Malware Analysis Report

2025-06-15 20:57

Sample ID 240525-2pnj1adh63
Target Lunar.exe
SHA256 2d952fedf846b7d19e3e75632fa03826b6da922ba04c308283c5ce8110a5e456
Tags
pyinstaller
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

2d952fedf846b7d19e3e75632fa03826b6da922ba04c308283c5ce8110a5e456

Threat Level: Shows suspicious behavior

The file Lunar.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary

pyinstaller

Loads dropped DLL

Unsigned PE

Detects Pyinstaller

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Modifies registry class

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-25 22:45

Signatures

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-25 22:45

Reported

2024-05-25 22:48

Platform

win7-20240220-en

Max time kernel

128s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Lunar.exe"

Signatures

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1732 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe C:\Users\Admin\AppData\Local\Temp\Lunar.exe
PID 1732 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe C:\Users\Admin\AppData\Local\Temp\Lunar.exe
PID 1732 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe C:\Users\Admin\AppData\Local\Temp\Lunar.exe
PID 2792 wrote to memory of 2824 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2824 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2824 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2736 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2736 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 2736 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 1532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 1532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 1532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 1532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 1532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 1532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 1532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 1532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 1532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 1532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 1532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 1532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 1532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 1532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 1532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 1532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Lunar.exe

"C:\Users\Admin\AppData\Local\Temp\Lunar.exe"

C:\Users\Admin\AppData\Local\Temp\Lunar.exe

"C:\Users\Admin\AppData\Local\Temp\Lunar.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6539758,0x7fef6539768,0x7fef6539778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1132 --field-trial-handle=1372,i,653431686851645439,12334374029810597453,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1372,i,653431686851645439,12334374029810597453,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1608 --field-trial-handle=1372,i,653431686851645439,12334374029810597453,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2308 --field-trial-handle=1372,i,653431686851645439,12334374029810597453,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2320 --field-trial-handle=1372,i,653431686851645439,12334374029810597453,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1548 --field-trial-handle=1372,i,653431686851645439,12334374029810597453,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1248 --field-trial-handle=1372,i,653431686851645439,12334374029810597453,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3020 --field-trial-handle=1372,i,653431686851645439,12334374029810597453,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3580 --field-trial-handle=1372,i,653431686851645439,12334374029810597453,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3560 --field-trial-handle=1372,i,653431686851645439,12334374029810597453,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3536 --field-trial-handle=1372,i,653431686851645439,12334374029810597453,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2484 --field-trial-handle=1372,i,653431686851645439,12334374029810597453,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2372 --field-trial-handle=1372,i,653431686851645439,12334374029810597453,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3716 --field-trial-handle=1372,i,653431686851645439,12334374029810597453,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=2248 --field-trial-handle=1372,i,653431686851645439,12334374029810597453,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3864 --field-trial-handle=1372,i,653431686851645439,12334374029810597453,131072 /prefetch:1

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 apis.google.com udp
GB 142.250.200.14:443 apis.google.com tcp
US 8.8.8.8:53 play.google.com udp
GB 142.250.179.238:443 play.google.com tcp
N/A 224.0.0.251:5353 udp
GB 142.250.187.196:443 www.google.com udp
US 8.8.8.8:53 i.ytimg.com udp
GB 142.250.200.54:443 i.ytimg.com tcp
GB 142.250.200.54:443 i.ytimg.com tcp
GB 142.250.200.54:443 i.ytimg.com tcp
US 8.8.8.8:53 content-autofill.googleapis.com udp
GB 142.250.187.202:443 content-autofill.googleapis.com tcp
US 8.8.8.8:53 www.youtube.com udp
GB 142.250.179.238:443 www.youtube.com udp
GB 142.250.200.54:443 i.ytimg.com udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 8.8.8.8:53 static.doubleclick.net udp
GB 172.217.169.34:443 googleads.g.doubleclick.net tcp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
GB 216.58.213.6:443 static.doubleclick.net tcp
GB 172.217.16.234:443 jnn-pa.googleapis.com udp
GB 172.217.169.34:443 googleads.g.doubleclick.net udp
US 8.8.8.8:53 www.python.org udp
GB 146.75.72.223:443 www.python.org tcp
GB 146.75.72.223:443 www.python.org tcp
GB 216.58.212.195:80 www.gstatic.com tcp
GB 146.75.72.223:443 www.python.org tcp
GB 146.75.72.223:443 www.python.org tcp
GB 146.75.72.223:443 www.python.org tcp
US 8.8.8.8:53 media.ethicalads.io udp
US 8.8.8.8:53 ajax.googleapis.com udp
GB 216.58.204.74:443 ajax.googleapis.com tcp
US 172.67.71.230:443 media.ethicalads.io tcp
GB 216.58.204.74:443 ajax.googleapis.com udp
US 8.8.8.8:53 ssl.google-analytics.com udp
GB 142.250.187.232:443 ssl.google-analytics.com tcp
US 8.8.8.8:53 console.python.org udp
US 8.8.8.8:53 2p66nmmycsj3.statuspage.io udp
US 167.99.21.118:443 console.python.org tcp
GB 142.250.187.232:443 ssl.google-analytics.com udp
US 3.162.140.62:443 2p66nmmycsj3.statuspage.io tcp
US 8.8.8.8:53 stats.g.doubleclick.net udp
BE 64.233.166.154:443 stats.g.doubleclick.net tcp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
US 192.178.49.195:443 beacons.gcp.gvt2.com tcp
US 192.178.49.195:443 beacons.gcp.gvt2.com tcp
US 192.178.49.195:443 beacons.gcp.gvt2.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI17322\ucrtbase.dll

