y8IAyxZS0sopzl:m7TTHTCh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Config.Msi\e577353.rbs
- Size 10KB
- SHA256 9ee337065a6567165fe3df5b744354e5dc2282f2080bcb24a1c8da59aeac18ea
- MD5 2611fe674326a6a7d20269ce0b383319
- SHA1 fccc52aec6e5c6f33731b4fb4b789222170f2fd1
- SHA512 d3900ff48247e3ba753b04df9a94ea1ecd2623ba50727fd0618799ccb06d622d40b1a20d4c7054f6d3190832fdeb2e320fa65382f16f6bb1383543c714566389
- SSDEEP 192:JsEE7XiG9Ae8MBYfZG0G5MBYfZd02K2u3Xpt+htLUbY5:J8yNlfxClf0wuf+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Java\jre6\lib\zi\GMT
- Size 27B
- SHA256 0a526439ed04845ce94f7e9ae55c689ad01e1493f3b30c5c2b434a31fa33a43d
- MD5 7da9aa0de33b521b3399a4ffd4078bdb
- SHA1 f188a712f77103d544d4acf91d13dbc664c67034
- SHA512 9d2170571a58aed23f29fc465c2b14db3511e88907e017c010d452ecdf7a77299020d71f8b621a86e94dd2774a5418612d381e39335f92e287a4f451ee90cfb6
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\LimeWire\LimeWire.exe
- Size 492KB
- SHA256 1ff8c71e2b4931cc62a624b465d6623ec41d8f457b81b71d2d38474513ffb86d
- MD5 2b7f2dc5741bb18f7f5ec7558da68197
- SHA1 850d6c91c1b0114e6585f5f7924ca7e8cb9ec97c
- SHA512 9de16fb7facb3cb7a959cd28eee572fdd03dd4fc62c8ee8603bc1d38b84e7369195eb12ce7f8a0997a69b6d30af716b8f81d4faa9893f72a711f87024719e012
- SSDEEP 6144:/r9QR0c4dF6U9GTBgFEViPySU5P6blpp7EWcd0+jJnvHuw4x7QCfs5H++80LS:/r9ZdEUMT6FEoKS6CbqWwjJZ4Tf6lLS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\LimeWire\LimeWire.ico
- Size 24KB
- SHA256 30657b82f1caa63d6a74e7f87df8882cf6162ef56c6d89f26830886842e84923
- MD5 933fa742ef155bbe47c5b603eb390694
- SHA1 5440590c53cba80d24ff282d1f1051c881a2530a
- SHA512 2e43b97a46ae843dee1efa0298c90539bc7ac7f0f56b4cb5cf8e82eb9b51d7a7793d8e0254d5998075e916c0a3e722d9306a68e807d8b4230be6faa274eea3a5
- SSDEEP 384:fbvp5VxDbu2gHUM2qpCVAodZxPckXNt+jX66sYuM+wXVDkch:Dx5VxDbu50IiVL+HsLM+GBl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A92F33496848CFF4F115ED04BCDD933A_6C14F82F698E40985D569864739DB21B
- Size 5B
- SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
- MD5 5bfa51f3a417b98e7443eca90fc94703
- SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
- SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C554DCF706A5AAB8B360FAD227EAB9C7
- Size 1KB
- SHA256 b674ab1941b315b897fb0d0cf91facfe75f268af88a8473795e3588b278b7eee
- MD5 63f207bab54520e443af5f5d879666ca
- SHA1 ae4d1aa61e3de3db80c8c7f41e9bce526fb05693
- SHA512 77a6db3c7dbb138e5d5bb2fc001c56797a399c0cd22195c9878865d16f38fea5712cd892b04ac97c8fdee82990244ad7a9822d3eecf5102c4c49b27dd250f089
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A92F33496848CFF4F115ED04BCDD933A_6C14F82F698E40985D569864739DB21B
- Size 408B
