039004b76a1bc5ac020958256bdcf97f1464398c13b0be2e0d0078f1aee8b3a7

Analysis

max time kernel
126s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-11-2024 13:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lonelyscreen-win-installer.exe
Size

538KB
MD5

64da00119c76c6e1d75f059ffc4a772d
SHA1

ebaebff7db60430cad107d4efc45654d43f98075
SHA256

039004b76a1bc5ac020958256bdcf97f1464398c13b0be2e0d0078f1aee8b3a7
SHA512

d13544aa2ee6060510c0f906e3f174a4ec40878f36193a99d6c527b62fa6a379115e965e272069b0e3f0479df16e6899a096ede37fb0832262c72d3d24f824f3
SSDEEP

12288:AS3yBV888888888888W88888888888pKfXGU69eTutORzK/AA9i6Zub02O9HtFbl:/3yLKfXG6wZ/D9kqtZaTq

Score

10^/10

discovery evasion persistence privilege_escalation

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules	mDNSResponder.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 6 IoCs

pid	Process
2308	lonelyscreen-win-installer.tmp
1528	setup.exe
2212	setup.tmp
108	Process not Found
2752	mDNSResponder.exe
2188	lonelyscreen.exe

Loads dropped DLL 24 IoCs

pid	Process
2892	lonelyscreen-win-installer.exe
2308	lonelyscreen-win-installer.tmp
2308	lonelyscreen-win-installer.tmp
2308	lonelyscreen-win-installer.tmp
2308	lonelyscreen-win-installer.tmp
1528	setup.exe
2212	setup.tmp
2212	setup.tmp
2212	setup.tmp
2212	setup.tmp
2212	setup.tmp
2280	MsiExec.exe
2280	MsiExec.exe
2280	MsiExec.exe
1268	MsiExec.exe
1268	MsiExec.exe
2056	MsiExec.exe
2580	MsiExec.exe
2312	MsiExec.exe
476	Process not Found
2308	lonelyscreen-win-installer.tmp
2188	lonelyscreen.exe
2308	lonelyscreen-win-installer.tmp
2972	iexplore.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\LonelyScreen = "C:\\Program Files (x86)\\LonelyScreen\\lonelyscreen.exe /start_context sys_auto"	setup.tmp

Blocklisted process makes network request 4 IoCs

flow	pid	Process
17	3020	msiexec.exe
19	3020	msiexec.exe
29	3020	msiexec.exe
31	3020	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dns-sd.exe	msiexec.exe
File created	C:\Windows\system32\dns-sd.exe	msiexec.exe
File created	C:\Windows\SysWOW64\dnssd.dll	msiexec.exe
File created	C:\Windows\system32\dnssd.dll	msiexec.exe
File created	C:\Windows\SysWOW64\dnssdX.dll	msiexec.exe
File created	C:\Windows\system32\dnssdX.dll	msiexec.exe
File created	C:\Windows\SysWOW64\jdns_sd.dll	msiexec.exe
File created	C:\Windows\system32\jdns_sd.dll	msiexec.exe