MD5 0e0bac3d1dcc1833eae4e3e4cf83c4ef
SHA1 4189f4459c54e69c6d3155a82524bda7549a75a6
SHA256 8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae
SHA512 a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

C:\Users\Admin\AppData\Local\Temp\_MEI17322\api-ms-win-core-localization-l1-2-0.dll

MD5 3589557535bba7641da3d76eefb0c73d
SHA1 6f63107c2212300c7cd1573059c08b43e5bd9b95
SHA256 642b01bb93d2cb529acf56070d65aae3202fd0b48d19fd40ec6763b627bcbee6
SHA512 7aedf3cf686b416f8b419f8af1d57675096ab2c2378c5a006f6ecbf2fe1ad701f28b7be8f08c9083230cf4d15d463371e92a6032178cd6c139d60b26fbd49b06

C:\Users\Admin\AppData\Local\Temp\_MEI17322\api-ms-win-core-processthreads-l1-1-1.dll

MD5 774aa9f9318880cb4ad3bf6f464da556
SHA1 3a5c07cf35009c98eb033e1cbde1900135d1abf8
SHA256 ba9fbd3a21879614c050c86a74ad2fffc0362266d6fa7be0ef359de393136346
SHA512 f7b57afb9810e3390d27a5469572fb29f0f1726f599403a180e685466237dff5dec4fdce40105ef1bb057e012d546308213e7cec73e0d7d3c5815eec8189a75d

C:\Users\Admin\AppData\Local\Temp\_MEI17322\api-ms-win-core-file-l1-2-0.dll

MD5 2b36752a5157359da1c0e646ee9bec45
SHA1 708aeb7e945c9c709109cea359cb31bd7ac64889
SHA256 3e3eb284937b572d1d70ce27be77b5e02eb73704c8b50feb5eb933db1facd2fc
SHA512 fc56080362506e3f38f1b3eb9d3193cdb9e576613c2e672f0fe9df203862f8a0f31938fa48b4ff7115dfe6016fa1fd5c5422fdc1913df63b3fde5f478a8417a1

C:\Users\Admin\AppData\Local\Temp\_MEI17322\api-ms-win-core-timezone-l1-1-0.dll

MD5 b9a20c9223d3e3d3a0c359f001ce1046
SHA1 9710b9a8c393ba00c254cf693c7c37990c447cc8
SHA256 00d9a7353be0a54c17e4862b86196a8b2bc6a007899fa2fbe61afd9765548068
SHA512 a7d5611c0b3b53da6cac61e0374d54d27e6e8a1af90ef66cd7e1b052f906c8b3f6087f4c6de0db3ae0b099df7689ecde6c815a954b728d36d9d3b5d002ccf18e

C:\Users\Admin\AppData\Local\Temp\_MEI17322\api-ms-win-core-file-l2-1-0.dll

MD5 bfffa7117fd9b1622c66d949bac3f1d7
SHA1 402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2
SHA256 1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e
SHA512 b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

C:\Users\Admin\AppData\Local\Temp\_MEI17322\python311.dll

MD5 387bb2c1e40bde1517f06b46313766be
SHA1 601f83ef61c7699652dec17edd5a45d6c20786c4
SHA256 0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364
SHA512 521cde6eaa5d4a2e0ef6bbfdea50b00750ae022c1c7bd66b20654c035552b49c9d2fac18ef503bbd136a7a307bdeb97f759d45c25228a0bf0c37739b6e897bad

\??\pipe\crashpad_2792_DADAXWMJBNRKEOQT

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

MD5 18e723571b00fb1694a3bad6c78e4054
SHA1 afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA256 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA512 43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

MD5 aefd77f47fb84fae5ea194496b44c67a
SHA1 dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA256 4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512 b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT~RFf769972.TMP

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\Tar9F24.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 b48a06754280e640041b83772b281fcd
SHA1 e2d55fd887a6a6f3c78230ca4a676dc261d3a725
SHA256 060cdb38f129cd7154ed026d24556d528d7846293529e74ab559e3e994f7e79e
SHA512 29b79f3053ffb298c04928a20aa851808e346cd08b85640c3fc1e48921bc52fc73e289bfeb717fb4c1fa3ee8d26a3d5bd929b433e50f914087579ddb713a7833

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 5d8d37b86feaf990ee6a78947672110c
SHA1 b4d86064a758c4f7ce6836dad523ea2085a84fca
SHA256 f9ab1dd54cf60c7551dd2a7dce1103ff584699d8bbeae2adc6561037bc4f9e94
SHA512 ca7e44a7b79a90df7616a49bea48415f643132369b207377b93b5b00ebb4d6cebfb60ae76775f52623d91ebda9fadf2add29cc3ab1efe1ccca17ae764e27e012