- SHA256 1ee81bef3161cf239a4d821c46a644599edf26c8f4fcb45bde60c60267d3f976
- MD5 08ba4853379adb19569bacaa2d20528a
- SHA1 b59b1a1ad901c3b44609bd5481f4db69c5a5e847
- SHA512 e708e26dfdfafe5f102948519655952a8a7d755fe4ceb0c8f319e0daa17766c3ccb7007e24180a4dadd2a42f9cb2766e37fd90bd3ae8d2e90fae9e5d1e33d80c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C554DCF706A5AAB8B360FAD227EAB9C7
- Size 188B
- SHA256 ab3e67ece27331bca758f1cb1edd4790ccd8b97b4f6d294d702229916b8074b9
- MD5 682f4e915f7b5567eeda810c2630bd3a
- SHA1 8375f75cfb170e488b9904459082e58f661af1ea
- SHA512 a5769a9ccba8c01b181b86a9021c481332bfa546ced3df78365964d8b9be78801e7361d11307d1b8dee528f80e3b1e08bf2e444fd46287697ece48a88658d06d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.6.0_18\jre1.6.0_18-c-l.msi
- Size 11.8MB
- SHA256 d8dbf634e775d8fdcb6891758520cf8ab80a32de2c94e9493ceab93cedf5ecf8
- MD5 53df295a99335d837423249e600c78ac
- SHA1 7266661133fd1a4e5566ed876b94b600fbdc27bf
- SHA512 ff0404f87453be69331411043e76b09aba87e6d7abefd3f70af421cf04103aff0ed226eaae4aad75b04118cde1cbf5257bbb82f830965a9953a7ceada7162db7
- SSDEEP 196608:hiWNu3TtObiolIQZsdJ1imJEyrSPh67FWuvgfftTVD2/4d5OTp9q98cR/PhG/:ICuDtxM5iJ8mWy2O4ZntTVD2/4dE9ej
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.6.0_18\lzma.dll
- Size 149KB
- SHA256 eb3471cf995199aebab00bf98cd2aaa5ba9afed8b85cdf1e82ffb98b288fa8ec
- MD5 3e87b9412a214afeed6603382c81ca49
- SHA1 501acfcb9959d77a9afbc058749d8f4bb4bc5cc7
- SHA512 13ee969236feffce696d04fb2106de8457f8c3aad40cea4211ee2595bbf1d657506b0e88e8c32d1626f0bec85d84cf71ad4f5410c8fb99a9bbbd0a5d157209c6
- SSDEEP 3072:A4gmoAZplSUS5IIiqbukO/3msvJv7DDpNePhFpnVlEC2:BgmoADlSUSWIlbuks3mGvnDpNohzkC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\FP_PL_MSI_INSTALLER.exe
- Size 1.8MB
- SHA256 575d59cef8075085f223896a980125f5faa5ee3c42bc59725cadaa5ef6c4217f
- MD5 ff637bfa17992211f0aa14120ce70283
- SHA1 b7f3143f0a852258c93dc73d0ade6fa50b69b0cd
- SHA512 d7d8ff2857b56d74941ca79d6a2354ba13d9972f4428cf9845d314cb97c7d005bf56f953bfdd6c27f3520d009909ea0011c8f59b2b5bf674a1981390fc76ffee
- SSDEEP 49152:o911UOp06NYFfsR4m16Hf8CnDL1btxIBvxO:olU966FfsR42af8If1bgBM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI772bf.LOG
- Size 1KB
- SHA256 22cb71ca7e913e3342f660eb14173152f6be6c39f4ba99738b8aefcd3df306df
- MD5 232ef61853c5691398df4cb0a3312c32
- SHA1 492dd7de5a99562a31f5f880d563a04aeb28ac6b
- SHA512 890610d18c1eac428807806bf7d231939a8269a60e32e55f4dda0a8cd45d5e1e6f4c591f8e94c5777171b1d04592b881218585c352dc77b76cfdd5901c3c44e7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\install_flash_player_10_plugin.msi
- Size 2.8MB
- SHA256 9845e1e471be93781a0a7e934883f9e1502eabcf16cdd3d5a5dcf5c2ea6defa7