Drops file in Program Files directory 37 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\ja.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\nl.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files (x86)\Bonjour\mDNSResponder.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\LonelyScreen\unins001.dat	lonelyscreen-win-installer.tmp
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\de.lproj\About Bonjour.rtf	msiexec.exe
File opened for modification	C:\Program Files (x86)\LonelyScreen\unins000.dat	setup.tmp
File opened for modification	C:\Program Files\Java\jre7\lib\ext\dns_sd.jar	msiexec.exe
File created	C:\Program Files (x86)\LonelyScreen\is-A8TGP.tmp	lonelyscreen-win-installer.tmp
File created	C:\Program Files (x86)\LonelyScreen\unins000.dat	setup.tmp
File created	C:\Program Files\Bonjour\dns_sd.jar	msiexec.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\ko.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files (x86)\LonelyScreen\is-BC3RP.tmp	setup.tmp
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\fi.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\fr.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\sv.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files (x86)\Bonjour\dns_sd.jar	msiexec.exe
File created	C:\Program Files\Bonjour\About Bonjour.lnk	msiexec.exe
File opened for modification	C:\Program Files (x86)\LonelyScreen\LonelyScreen.exe	setup.tmp
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\ru.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files\Bonjour\mdnsNSP.dll	msiexec.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\pl.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files (x86)\Bonjour\About Bonjour.lnk	msiexec.exe
File created	C:\Program Files (x86)\LonelyScreen\unins001.dat	lonelyscreen-win-installer.tmp
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\nb.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files\Bonjour\mDNSResponder.exe	msiexec.exe
File created	C:\Program Files\Java\jre7\lib\ext\dns_sd.jar	msiexec.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\en_GB.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\da.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\en.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\es.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\it.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\pt.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\pt_PT.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\zh_CN.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files (x86)\LonelyScreen\is-D0A8T.tmp	setup.tmp
File created	C:\Program Files (x86)\Bonjour\mdnsNSP.dll	msiexec.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\zh_TW.lproj\About Bonjour.rtf	msiexec.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\f76eb49.msi	msiexec.exe
File created	C:\Windows\Installer\f76eb4c.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF0E0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF0F1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEEEB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEF4A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF16F.tmp	msiexec.exe
File created	C:\Windows\Installer\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}\RichText.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\f76eb4c.ipi	msiexec.exe
File created	C:\Windows\Installer\f76eb49.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF1FC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF411.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}\Bonjour.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}\Bonjour.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}\RichText.ico	msiexec.exe
File created	C:\Windows\Installer\f76eb4f.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
604	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lonelyscreen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lonelyscreen-win-installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lonelyscreen-win-installer.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf600000000020000000000106600000001000020000000f247b9905363bd6ad7268c2a0e093142c0381534410802e8b58935e279916128000000000e8000000002000020000000f4d5e36fda957f78193c4d9c89dde786de8cb3472aed94cbc682433a45d319b190000000461e1f6b196e991a3c7f9f9a95cc2fe2f9173cd978de8655ee8778a2f05b8f178e21a926ae1bd54e5ff28e13c561a49f594bc64d93fe7df303213ede6b141158867d77058a1e2da0af33e33901e7ea40a6b3135a68e624b7e2d22610e8b955096cfabd382f0b7d14c659d315370e230538688d72684de8249092e53c2b4789580d64d469450949979129ba90a09d529340000000de77b510919369a7d8e6b11e4be39bf66f4ec33feda9ea3ff6e5bc2f000ea85988c83db34dc3d8e076eadfea3766ddf4d637cd6b98083e5aa13d5afa828ab31d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DOMStorage\lonelyscreen.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DOMStorage\lonelyscreen.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9A3854A1-A678-11EF-8318-F2DF7204BD4F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "438184106"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf600000000020000000000106600000001000020000000634eae7aa0f6ed5a99159f931a2e550977fbfcaac9f2c8fa421148c90ba322d6000000000e800000000200002000000019be7de3b2c1885975b56b7d189bd5fe97cf72cf3cf92dbc3e85ea056805247d20000000d1f87c1ff85ee4dc4a737f1cd60834c6626582d7c099b30a5cb7c7519c02b45e400000003c7d1cc6ec5a8680f397cc5f82300c39b5c44e331365d7720ad0ecbe51c6b0af684fd9f75c57c43e844b13dfc9a3356376a9cd01b3d4a9db5814b50979f181fe	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40ca4171853adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\VersionIndependentProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\Programmable	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Bonjour.DNSSDService.1\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Bonjour.DNSSDService.1\CLSID\ = "{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Bonjour.TXTRecord\CLSID\ = "{AFEE063C-05BA-4248-A26E-168477F49734}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Bonjour.TXTRecord.1\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Bonjour.DNSSDEventManager\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\NumMethods\ = "7"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Bonjour.DNSSDEventManager\ = "DNSSDEventManager Class"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\Programmable	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Bonjour.DNSSDService	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\VersionIndependentProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\ = "IDNSSDEventManager"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{21AE8D7F-D5FE-45CF-B632-CFA2C2C6B498}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\AppID = "{56608F9C-223B-4CB6-813D-85EDCCADFB4B}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B0163E6D0340BE4183EB2758E9BEDD8\ProductName = "Bonjour"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7FD72324-63E1-45AD-B337-4D525BD98DAD}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18FBED6D-F2B7-4EC8-A4A4-46282E635308}\1.0\0	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{7FD72324-63E1-45AD-B337-4D525BD98DAD}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\Programmable	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Bonjour.DNSSDEventManager\CurVer\ = "Bonjour.DNSSDEventManager.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{9CE603A0-3365-4DA0-86D1-3F780ECBA110}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9CE603A0-3365-4DA0-86D1-3F780ECBA110}\TypeLib\ = "{18FBED6D-F2B7-4EC8-A4A4-46282E635308}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Bonjour.DNSSDRecord.1\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Bonjour.TXTRecord\ = "TXTRecord Class"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{9CE603A0-3365-4DA0-86D1-3F780ECBA110}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{18FBED6D-F2B7-4EC8-A4A4-46282E635308}\1.0\HELPDIR	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8FA0889C-5973-4FC9-970B-EC15C925D0CE}\NumMethods\ = "14"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Bonjour.DNSSDEventManager.1\ = "DNSSDEventManager Class"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID\{56608F9C-223B-4CB6-813D-85EDCCADFB4B}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{21AE8D7F-D5FE-45CF-B632-CFA2C2C6B498}\TypeLib\Version = "1.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8FA0889C-5973-4FC9-970B-EC15C925D0CE}\NumMethods\ = "14"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\VersionIndependentProgID\ = "Bonjour.TXTRecord"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{21AE8D7F-D5FE-45CF-B632-CFA2C2C6B498}\TypeLib\ = "{18FBED6D-F2B7-4EC8-A4A4-46282E635308}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18FBED6D-F2B7-4EC8-A4A4-46282E635308}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Bonjour\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\TypeLib\ = "{18FBED6D-F2B7-4EC8-A4A4-46282E635308}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{18FBED6D-F2B7-4EC8-A4A4-46282E635308}\1.0\0\win64	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B0163E6D0340BE4183EB2758E9BEDD8\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2B0163E6D0340BE4183EB2758E9BEDD8\Bonjour	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B0163E6D0340BE4183EB2758E9BEDD8\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\VersionIndependentProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Bonjour.DNSSDEventManager	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{29DE265F-8402-474F-833A-D4653B23458F}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9CE603A0-3365-4DA0-86D1-3F780ECBA110}\TypeLib\ = "{18FBED6D-F2B7-4EC8-A4A4-46282E635308}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\ = "IDNSSDEventManager"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\InprocServer32\ = "C:\\Windows\\system32\\dnssdX.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\VersionIndependentProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\InprocServer32\ = "C:\\Windows\\SysWOW64\\dnssdX.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Bonjour.DNSSDEventManager\CLSID\ = "{BEEB932A-8D4A-4619-AEFE-A836F988B221}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{29DE265F-8402-474F-833A-D4653B23458F}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{8FA0889C-5973-4FC9-970B-EC15C925D0CE}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\TypeLib\ = "{18FBED6D-F2B7-4EC8-A4A4-46282E635308}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9CE603A0-3365-4DA0-86D1-3F780ECBA110}\TypeLib\Version = "1.0"	msiexec.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	lonelyscreen-win-installer.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	lonelyscreen-win-installer.tmp