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fb37f6b21ec30fbf1cb6d78882106271
SHA1 917c28761390e22d540650e850163ce65855290e
SHA256 aca19d542b048742345ca042c954492cb1286ac8718c555ed3157609fcba2fdf
SHA512 7ca2ff460e52d322e837e44febc6514e18c663c719afe44872779e51378b8a73229850cca79e33c44d17be1c02404b8df1414332fdf720af7c7bb24358d8c32e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 6167ca0c50b655003afebb7963167c26
SHA1 514e224fc5757597feda19e39cf786f0e6f3070c
SHA256 53adca75c3df9dbb352310d162fdaef18d4258a2a27f9add24e82c8ffea178c5
SHA512 46d999d55e9c5565e05e5706b0ca90480b486932fa225b5e7429c8a2f93e34a87dccd1e73d3ddcde32cb5fdb20343f16608e188947e03276ec5828b60d4ba442

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 ba83dc64b4731e60b32eaf4b4febc3e9
SHA1 7ece2f98ce5cf23f3761d45f1ca58587ec6a0e4a
SHA256 d0c187cbab3ef367c99f86f0004e553ea9a998a718d6762c305bfadcdffa6905
SHA512 3804b784e1f181647802bbf02e26420132001c43b2e9598f1969c3a4e46c20e74a6db13fc00ef7b0f08f1b0e2eae5ebce77743f8fbb79ad138718c59ba28fb78

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 01ff4e7541f78c4959fd22dba5f2e119
SHA1 48a5ccaaaf001c705cfb8b888a9b0c86221f82ae
SHA256 2f07c6c8d3ec5a03f43d4f3c10e3f973ae10bab3c9c9e1a2544032862e4b9824
SHA512 fac837c797b7ca7c5b1ad472d440dee64883cfcc218add94abe97712d75ae74f2d8afe6ca74fcea3e4f374b6cf679d1f9b8ca39c3be421f5149eeede112a17a5

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-25 22:45

Reported

2024-05-25 22:48

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Lunar.exe"

Signatures

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3592 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe C:\Users\Admin\AppData\Local\Temp\Lunar.exe
PID 3592 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\Lunar.exe C:\Users\Admin\AppData\Local\Temp\Lunar.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Lunar.exe

"C:\Users\Admin\AppData\Local\Temp\Lunar.exe"

C:\Users\Admin\AppData\Local\Temp\Lunar.exe

"C:\Users\Admin\AppData\Local\Temp\Lunar.exe"

C:\Windows\explorer.exe

explorer.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 105.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 24.73.42.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI35922\ucrtbase.dll

MD5 0e0bac3d1dcc1833eae4e3e4cf83c4ef
SHA1 4189f4459c54e69c6d3155a82524bda7549a75a6
SHA256 8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae
SHA512 a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

C:\Users\Admin\AppData\Local\Temp\_MEI35922\python311.dll

MD5 387bb2c1e40bde1517f06b46313766be
SHA1 601f83ef61c7699652dec17edd5a45d6c20786c4
SHA256 0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364
SHA512 521cde6eaa5d4a2e0ef6bbfdea50b00750ae022c1c7bd66b20654c035552b49c9d2fac18ef503bbd136a7a307bdeb97f759d45c25228a0bf0c37739b6e897bad

C:\Users\Admin\AppData\Local\Temp\_MEI35922\VCRUNTIME140.dll

MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

C:\Users\Admin\AppData\Local\Temp\_MEI35922\_ctypes.pyd

MD5 565d011ce1cee4d48e722c7421300090
SHA1 9dc300e04e5e0075de4c0205be2e8aae2064ae19
SHA256 c148292328f0aab7863af82f54f613961e7cb95b7215f7a81cafaf45bd4c42b7
SHA512 5af370884b5f82903fd93b566791a22e5b0cded7f743e6524880ea0c41ee73037b71df0be9f07d3224c733b076bec3be756e7e77f9e7ed5c2dd9505f35b0e4f5

C:\Users\Admin\AppData\Local\Temp\_MEI35922\_socket.pyd

MD5 b77017baa2004833ef3847a3a3141280
SHA1 39666f74bd076015b376fc81250dff89dff4b0a6
SHA256 a19e3c7c03ef1b5625790b1c9c42594909311ab6df540fbf43c6aa93300ab166
SHA512 6b24d0e038c433b995bd05de7c8fe7dd7b0a11152937c189b8854c95780b0220a9435de0db7ac796a7de11a59c61d56b1aef9a8dbaba62d02325122ceb8b003d

C:\Users\Admin\AppData\Local\Temp\_MEI35922\_bz2.pyd

MD5 aa1083bde6d21cabfc630a18f51b1926
SHA1 e40e61dba19301817a48fd66ceeaade79a934389
SHA256 00b8ca9a338d2b47285c9e56d6d893db2a999b47216756f18439997fb80a56e3
SHA512 2df0d07065170fee50e0cd6208b0cc7baa3a295813f4ad02bec5315aa2a14b7345da4cdf7cac893da2c7fc21b201062271f655a85ceb51940f0acb99bb6a1d4c