- MD5 ba1b533302caddf37e352c3599311be3
- SHA1 ea9cd7dd6ffbb7b2249870e42785ac1d0728c770
- SHA512 6e697808a375ca611527d1f1b9c64b68edef913a51c2e74ab46b7417aa5c7faa198c88994720ed82dc2d9e7513fa680e0720ebb865417afb18e08eb838ec10b6
- SSDEEP 49152:PF3Yyq1BhI11pM70HK4VBzu3Oi6OA8hnH49j5VgujT:1Yyq1Bhmp5HPVBzu3x/A8BY9jMu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\java_install.log
- Size 26KB
- SHA256 d901223d74038ee199057aa0713abf6d3d649d51a2105f02bcd452d7e2bb7901
- MD5 85d3f69800e117514f2e915f3a8d1905
- SHA1 b2d1675bcbf566bea7ff9a10a43f9621f678f62b
- SHA512 79f44c34027c7dc64da9eccf71b9bc7c36abc736088557fc329a45cc4c4a8c79f6e26dd79e87d61ef8e25fad19dec4ad4086d3b0f115d6693fb4b3a1792d47d1
- SSDEEP 384:5RgY2YadAYD1TYgiT3EH5SG0BxU/nikHL:/gY2YYAEheEH5S9YnikHL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\jrelog.txt
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\jrestub.exe
- Size 898KB
- SHA256 8278a6df47d4f55b1e7fb8108fd0ddcb77dad78d0bf9b2c76829d091a902f012
- MD5 0f2e650297a42c029811192a45d11bde
- SHA1 d87ae041a3379e1e3f7c9f2391bbe1b7ce28e5d0
- SHA512 f577614bb5180261d51d46f811ecf484d7881c24b92bab37f3d06c1cbecb7ad209672502dc39714821195cb8db15b4743552129b1ecfa8056e6d8f3b3a1821ba
- SSDEEP 12288:Ipj7+ckMu5KRYlXhAOqdOP2kVj9yqsqFZe31QtN+iUpNN1IXfi4oQr/GRo8toSxP:ptKR2XhLFIFQtN4pNN1A6BQ6Ro8J
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\jusched.log
- Size 296KB
- SHA256 ff5c918a2e331449a9cb8eec127bb62188882959926711ce2f0452c0ace5db55
- MD5 52e47107d0ece4cf4af758a1a194dac3
- SHA1 389eeb224dcced04e6e96f76f322cb5b273580ef
- SHA512 4c183ecca82a25f23ccc19af08802d331e785541f20ed5906dbead3bcba1629bc2ffd4b16bf7338a38d9b59051fcfc9c5ac6503888f1e2b4b399e8ba4bd6ebfe
- SSDEEP 3072:0TgQCwJluXJf5tQ8tLgw9PMF8RqIVnirKU793ssuB1WUxSMzJL6ZtEtLiHqUYMfR:0TgQ+tLgw95H5705r
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsi5BBD.tmp\Banner.dll
- Size 4KB
- SHA256 05838c8f81efbb98679010158f29cefd88a34fb1fe5d603e839dd406235ddf29
- MD5 91c9ee5005ac6cb4ec79a3b039b4c8df
- SHA1 95a9c018b501b6697beca846a33955909c3f97be
- SHA512 41cc45a64fbe64cd83e704e87193004245f5d29f4f880921d041e5f2ceec86ca0653146e6477642eba73875b9d5f0d773b540436b19e4797def9c15d7618474b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsi5BBD.tmp\ExtractDLLEx.dll
- Size 7KB
- SHA256 73acba7dd477dfd6cf4249911f4e3c781196c7cf6b28425761dcb2d4f90c36c5
- MD5 ba4063f437abb349aa9120e9c320c467
- SHA1 b045d785f6041e25d6be031ae2af4d4504e87b12
- SHA512 48a813f55834069f8c6b90740de3df01564a136b0fe637f9f85cc1a19d7f32b1f70205ff2462526508fe3c1962d7c1e8e384c40463e328538aeba28e8d0fb92a