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2212	setup.tmp
2212	setup.tmp
2308	lonelyscreen-win-installer.tmp
2308	lonelyscreen-win-installer.tmp

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	604	msiexec.exe
Token: SeIncreaseQuotaPrivilege	604	msiexec.exe
Token: SeRestorePrivilege	3020	msiexec.exe
Token: SeTakeOwnershipPrivilege	3020	msiexec.exe
Token: SeSecurityPrivilege	3020	msiexec.exe
Token: SeCreateTokenPrivilege	604	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	604	msiexec.exe
Token: SeLockMemoryPrivilege	604	msiexec.exe
Token: SeIncreaseQuotaPrivilege	604	msiexec.exe
Token: SeMachineAccountPrivilege	604	msiexec.exe
Token: SeTcbPrivilege	604	msiexec.exe
Token: SeSecurityPrivilege	604	msiexec.exe
Token: SeTakeOwnershipPrivilege	604	msiexec.exe
Token: SeLoadDriverPrivilege	604	msiexec.exe
Token: SeSystemProfilePrivilege	604	msiexec.exe
Token: SeSystemtimePrivilege	604	msiexec.exe
Token: SeProfSingleProcessPrivilege	604	msiexec.exe
Token: SeIncBasePriorityPrivilege	604	msiexec.exe
Token: SeCreatePagefilePrivilege	604	msiexec.exe
Token: SeCreatePermanentPrivilege	604	msiexec.exe
Token: SeBackupPrivilege	604	msiexec.exe
Token: SeRestorePrivilege	604	msiexec.exe
Token: SeShutdownPrivilege	604	msiexec.exe
Token: SeDebugPrivilege	604	msiexec.exe
Token: SeAuditPrivilege	604	msiexec.exe
Token: SeSystemEnvironmentPrivilege	604	msiexec.exe
Token: SeChangeNotifyPrivilege	604	msiexec.exe
Token: SeRemoteShutdownPrivilege	604	msiexec.exe
Token: SeUndockPrivilege	604	msiexec.exe
Token: SeSyncAgentPrivilege	604	msiexec.exe
Token: SeEnableDelegationPrivilege	604	msiexec.exe
Token: SeManageVolumePrivilege	604	msiexec.exe
Token: SeImpersonatePrivilege	604	msiexec.exe
Token: SeCreateGlobalPrivilege	604	msiexec.exe
Token: SeRestorePrivilege	3020	msiexec.exe
Token: SeTakeOwnershipPrivilege	3020	msiexec.exe
Token: SeRestorePrivilege	3020	msiexec.exe
Token: SeTakeOwnershipPrivilege	3020	msiexec.exe
Token: SeRestorePrivilege	3020	msiexec.exe
Token: SeTakeOwnershipPrivilege	3020	msiexec.exe
Token: SeRestorePrivilege	3020	msiexec.exe
Token: SeTakeOwnershipPrivilege	3020	msiexec.exe
Token: SeRestorePrivilege	3020	msiexec.exe
Token: SeTakeOwnershipPrivilege	3020	msiexec.exe
Token: SeRestorePrivilege	3020	msiexec.exe
Token: SeTakeOwnershipPrivilege	3020	msiexec.exe
Token: SeRestorePrivilege	3020	msiexec.exe
Token: SeTakeOwnershipPrivilege	3020	msiexec.exe
Token: SeRestorePrivilege	3020	msiexec.exe
Token: SeTakeOwnershipPrivilege	3020	msiexec.exe
Token: SeRestorePrivilege	3020	msiexec.exe
Token: SeTakeOwnershipPrivilege	3020	msiexec.exe
Token: SeRestorePrivilege	3020	msiexec.exe
Token: SeTakeOwnershipPrivilege	3020	msiexec.exe
Token: SeRestorePrivilege	3020	msiexec.exe
Token: SeTakeOwnershipPrivilege	3020	msiexec.exe
Token: SeRestorePrivilege	3020	msiexec.exe
Token: SeTakeOwnershipPrivilege	3020	msiexec.exe
Token: SeRestorePrivilege	3020	msiexec.exe
Token: SeTakeOwnershipPrivilege	3020	msiexec.exe
Token: SeRestorePrivilege	3020	msiexec.exe
Token: SeTakeOwnershipPrivilege	3020	msiexec.exe
Token: SeRestorePrivilege	3020	msiexec.exe
Token: SeTakeOwnershipPrivilege	3020	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2212	setup.tmp
2972	iexplore.exe
2308	lonelyscreen-win-installer.tmp
2188	lonelyscreen.exe
2188	lonelyscreen.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2188	lonelyscreen.exe
2188	lonelyscreen.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2972	iexplore.exe
2972	iexplore.exe
1156	IEXPLORE.EXE
1156	IEXPLORE.EXE
2188	lonelyscreen.exe
2188	lonelyscreen.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2308	2892	lonelyscreen-win-installer.exe	30