C:\Users\Admin\AppData\Local\Temp\_MEI35922\select.pyd

MD5 e4ab524f78a4cf31099b43b35d2faec3
SHA1 a9702669ef49b3a043ca5550383826d075167291
SHA256 bae0974390945520eb99ab32486c6a964691f8f4a028ac408d98fa8fb0db7d90
SHA512 5fccfb3523c87ad5ab2cde4b9c104649c613388bc35b6561517ae573d3324f9191dd53c0f118b9808ba2907440cbc92aecfc77d0512ef81534e970118294cdee

C:\Users\Admin\AppData\Local\Temp\_MEI35922\_lzma.pyd

MD5 b86b9f292af12006187ebe6c606a377d
SHA1 604224e12514c21ab6db4c285365b0996c7f2139
SHA256 f5e01b516c2c23035f7703e23569dec26c5616c05a929b2580ae474a5c6722c5
SHA512 d4e97f554d57048b488bf6515c35fddadeb9d101133ee27a449381ebe75ac3556930b05e218473eba5254f3c441436e12f3d0166fb1b1e3cd7b0946d5efab312

C:\Users\Admin\AppData\Local\Temp\_MEI35922\_hashlib.pyd

MD5 b4ff25b1aca23d48897fc616e102e9b6
SHA1 8295ee478191eb5f741a5f6a3f4ab4576ceec8d2
SHA256 87dd0c858620287454fd6d31d52b6a48eddbb2a08e09e8b2d9fdb0b92200d766
SHA512 a7adcf652bc88f8878dae2742a37af75599936d80223e62fe74755d6bafaafd985678595872fb696c715f69a1f963f12e3d52cd3d7e7a83747983b2ee244e8a2

C:\Users\Admin\AppData\Local\Temp\_MEI35922\_decimal.pyd

MD5 c88282908ba54510eda3887c488198eb
SHA1 94ed1b44f99642b689f5f3824d2e490252936899
SHA256 980a63f2b39cf16910f44384398e25f24482346a482addb00de42555b17d4278
SHA512 312b081a90a275465787a539e48412d07f1a4c32bab0f3aa024e6e3fe534ac9c07595238d51dc4d6f13c8d03c2441f788dff9fe3d7ca2aad3940609501d273bd

C:\Users\Admin\AppData\Local\Temp\_MEI35922\VCRUNTIME140_1.dll

MD5 f8dfa78045620cf8a732e67d1b1eb53d
SHA1 ff9a604d8c99405bfdbbf4295825d3fcbc792704
SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
SHA512 ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371

C:\Users\Admin\AppData\Local\Temp\_MEI35922\unicodedata.pyd

MD5 fd9132f966ee6d214e0076bf0492fb30
SHA1 89b95957f002bf382435d015e26962a42032cb97
SHA256 37c68617fa02a2cadced17ef724e2d450ef12a8a37215da789a4679fde1c5c02
SHA512 e35729abc45e5561aae1fb9e0e7c711dd7d3c1491520aa5c44fcc50c955f549f81d90897959327e930d02a5356afe08d6195adf002c87801a7a11235670639b5

C:\Users\Admin\AppData\Local\Temp\_MEI35922\libcrypto-3.dll

MD5 e547cf6d296a88f5b1c352c116df7c0c
SHA1 cafa14e0367f7c13ad140fd556f10f320a039783
SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
SHA512 9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d

C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-crt-utility-l1-1-0.dll

MD5 57d3ee548db3a503ac391af798e0e2a2
SHA1 d686a96c5046d6d7a022c4266a5d0014745360a4
SHA256 2c80280e51c242466e10a36a0bf2a341607983b6f6648f93b0718b34ab5285c5
SHA512 f3ea9c8f2f230d23bc878e37044599b2c77f0bf6dd84b07c2f87a84263fb9ac7f44732f05e14781b6046afb2a39f27135c96d2da2ab9605bd00e55d9b0fffb0b

C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-crt-time-l1-1-0.dll

MD5 816a8932759bdb478d4263cacbf972e3
SHA1 ac9f2bed41e340313501aa7d33dcd369748f0496
SHA256 ce9a8e18923d12e2f62ce2a20693113000fc361cc816773037c155c273b99e7c
SHA512 5144f01bee04455d5b9a7b07e62f4afb928605331213eb483265016640198c175dc08673903ed5bc16b385ee76657aa4303776233d04347d9d1daadce39525c4

C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-crt-string-l1-1-0.dll

MD5 f9297b9ff06295bc07b7e5281b1face0
SHA1 d0eb0fddbb3eb187df0f0e5f9ddffcfc2e05f9b7
SHA256 c56a2ee0cc6dc1e7283b9bda8b7b2dba957329cb4bc9aca4cd99f88e108f9c04
SHA512 bec6222776015996eba744698d3254945dfe4bb4dc0d85528ee59a0f3b5fc5bb054bbf496d562cfc7b4cc81b4d3df5c53761931162a0091a49386233afba4f9c