- SSDEEP 96:lyEPmi/06iLbX8SIP59L1MmqPbgkk/eWKCHGojGYYIF/ggiomsTeZUzI:lyEPmymbMbPZOz+/eWJmoUItiopTeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsi5BBD.tmp\FindProcDLL.dll
- Size 3KB
- SHA256 0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
- MD5 8614c450637267afacad1645e23ba24a
- SHA1 e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
- SHA512 af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsi5BBD.tmp\InstallOptions.dll
- Size 14KB
- SHA256 8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c
- MD5 0dc0cc7a6d9db685bf05a7e5f3ea4781
- SHA1 5d8b6268eeec9d8d904bc9d988a4b588b392213f
- SHA512 814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0
- SSDEEP 192:n6d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jPK72dwF7dBEnbok:n6UdHXcIiY535zBt2jP+BEnbo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsi5BBD.tmp\KillProcDLL.dll
- Size 4KB
- SHA256 c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93
- MD5 99f345cf51b6c3c317d20a81acb11012
- SHA1 b3d0355f527c536ea14a8ff51741c8739d66f727
- SHA512 937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsi5BBD.tmp\LangDLL.dll
- Size 5KB
- SHA256 2a7f33ef64d666a42827c4dc377806ad97bc233819197adf9696aed5be5efac0
- MD5 a401e590877ef6c928d2a97c66157094
- SHA1 75e24799cf67e789fadcc8b7fddefc72fdc4cd61
- SHA512 6093415cd090e69cdcb52b5d381d0a8b3e9e5479dac96be641e0071f1add26403b27a453febd8ccfd16393dc1caa03404a369c768a580781aba3068415ee993f
- SSDEEP 48:iV6sAvmNC6iMPUptxEZK65x/AmvycNSmwVsOYJyvrpXptp/JvR0Joof5d2:2V11GED5ZTvycNSmwVsTJuftpZR0Ld2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsi5BBD.tmp\LockedList.dll
- Size 18KB
- SHA256 c79c0b410049411a70293f1657a2144d71a647753785f5134f47f1f977f90fd3
- MD5 acb2534a2b90fcdc079966203abb83a6
- SHA1 36e6842e78d8f1c6e2f3a6d93667bef1cfa5d3d6
- SHA512 e77b6b1d09b59af51e3f98debdd8eb472778c339be71849e19b5ad3f262c037bf050d3fd892d194ca24b9fd43c682d1a903629318792a2fd9fee4582d316b959
- SSDEEP 192:8X3aaH6S1xA9hTSrlnUieI65sD1BIYF3uzyBLff3lhOh18iaLI+AmOZrfCTliZPO:sKQzln7xrPlhOh1Xa05fCTlUPf5hXuz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsi5BBD.tmp\RunProcess.dll
- Size 180KB
- SHA256 ad31aa34cf3371c522b58ba7cc4958d6ea98f96510896cf680c313d21925bac5
- MD5 6f05acd8d0b80754534355437cfa4f0b
- SHA1 956f7048b41db52585ae663872e5a35cb9d72f3c
- SHA512 84d2322ace21adbb8404cb1adbaa05684afa3014005e504fbfed614f42fa170ce917bd6418db95be732f1e1923ce9da9e5b0cca51e76497d8e76e37d14de3be6
- SSDEEP 3072:+7cpps5NLaOXCo/QrBdiE3l9R0QVLjqS9PtlDAm1tDKso:+us5JFXrIrBYY9OEzMmro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsi5BBD.tmp\System.dll
- Size 11KB
- SHA256 dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
- MD5 00a0194c20ee912257df53bfe258ee4a
- SHA1 d7b4e319bc5119024690dc8230b9cc919b1b86b2