PID 2892 wrote to memory of 2308	2892	lonelyscreen-win-installer.exe	30
PID 2892 wrote to memory of 2308	2892	lonelyscreen-win-installer.exe	30
PID 2892 wrote to memory of 2308	2892	lonelyscreen-win-installer.exe	30
PID 2892 wrote to memory of 2308	2892	lonelyscreen-win-installer.exe	30
PID 2892 wrote to memory of 2308	2892	lonelyscreen-win-installer.exe	30
PID 2892 wrote to memory of 2308	2892	lonelyscreen-win-installer.exe	30
PID 2308 wrote to memory of 1528	2308	lonelyscreen-win-installer.tmp	32
PID 2308 wrote to memory of 1528	2308	lonelyscreen-win-installer.tmp	32
PID 2308 wrote to memory of 1528	2308	lonelyscreen-win-installer.tmp	32
PID 2308 wrote to memory of 1528	2308	lonelyscreen-win-installer.tmp	32
PID 2308 wrote to memory of 1528	2308	lonelyscreen-win-installer.tmp	32
PID 2308 wrote to memory of 1528	2308	lonelyscreen-win-installer.tmp	32
PID 2308 wrote to memory of 1528	2308	lonelyscreen-win-installer.tmp	32
PID 1528 wrote to memory of 2212	1528	setup.exe	33
PID 1528 wrote to memory of 2212	1528	setup.exe	33
PID 1528 wrote to memory of 2212	1528	setup.exe	33
PID 1528 wrote to memory of 2212	1528	setup.exe	33
PID 1528 wrote to memory of 2212	1528	setup.exe	33
PID 1528 wrote to memory of 2212	1528	setup.exe	33
PID 1528 wrote to memory of 2212	1528	setup.exe	33
PID 2212 wrote to memory of 2972	2212	setup.tmp	36
PID 2212 wrote to memory of 2972	2212	setup.tmp	36
PID 2212 wrote to memory of 2972	2212	setup.tmp	36
PID 2212 wrote to memory of 2972	2212	setup.tmp	36
PID 2972 wrote to memory of 1156	2972	iexplore.exe	37
PID 2972 wrote to memory of 1156	2972	iexplore.exe	37
PID 2972 wrote to memory of 1156	2972	iexplore.exe	37
PID 2972 wrote to memory of 1156	2972	iexplore.exe	37
PID 2308 wrote to memory of 604	2308	lonelyscreen-win-installer.tmp	38
PID 2308 wrote to memory of 604	2308	lonelyscreen-win-installer.tmp	38
PID 2308 wrote to memory of 604	2308	lonelyscreen-win-installer.tmp	38
PID 2308 wrote to memory of 604	2308	lonelyscreen-win-installer.tmp	38
PID 2308 wrote to memory of 604	2308	lonelyscreen-win-installer.tmp	38
PID 2308 wrote to memory of 604	2308	lonelyscreen-win-installer.tmp	38
PID 2308 wrote to memory of 604	2308	lonelyscreen-win-installer.tmp	38
PID 3020 wrote to memory of 2280	3020	msiexec.exe	40
PID 3020 wrote to memory of 2280	3020	msiexec.exe	40
PID 3020 wrote to memory of 2280	3020	msiexec.exe	40
PID 3020 wrote to memory of 2280	3020	msiexec.exe	40
PID 3020 wrote to memory of 2280	3020	msiexec.exe	40
PID 3020 wrote to memory of 1268	3020	msiexec.exe	41
PID 3020 wrote to memory of 1268	3020	msiexec.exe	41
PID 3020 wrote to memory of 1268	3020	msiexec.exe	41
PID 3020 wrote to memory of 1268	3020	msiexec.exe	41
PID 3020 wrote to memory of 1268	3020	msiexec.exe	41
PID 3020 wrote to memory of 1268	3020	msiexec.exe	41
PID 3020 wrote to memory of 1268	3020	msiexec.exe	41
PID 3020 wrote to memory of 2056	3020	msiexec.exe	43
PID 3020 wrote to memory of 2056	3020	msiexec.exe	43
PID 3020 wrote to memory of 2056	3020	msiexec.exe	43
PID 3020 wrote to memory of 2056	3020	msiexec.exe	43
PID 3020 wrote to memory of 2056	3020	msiexec.exe	43
PID 3020 wrote to memory of 2056	3020	msiexec.exe	43
PID 3020 wrote to memory of 2056	3020	msiexec.exe	43
PID 3020 wrote to memory of 2580	3020	msiexec.exe	44
PID 3020 wrote to memory of 2580	3020	msiexec.exe	44
PID 3020 wrote to memory of 2580	3020	msiexec.exe	44
PID 3020 wrote to memory of 2580	3020	msiexec.exe	44
PID 3020 wrote to memory of 2580	3020	msiexec.exe	44
PID 3020 wrote to memory of 2312	3020	msiexec.exe	45
PID 3020 wrote to memory of 2312	3020	msiexec.exe	45
PID 3020 wrote to memory of 2312	3020	msiexec.exe	45
PID 3020 wrote to memory of 2312	3020	msiexec.exe	45