C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-crt-stdio-l1-1-0.dll

MD5 8341f0371e25b8077fe61c89a9ef8144
SHA1 fc185203e33abed12e1398440cb2ee283ca9541a
SHA256 bd9a5d4554ef1a374257e8dd9436d89f686006ed1fd1cc44364b237bf5b795ff
SHA512 9c7e4e8d8e9e620f441ab5106820ec021d2b2323f44ed8cc8ec9673745dbc531347356f1ff195d63b62b09cc5c27e8f8641ce25be12ee9b700b5fc766337228b

C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-crt-runtime-l1-1-0.dll

MD5 364bc49cc7034f8a9981ade1ce565229
SHA1 fbd76c1842d1ccf563ece2db32fff4c71e7ca689
SHA256 6254fd07ace88685112e3a7b73676aabf13a1b1bc30c55dd976b34fea12b7f1d
SHA512 65e59e3358eb1bf26823c9538c74d343e7383591c021d2b340ef68aa9a274d65b15b30bbbe55f4b32e3a08fc79d4e179a6ce92eadb8c4be09a2c35c348ce10af

C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-crt-process-l1-1-0.dll

MD5 e3914d51afd864a6c6587aa9192c491b
SHA1 bae85701809bc259a8744aafa45cd7159e6c13f8
SHA256 28257cc063431f78284335ce3002ffb71b75c1e7ccabf5417bb42392c35564b4
SHA512 43b1445a80d309ec73d52d6cf68f4533a132fb55ab672e5e2a878bb42c1cb36d6e4c504d43fa4923e692c8be600f3f9d5a5edde80602636cb726eedfca23dfb8

C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-crt-math-l1-1-0.dll

MD5 a592d1b2ecc42d1a083f0d34feae2444
SHA1 29718af390f832626fcdcc57c107333cdb5743e1
SHA256 18a827b01de7b1a3d5c8d17b79ad2462a90308124448a9b8c47eccda39c3a095
SHA512 44bed6d24f1fa35b10d2b2b1574e7baf10182e60fdcb6cba5dd9de5cd7a5183198925e4fa5a7e2896564a30f7b70de69691713118d59bf5162ce35aff5bcf7a6

C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-crt-locale-l1-1-0.dll

MD5 75f1a5f65790560d9544f3fb70efba51
SHA1 f30a5751901cfffc250be76e13a8b711ebc06bcc
SHA256 e0e02ea6c17da186e25e352b78c80b1b3511b5c1590e5ba647b14a7b384af0f8
SHA512 b7e285ca35f6a8ae2ccbe21594d72152175301a02ad6b92fe130e1e226a0faad1bfad1bd49857401549c09b50feee2c42c23ca4c19b2845cad090f5b9e8e8f63

C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-crt-heap-l1-1-0.dll

MD5 4b038cdc70357d2dec440717ac344a52
SHA1 f67ba87f6830858845a5763381a47893af061bf8
SHA256 6a24e9cfb0efd9e1b90053d4ebd87fc35144e61ae3f6555c7d400542d648e2b5
SHA512 9557f15fa3c06de89ea8be0c959b94575a1c4587151687730f9e66fed095feb882d43ea32262000f871e6d860ce0c6c341cf5509a6ce81866f6d0efacb8526fe

C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-crt-filesystem-l1-1-0.dll

MD5 102a8c01049ef18cc6e8798a9e5d57f4
SHA1 9adef547e03032d8c5525cc9c7d4512fbeb53948
SHA256 e13edab280e7b3410d7f4ce30a8e8cae64f38652d770fc3bf223206f0c57aaa5
SHA512 a9fbc726f33399f55f70967f3f1bf374589eaad9581d9e94228d39afa06cdce31ed25bdc04805aad361c7cafbeb56ca39f6693259d67457199d4423a61b32263

C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-crt-environment-l1-1-0.dll

MD5 e41612752a7dfbbe756322cf48e106b9
SHA1 0ec106e926c9837a43e1d7ec8d1a5f03edd5ec3d
SHA256 4bb9d36e0e034652f2331ddb43ee061608f436cbc9e5771b4d27b28fa10f5248
SHA512 9bed9399e896d1cc58cc06e8d7ec6cc3345be6d15ca307c670e0f282c9ebe48a6cc1b145c2ecf94d84214cddff8f0d0d720ea984478c74c98e2499c2184638c9

C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-crt-convert-l1-1-0.dll

MD5 87e2934e49d7d111f383673f97d5029e
SHA1 267603d5510b775de3667f7d92bfaa3bd60e6533
SHA256 fb9dd774b25ab8e661c922caffb976c37a4d10a631ab65665da60016ef0c4d7c
SHA512 e6025ad419359ad3e06cc7a3b3b7436464dbbc71b91653833575264a5f8b0d781844a411bcd915d404b9a8c0a056eaf6d4d412723936845b53bfb5368bf5f7a7

C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-crt-conio-l1-1-0.dll

MD5 9eb2c06decaae1a109a94886a26eec25
SHA1 307ce096bee44f54a6d37aab1ef123fb423ed028
SHA256 da8fd2fe08a531d2331c1fbee9f4ae9015b64f24a2654a7f82418c86b4ab6909
SHA512 7e701cb00a4cab8d5b3ecf55a16fef0103f9be1aa3fd7b53c7bab968708c21e8d1c763ad80a7a8d6c76dd45ddd244c9c9e8944455c2025b4195660b61ac1e8b7