- SHA512 3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsi5BBD.tmp\UserInfo.dll
- Size 4KB
- SHA256 7d099352c82612ab27ddfd7310c1aa049b58128fb04ea6ea55816a40a6f6487b
- MD5 1e8e11f465afdabe97f529705786b368
- SHA1 ea42bed65df6618c5f5648567d81f3935e70a2a0
- SHA512 16566a8c1738e26962139aae893629098dc759e4ac87df3e8eb9819df4e0e422421836bb1e4240377e00fb2f4408ce40f40eee413d0f6dd2f3a4e27a52d49a0b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsi5BBD.tmp\ioSpecial.ini
- Size 766B
- SHA256 7441ae787782dc787ac4a34b839d3c74812601dbf7181c6266eaf41d1168178f
- MD5 38343adab8a0f325f94779bcb11c398e
- SHA1 97e85bdaa9c37d72e680643f98ec19358647730f
- SHA512 e2a53117c4a27a389dea5cea69c9c11e1ce53be2e4b1c714952543c84a02710f2466ce70a1372a504a7beea8197ced3efb3d97215193e44ef9527a8f8de721fb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsi5BBD.tmp\ioSpecial.ini
- Size 775B
- SHA256 bfa0d0020b3c0ee6d8e8faab0d7428afca9f6e86ac2352fc6be3e0858dca9d3f
- MD5 a5ecbd29553688adda7acb944059601b
- SHA1 55fbe47cf8cf10f71557bc65b433bf6a04fd2a4f
- SHA512 f3ee7455e5425b46086854e12b10fc26dc03cb0fa63cd970cdd06db638d1f4a48a29f13fc81587b4e234e73c6cf620332b18e1b17ac43cb11fdb8f16e2131ea6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsi5BBD.tmp\legal.ini
- Size 1KB
- SHA256 acb9ff181db79d9d51b005f4795b1abba94f1cf0651f0117f1226ea5195c4865
- MD5 744f69407502d52f7e7f12f242852a96
- SHA1 6b949675ec10f2f79e9270c577566f10c6b0d851
- SHA512 37f809b2a4b5403e648f703d27779f855e7e03720b3dac00b48dd7607db9dca98adaf02829edc77b17ea1a0559fbe1699a01b3d9ddc1d969be378f039556c90d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsi5BBD.tmp\legal.ini
- Size 1KB
- SHA256 1a4750f51590a94db0404fcd7921714c231663d15091a78503b71e18ed6a46be
- MD5 ddde964da6ebdcf511a82e27e350e24d
- SHA1 e9e3d0524f57b6803a2f1f3d4b45afad40b3423d
- SHA512 1032c8deb25b92cd9b3ab5fa0e8da2b45e6766914c1fbb74f704824e397e16883f64228aff99bdc2afc476a0c151ea6b776a41c4aab070c3d4d79f9be29163d9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nst7699.tmp\NSISArray.dll
- Size 17KB
- SHA256 38654eef0ee3715f4b1268f4b4176a6b487a0a9e53a27a4ec0b84550ea173564
- MD5 2b8574f6a8f5de9042baa43c069d20ba
- SHA1 07959da0c6b7715b51f70f1b0aea1f56ba7a4559
- SHA512 f034f71b6a18ee8024d40acd3c097d95c8fd8e128d75075cc452e71898c1c0322f21b54bd39ca72d053d7261ffbab0c5c1f820602d52fc85806513a6fe317e88
- SSDEEP 192:YAFuV2Ow8mbPNnDSnYJly4RX+VGeSDlsGUlyGaWNn3B3/WXZWsQs5PaqJ7En/5U3:YA4V2Jb1nDSnc+Zos1lP6Suhe/q9l
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nst7699.tmp\System.dll
- Size 10KB
- SHA256 c11ffa087c6848f3870e6336d151f0ba6298c0e1e30ccddf2da25a06d36a61fc
- MD5 16ae54e23736352739d7ab156b1965ba