C:\Users\Admin\AppData\Local\Temp\lonelyscreen-win-installer.exe
"C:\Users\Admin\AppData\Local\Temp\lonelyscreen-win-installer.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Users\Admin\AppData\Local\Temp\is-VSADO.tmp\lonelyscreen-win-installer.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-VSADO.tmp\lonelyscreen-win-installer.tmp" /SL5="$400D6,164153,114176,C:\Users\Admin\AppData\Local\Temp\lonelyscreen-win-installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Users\Admin\AppData\Local\Temp\is-6O6LP.tmp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\is-6O6LP.tmp\setup.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1528
  - - C:\Users\Admin\AppData\Local\Temp\is-9BEP5.tmp\setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-9BEP5.tmp\setup.tmp" /SL5="$5016E,7573378,114176,C:\Users\Admin\AppData\Local\Temp\is-6O6LP.tmp\setup.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2212
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" http://www.lonelyscreen.com/installed.php?version=1.2.16
        5⤵
        Loads dropped DLL
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2972
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1156
- - C:\Windows\SysWOW64\msiexec.exe
    "msiexec.exe" /qn /i C:\Users\Admin\AppData\Local\Temp\is-6O6LP.tmp\bonjour.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:604
- - C:\Program Files (x86)\LonelyScreen\lonelyscreen.exe
    "C:\Program Files (x86)\LonelyScreen\lonelyscreen.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:2188