C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-util-l1-1-0.dll

MD5 f7fdc91ac711a9bb3391901957a25cea
SHA1 1cebc5497e15051249c951677b5b550a1770c24f
SHA256 de47c1f924dc12e41d3a123b7dcce0260e7758b90fb95ec95c270fc116fc7599
SHA512 0e03c998622d6bf113e8d3b4dab728974391efecf59df89f938bd22240488e71885c05fb0fa805948b3d9645758409a0966299b26625aa36e3fd6e519ee22769

C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-timezone-l1-1-0.dll

MD5 b9a20c9223d3e3d3a0c359f001ce1046
SHA1 9710b9a8c393ba00c254cf693c7c37990c447cc8
SHA256 00d9a7353be0a54c17e4862b86196a8b2bc6a007899fa2fbe61afd9765548068
SHA512 a7d5611c0b3b53da6cac61e0374d54d27e6e8a1af90ef66cd7e1b052f906c8b3f6087f4c6de0db3ae0b099df7689ecde6c815a954b728d36d9d3b5d002ccf18e

C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-sysinfo-l1-1-0.dll

MD5 e4893842d031b98cac1c6f754a2a3f8d
SHA1 2b0187134e40d27553a85dd4ec89dd6c40e58a24
SHA256 abe4c1464b325365d38e0bc4ae729a17a7f6f7ba482935c66e6840e1b0d126c5
SHA512 fc61a66fdc7213857f204bd0b20671db7092e0010e07b5e0e8e8408ace8ac5b6e696a7d9fc969233b2b3ad5dae4d3b291b007ff27a316e7fb750bfc93257c532

C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-synch-l1-2-0.dll

MD5 b962237df7ea045c325e7f97938097cb
SHA1 1115e0e13ecc177d057e3d1c9644ac4d108f780a
SHA256 a24dd6afdb4c4aa450ae4bc6a2861a49032170661b9c1f30cd0460c5dc57e0f7
SHA512 19ac4cccaaa59fbae042d03ba52d89f309bd2591b035f3ec3df430ff399d650fcf9c4d897834a520dea60dc0562a8a6f7d25a1fffcd32f765a4eaffe4c7d5ea2

C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-synch-l1-1-0.dll

MD5 bccc676f2fb18c1a1864363e5a649a88
SHA1 a095a83a32a4a65fe16aa0be9a517239fac5db0d
SHA256 9d3f803dc791d2ff2e05059f9bb9207cc8f4134e1ac05f20edd20cfadd6e72c0
SHA512 55aab9fa6f7c4904e4beea4ce250f45fb71c2dd6a6f099f4017101ebc45c0a6e303b6a222f49c971992cafe8988a042b7ef8e94671be858c926105021514737a

C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-string-l1-1-0.dll

MD5 b65933f7bcadc7072d5a2d70ecba9f81
SHA1 c53561755b9f33d0ae7874b3a7d67bedcb0129d8
SHA256 eadf535795df58d4f52fc6237fe46feb0f8166daca5eaaa59cec3cee50a9181d
SHA512 4cbb8bda8609404fe84ca36a8cbfe1d69c55dee2b969231b2fa00ca9139d956196a2babbb80a1a2bb430a34e6bd335294f452bcbe9e44411561ebdf21e4aba91

C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-rtlsupport-l1-1-0.dll

MD5 0b30c6862b5224cc429fe2eb2b7bf14b
SHA1 5c3affa14e3bfdafe09e9841a2920b57c7fcbc56
SHA256 d9c6f93c4972db08c7888d55e8e59e8aba022d416817d65bc96e5a258c859b5f
SHA512 b378f2a2812245ea948d81a925d041dbd7e7a8fb2770cf7dd47643da20f5c685c6121479f95b293177a9480290b17c49e7b4fc10d33734cf883d2c614daae1bf

C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-profile-l1-1-0.dll

MD5 1be729c6d9bf1b58f435b23e7f87ba49
SHA1 4b2df3fab46a362ee46057c344995fa622e0672a
SHA256 4c425fbb8d2319d838733ab9cec63a576639192d993909e70cf84f49c107f785
SHA512 ceccc5ff2bd90a91cfbb948f979576795ff0a9503ddaafd268c14306f93d887975bd376b62ed688be51bb88b3a0c54ef332be93b4b0d8737b5ab70a661b11416

C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-processthreads-l1-1-1.dll

MD5 774aa9f9318880cb4ad3bf6f464da556
SHA1 3a5c07cf35009c98eb033e1cbde1900135d1abf8
SHA256 ba9fbd3a21879614c050c86a74ad2fffc0362266d6fa7be0ef359de393136346
SHA512 f7b57afb9810e3390d27a5469572fb29f0f1726f599403a180e685466237dff5dec4fdce40105ef1bb057e012d546308213e7cec73e0d7d3c5815eec8189a75d