- SHA1 14f8f04bed2d6adc07565d5c064f6931b128568f
- SHA512 15dbfcdc5dc34cb20066120045e3250f8df9e50b91de043f2ada33ac0235907d98668e248828a7ed9c75e25dfb5103b7248867530ce73ee36f6a35c30b4afa9f
- SSDEEP 192:HO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1a8gMO:GKAFERdlxhGRYUzqZa8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nst7699.tmp\UserInfo.dll
- Size 4KB
- SHA256 21a373c52aaecce52b41aebe6d0224f53760fc3e5c575e821175eee3a1f7f226
- MD5 68d73a95c628836b67ea5a717d74b38c
- SHA1 935372db4a66f9dfd6c938724197787688e141b0
- SHA512 0e804deab4e647213132add4173c1d2c554c628816f56e21e274a40e185d90254e29c8bfc6fbfdfea2a492d43d23c0bfa4b276252a3f5e1993ab80ff832c4914
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\LimeWire\browser\xulrunner\chrome\classic.jar
- Size 759KB
- SHA256 aa68c283a5a447b5d050a99fa780194a85ca5bda8d88ae1ce0ab524ca14ee8c1
- MD5 ee66b755fbe00931dfefb8b30869f6db
- SHA1 36f88c3380f6491c3cff5458197e2cf086079504
- SHA512 2770733be288a3cca503bf91c28821e30587354622e7c8854f2c849015df63cb9eb141c4888cdcec0d7f75ce28a307d0adc7170e448270a2b6e18cee3bed3ee4
- SSDEEP 12288:bIiQ6BMpgT9bl9xGdycTcEc4GVIziPOr7O7eUo6MzFwW1ZsQGMFR0/oLL2RSRoc4:toLL2NONQdEKrV1t
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\LimeWire\browser\xulrunner\chrome\en-US.jar
- Size 324KB
- SHA256 d7f81742dfe3d35cda6f22e449879bfa37c7a6abba560432d517792c5bf2adac
- MD5 5c1624554ce568d668f2e7bfc11151b9
- SHA1 51180b987c7305cfd176e4d92b936eff4e001f62
- SHA512 9947e985674e126285108ae1fc9f5fe75e04e9315937b01676a97ebfc8eae6f8d2933c5783b5c7b6507058cbec53fe3ea7f0d52ef5c36a7e47991935c953d6c7
- SSDEEP 6144:vx/FLt5zt1Y5sPue+6NGMaHGMQ0huN7DTTVTGsss5vtfxnB/JTE4bXdJIYAFw+oA:vx/FLt5zt1Y5sPue+6N3aHGGC/VTGssl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\LimeWire\browser\xulrunner\chrome\limewire.jar
- Size 8KB
- SHA256 ad06cbee7fb1bde10498b342a584e68d69d87bcad1e0b15fcc49ffe520709779
- MD5 964744738869ff5f4febae1b42c35da4
- SHA1 f2192d0453001ec9ffac1c29617aaf0ec5baffd4
- SHA512 191866e6c7292ca912cf19cdb824a42a7de0d5a28a55da49c1f26cb5d600345491e5e11a589b19dd307349e74f75bb865029df9f129ec6ff61c4d5eba2181117
- SSDEEP 192:5y8uM4QxwSIY+eLGpM2IhIilnvyZwdSmatTzAy5Gl/fNYk:zJ4sKHeLGphGIUnvyZ59zAy5a/f5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\LimeWire\browser\xulrunner\msvcr71.dll
- Size 340KB
- SHA256 8094af5ee310714caebccaeee7769ffb08048503ba478b879edfef5f1a24fefe
- MD5 86f1895ae8c5e8b17d99ece768a70732
- SHA1 d5502a1d00787d68f548ddeebbde1eca5e2b38ca
- SHA512 3b7ce2b67056b6e005472b73447d2226677a8cadae70428873f7efa5ed11a3b3dbf6b1a42c5b05b1f2b1d8e06ff50dfc6532f043af8452ed87687eefbf1791da