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding C7C0D08671C0172457054EE1DFF4279D
  2⤵
  - Loads dropped DLL
  PID:2280
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A5156E27430F49B2BAD74BA8DFDC9F8E
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1268
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DCCEB7594E3CCD321E03458CA35EC2DD M Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2056
- C:\Windows\system32\MsiExec.exe
  "C:\Windows\system32\MsiExec.exe" /Y "C:\Program Files\Bonjour\mdnsNSP.dll"
  2⤵
  - Loads dropped DLL
  PID:2580
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Bonjour\mdnsNSP.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2312

C:\Program Files\Bonjour\mDNSResponder.exe
"C:\Program Files\Bonjour\mDNSResponder.exe"
1⤵
- Modifies firewall policy service
- Executes dropped EXE
PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f76eb4d.rbs

Filesize
118KB

MD5
ed9fae517e706d6572b69543994c9718

SHA1
b010d58b4132357044b6acfcd86b615e6a484a07

SHA256
908448720982124c8b9ccd2b09d49d09f6c19d148787bf5c6c5370ff5f2fb2b7

SHA512
bbebbdf109009094a8f2abc98c52cc8f6ce3b97715ae0ff6fcf610fb767c1d486df769cd0f77d7c6e360d622c702511945290b82ebe564b6f54c285cb3af81f2

Download Submit
C:\Program Files (x86)\Bonjour\mdnsNSP.dll

Filesize
118KB

MD5
40947436a70e0034e41123df5a0a7702

SHA1
6c27e1dd1c1533feb6435190a5074300ac2a9822

SHA256
5d40fd92da5ca59c1badb58ad509db6a6d613f18660a9a270a53eca85d34c3a9

SHA512
ba5634cc82f306245f9f0350bfa0b91e2f5ffc6c355b1452a95483f47e6acdb42c4e063f6c15115faf0f0630005df4fe8ef0e01539c270031cbd07a34a929704

Download Submit
C:\Program Files (x86)\LonelyScreen\is-A8TGP.tmp

Filesize
1.1MB

MD5
cc8b164c85cc68a2e6e0d10e452ef68b

SHA1
fed79b50a5f03c0e33071ff849ea19dfdaf3c464

SHA256
20590034969e110c4fba1d065da8ac53dad79f5b8a9bd68780164207a170c749

SHA512
bee540ceb2b1de587872cdb963d2c754ac4ba0f3cac8026c3d7c2882aae0bfeb31babae927361b2ef5484ab2085b4a19914cc99a504aafd3f08c34f9f626699d

Download Submit
C:\Program Files (x86)\LonelyScreen\unins000.dat

Filesize
6KB

MD5
d8a73605cc8e451f0bfa007f21e0a205

SHA1
3590fb464baf3159219cc844c85c1ebfb747cbf9

SHA256
5eefa3a19893661b1345cf3928860c58df87a25384e360f9262dbe767d1a5931

SHA512
972f949f2ddcb84df73a57e40f1cc7cf7c124be406951372370d5d6b89b99f0862bd6f2418d2b1aea5f4c13bd111a4ec1147bfcc6b423eac6e19a0d53609b1f2