C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-processthreads-l1-1-0.dll

MD5 73586decad3b3d90653750504b356a5c
SHA1 39a7ee1660ca1291314ef78150e397b1d8683e03
SHA256 34f560c3e56f40db5df695c967b6e302e961085bc037bb9a1c2d2c866a9df48f
SHA512 9ec299e930d2b89ad379613f8fa63669ec7c858da8a24608b92175f42b0be75f8aa2e1727dabf7638ae9d2942d03840f288eab53f2c9f38dbea1325f1ea8b22b

C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-processenvironment-l1-1-0.dll

MD5 4f1303827a67760d02feb54e9258edb1
SHA1 340d7029c39708d14da79b12a0e2ed0a8bc7c020
SHA256 77fc9adf1a734d9717700b038b98b4337a494fc4f7e1e706c82e97dbca896fd8
SHA512 20f067d1c2749c709e4fc45da8d9eb5b813f54d0e09fa482d00bc4a7e5744c587d0afc00cdd5263b4223fe94baa3f8ca110d010339f9e3f1c6b2700888dbe3d0

C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-localization-l1-2-0.dll

MD5 3589557535bba7641da3d76eefb0c73d
SHA1 6f63107c2212300c7cd1573059c08b43e5bd9b95
SHA256 642b01bb93d2cb529acf56070d65aae3202fd0b48d19fd40ec6763b627bcbee6
SHA512 7aedf3cf686b416f8b419f8af1d57675096ab2c2378c5a006f6ecbf2fe1ad701f28b7be8f08c9083230cf4d15d463371e92a6032178cd6c139d60b26fbd49b06

C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-libraryloader-l1-1-0.dll

MD5 d042aa497ce2a9f03296f8de68ed0680
SHA1 f483a343a18b960630ccf0e6de2f82883550f3bf
SHA256 de3d2c5519f74a982f06f3f3fda085571c0cdcf5ad8d2d331c79d9c92062bdc3
SHA512 4e157c8701860982ce0dec956fe4bfb684d2db3eaa9e784f179d385be905fd0551ba90cc27c54179fc39a693d9c742364f2bf1a5444424ba5eae38103b5f0e02

C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-interlocked-l1-1-0.dll

MD5 5872cb5ca3980697283aab9007196ae6
SHA1 26e8de47d9bee371f6c7a47f206a131965b6b481
SHA256 0dff50774693fcb71782b5e214419032a8c00b3031151d93be5c971b6f62cd45
SHA512 9b3e2fa9f66d29bfc7a4ca5d673b395bcda223a85fd06c94a11217047c1a312148c9c6270d7f69dfef06b25f8b5ad46717a829bde55f540c804a4ba4c4af070c

C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-heap-l1-1-0.dll

MD5 a8b967b65232ecce7261eaecf39e7d6d
SHA1 df0792b29c19d46a93291c88a497151a0ba4366d
SHA256 8fcc9a97a8ad3be9a8d0ce6bb502284dd145ebbe587b42cdeaa4262279517c1d
SHA512 b8116208eb646ec1c103f78c768c848eb9d8d7202ebdab4acb58686e6f0706f0d6aaa884e11065d7ece63ebbd452f35b1422bd79e6eb2405fb1892758195ccbb

C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-handle-l1-1-0.dll

MD5 567ff20a8d330cbb3278d3360c8d56f5
SHA1 cdf0cfc650da3a1b57dc3ef982a317d37ffb974d
SHA256 47dfbe1ecc8abc002bd52dcd5281ed7378d457789be4cb1e9bee369150d7f5c8
SHA512 1643e900f13509f0ef9c7b7f8f2401fb3b6f2c0c39b512c623615df92b1e69df042ef1a0c6aace82173ce5d4d3c672c1636d6ee05545ce5c3b7374ab745e0e87

C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-file-l2-1-0.dll

MD5 bfffa7117fd9b1622c66d949bac3f1d7
SHA1 402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2
SHA256 1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e
SHA512 b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-file-l1-2-0.dll

MD5 2b36752a5157359da1c0e646ee9bec45
SHA1 708aeb7e945c9c709109cea359cb31bd7ac64889
SHA256 3e3eb284937b572d1d70ce27be77b5e02eb73704c8b50feb5eb933db1facd2fc
SHA512 fc56080362506e3f38f1b3eb9d3193cdb9e576613c2e672f0fe9df203862f8a0f31938fa48b4ff7115dfe6016fa1fd5c5422fdc1913df63b3fde5f478a8417a1

C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-file-l1-1-0.dll

MD5 abf9850eb219be4976a94144a9eba057
SHA1 3d8c37588b36296240934b2f63a1b135a52fcee2
SHA256 41c5c577fea3ce13d5beb64ce0920f1061f65bcf39eafa8cd3dfc09ff48bcf76
SHA512 dfaafb43ce7f05b2db35eac10b314fb506c6aada80f6c4327b09ec33c170478ebd0eea19f1c6ca2e4832bfa41f769046deca8f15d54b7966134d166ee6036bda

C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-errorhandling-l1-1-0.dll

MD5 98340ffd2b1d8affef27d4b1260aeac5
SHA1 b428b39aa814a7038a1ddff9b64b935f51833a26
SHA256 7388a019922e9a0a3d05a8605a5307e3141b39f7d57b7faca5d34e72adfd5fa5
SHA512 6165c5be0360d55403e9dfd4e9df4ff9a12e5fb6057ed9278da09e688751487e46d9dd64949375c00764cbb4355cc13a1ea714055050f2ab7d432977b8443f81