- SSDEEP 6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\LimeWire\browser\xulrunner\plugins\npnul32.dll
- Size 56KB
- SHA256 a14628fdb1808d760bd538b61c5fc6a1730c6c3c5c5e345470e1b68d789a4876
- MD5 6078bb60da0bc6d988d1cbc66a9072c6
- SHA1 40527bd71f83527b691497ca06f87f24a77b782a
- SHA512 2d7ec502a3d5bfeaec14e4480b07c1e17d9bf1430a8598438074e012e6883ffca2c5814567d752a82411c1b166278cf530b24eadfde16578ce857fa20f078f7c
- SSDEEP 768:pQbwuoA/mVUnB3nmQBIDRVkymwK7ILpsioEtWkHBESq24:0iA/mVkfIDTkymwfLgsPBEt24
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\LimeWire\library5.dat
- Size 454B
- SHA256 0ce6070e7d057f659863d84173204ba728e722abfcb94239a6c89c5b0ae66a57
- MD5 47863d0411b0b2c5290b26a8fc90f1fd
- SHA1 09d868de3e25b7f013a2b3902a9b8ea64e869642
- SHA512 b41df7eab11378e53a181a6dae1284a88960f7b56aa61343562995b8e6a3de6c3497b2835672079606c897ef3884603930761820f79532f50f4d127baece60a5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\LimeWire\update.cert2284726009550676907tmp
- Size 786B
- SHA256 35d67c73d6ee53c67acdac83473103084f15b4c92e1aca32d02751991ade1ea2
- MD5 320fea5fefa7201eb43aa333f6567e0b
- SHA1 2c1c065a48d0cbc19491c63c00d3982afa3010a3
- SHA512 14f5c47feece97af0ae256b9d2f1e5a451047ec101df080478c2eaaf68bd8877d8d76fb2b454af1d0107175e2d4899c061eedba5de0787060e7513878f3c42b2
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\MSI7530.tmp
- Size 84KB
- SHA256 9dc871199cc9e96067a32401d225af50683ac14efaf35edc61aa45f346374494
- MD5 abb81f7897bb48a036686ccf840287ae
- SHA1 d6d648782584340bfa56c8e6d34fd70707af5d36
- SHA512 4769d555b95ad593eae41e1cb91a9c7539b1c115b9b19a4954dec791f4d662388b459e3b7ad2964d5e0db4270406816582986d5a184bf55fd6c067906c2e0b25
- SSDEEP 1536:Givk7DtT4NxMQxmWthib9C0X/niKJK+TcAyc/idw5eQ7:Pcnsx1FTidK+TcAyc/i25X
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI9465.tmp
- Size 108KB
- SHA256 f824ddc055db061a77b0a0a4f2e7224c0df074aa60c0540f96724be416100c03
- MD5 a31e140d42571f7deadf5878aca17e0e
- SHA1 c3e4bb0550970f31711482cc02dafce025f1103d
- SHA512 61ddcfffa695dcee62b99df78a08c03946830e66fc732b1aaaec8311be771375bcc4f8932269a8db7f8565509a1cb6a9b4747aec046b7d5e00cb75048a21ee71
- SSDEEP 3072:OqvY98JJhNJpEgvObzeoAXEkjVsupDljX6:WEJhDvv+SoAXEkjmK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
- Size 3.7MB
- SHA256 710b2e4c71e73d4d0a99b786d22de56732cb7e358ee1e8254b0c26f069719efe
- MD5 f8efdcfc440a420d6c1ecd245ab20207
- SHA1 f47972cdc8ef6a1b6af7ebd6d04ef3bd6b1fc118
- SHA512 4fb54e4678f42e8beee57de6b450f95b1f8b201e5109d3ba72630b5204f7dd7f84e287ef7a0e48550515efe48344d27027a6329cc1aa8216ab738ac215cf728d
- SSDEEP 49152:fg5SCCzzvoUzTbg3LmuBkQt3fCETKhg5IvLMkwAwwCQ+IPmTcjsRt143Eg8WSr7L:fgRCzzvoU03LBF2gO3mTcGt14KWskHW
- MD5 SHA1 SHA512 SSDEEP