C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-debug-l1-1-0.dll

MD5 a00ebd3cf88d668be6d62a25fa4fb525
SHA1 edb07eafd08991611389293e2be80f8ee98f1e62
SHA256 b44646453584305d4edf8ab5f5d1adea6b9650bd2b75f8486fc275be52b86433
SHA512 d63f0e9f2e079ee06aa3ab96a0bd2d169564896027b731ee2597327bdc55456c5fd0c2d8c7e68165fc80bbc3fe0c24a3388d4c3615f33fc9f9fc0b205ae9ba7a

C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-datetime-l1-1-0.dll

MD5 3095c9577395249e105410bdcc585f77
SHA1 7dfc0c81f8f28cbf36c5acdb83523569b430b944
SHA256 c08be448195f46c4b423d0ce0c2cdc343e842ff1f91b16a8d3c09d5152150917
SHA512 555568fc23ade238bcc13a447520d395546def4409a002d795dd3abea03b15321491bc63c97f4ed8eb78aa411a0b1267dce5c528e51dcac8ca9e93b8f5265786

C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-console-l1-1-0.dll

MD5 a148dc22ea14cd5578de22b2dfb0917f
SHA1 eaccb66f62e5b6d7154798e596eabd3cef00b982
SHA256 7603e172853a9711fbdc53b080432ad12984b463768dbc3aa842a26f5b26ae23
SHA512 4e3c927692fc41889b596273aea8bbd776cf7644dae26c411c12bda23cd3299a5c9adc06a930294310f002de74592a244767378fc9e37ec76e86bfa23f4c0478

C:\Users\Admin\AppData\Local\Temp\_MEI35922\libffi-8.dll

MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-namedpipe-l1-1-0.dll

MD5 d1bc9b3a7aa94d10c41fa16210aa9dba
SHA1 a358b824b1f26ead420d2100e5f1a3fb74af2b7a
SHA256 75652caf05e86adc88ed214fd208b4a289489cac2b28fd358e302e2e7c3c338f
SHA512 149478dfca0165d5a68e89070017cda3400926284eaa2143a810138ff710079cde413c031721de5b58cb834f03d4c5df5b4bd6c2bdb65687755ad77cae778b30

C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-memory-l1-1-0.dll

MD5 064fb2e1b5e90796a68d1edf91269ad3
SHA1 6e3a8c568f038879b7b102975a4471b2489f5493
SHA256 3500935e638f7d0ae2bf564bf77f9329811329261185fcdb9cd702b999889ffd
SHA512 821f091529d45531811a73664473cebb372a310d855e1a4c1a028ad4dc7d36146d3030dcf10de8a4a4bf16fb535fe3d0d2e1fcd22959690842388abb177b0036

C:\Users\Admin\AppData\Local\Temp\_MEI35922\python3.dll

MD5 7e07c63636a01df77cd31cfca9a5c745
SHA1 593765bc1729fdca66dd45bbb6ea9fcd882f42a6
SHA256 db84bc052cfb121fe4db36242ba5f1d2c031b600ef5d8d752cf25b7c02b6bac6
SHA512 8c538625be972481c495c7271398993cfe188e2f0a71d38fb51eb18b62467205fe3944def156d0ff09a145670af375d2fc974c6b18313fa275ce6b420decc729

C:\Users\Admin\AppData\Local\Temp\_MEI35922\base_library.zip

MD5 4b011f052728ae5007f9ec4e97a4f625
SHA1 9d940561f08104618ec9e901a9cd0cd13e8b355d
SHA256 c88cd8549debc046a980b0be3bf27956ae72dcdcf1a448e55892194752c570e6
SHA512 be405d80d78a188a563086809c372c44bcd1ccab5a472d50714f559559795a1df49437c1712e15eb0403917c7f6cfaf872d6bb0c8e4dd67a512c2c4a5ae93055

Analysis: behavioral3

Detonation Overview

Submitted

2024-05-25 22:45

Reported

2024-05-25 22:47

Platform

win7-20240220-en

Max time kernel

103s

Max time network

16s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\troll.pyc

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.pyc\ = "pyc_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.pyc C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\shell C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\troll.pyc

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\troll.pyc

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\troll.pyc"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 a429dfd97046a4c8c78914eab4a0df04
SHA1 8ac388cf0fd1fdc60e98be588e3426cb24b5ed54
SHA256 b575d43416db77cacbb35f60e4ad599b84e47b09c0d962bf48a6180fed819e1c
SHA512 e9cb220d221dcb7f81a5937391ef949fa2f2674fb3f7b819ff5704512f047f4ea6dcf5ea843e65acde8d28e6cf45a25473db47c5d0ed312ee76450d24bc309bf

Analysis: behavioral4

Detonation Overview

Submitted

2024-05-25 22:45

Reported

2024-05-25 22:48

Platform

win10v2004-20240426-en

Max time kernel

148s

Max time network

152s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\troll.pyc

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\troll.pyc

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 98.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 145.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 136.71.105.51.in-addr.arpa udp

Files

N/A