Download Submit
C:\Program Files\Java\jre7\lib\ext\dns_sd.jar

Filesize
16KB

MD5
ca086bb31b598febd7e8d44daf14714a

SHA1
4838808e80df811cfb2bf7faf361b3cbc16f9f81

SHA256
3818abdee5b1d3d77ae4a5ace25a638b2d7d624605f8e8ce14dd6d4c6639c00c

SHA512
54188bf433a0da1b6b8f6f881af6d681a6bb629693191c7ee46f852953529cb94dfa894aca574e1cd7355985ea8d6187e7694c8144ea1db880922676f0dfe0c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
822467b728b7a66b081c91795373789a

SHA1
d8f2f02e1eef62485a9feffd59ce837511749865

SHA256
af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

SHA512
bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6F06065BB83477089CB2AC4E4CE380C8

Filesize
504B

MD5
9bc0cab2765e360a50f22bbebb656501

SHA1
8bf0009bf4dfb23a7e4aea00db38d451c8ef61b2

SHA256
202c4b96677de63c750b4faa8ea126cec6bd7a07eee84f75d707da583af5ffc2

SHA512
fde674f858b81eaed33e3b179da560139682f271fb4cd04d6f80b59e809c3fe6f50ed23018371a27515f518ab822eb1bc72e4a26a2285f4af38ebd811d7320f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
3b9c9801624049209e1f13719ecd7603

SHA1
531bd8bde17ce3b099919ec6c49bee1ecb4e5592

SHA256
bbe3705f7087f95cadaf239ea2e50d92e6f70a7cb11b3a32d634032070e3dc5b

SHA512
3644ff645dbfda9b98071680808c4c544cec7f45af4fa22c7799cd40eadaa51e07b982caeddca115c4893102590ac5c7cc6d7375731ce776cae5de4705a3b1f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
051e6fdda23c6dd25003618471e1d302

SHA1
c5f3e0071840970330ccd5646400b1a236e03ced

SHA256
6d6e8ff92e5ff4229db0ee9784217921e90d85bf532813a72ffdc2b5dc9b57d3

SHA512
a4f687fc978daeabad256ca7b4f892bc2a29cd4d877cc209c2ff613511bcdbe3837a1ec306006a6bdaf679056edb073481e6d3f6cb12c832a5d3dbd1ea771500

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6F06065BB83477089CB2AC4E4CE380C8

Filesize
546B

MD5
60163c38680b7a3f258f88f4f902d0c5

SHA1
7d3eddf8cbd18a3448fdf0cd78598531bdb1df48

SHA256
8c25018a682e12888124fc94087ee710901380bd9c776815d50d4032a408d803

SHA512
3c02ca188b8fb3b6f1de8479c207a5cb2b8cd0220996010fcf092b410b7e2d71516030b2fe45e8e86667ab9e8c98d94d8b9cf91f1c7ae860600e67ce12057e0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18693f1a0f510b3b620d5a4c633eb687

SHA1
6d07cc0a6d99546869f644c07be0bdc878b448c8

SHA256
ca9576a4d28081b17fb30cd08d7d04bdc8cf5e0d485f308234cb869211cdefa5

SHA512
18234fd6b00aabafaf3e464ecc229d2fbc7c870db7b6409d739efb41e82427b50ce37220c38b1dd930302bc3400ea6287c6564e80fd100fa82e1ed89945d7b84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20cfd126a5d8c7727e77c31dfc2671ee

SHA1
6c518ca8b9d6307aaf2054aa2a9a658c27c7ea46

SHA256
6cd0e4f179f15092d681a6c82fac9c598f68ed46297d9d11ce9bcfc8e90a870c

SHA512
92dd10894d7acaa0340a97f7c55aca8b59aaab6e45d062eb656d857072f5d69c31d2373d265bcf793d1a4ef2a36c4335195b3ec96c870b53046a32d755c35c40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73e34eca4e7abb26e75950d9193b175e

SHA1
c2fc1a7174ac536a788d328b3f204dfe6fb44174

SHA256
d8965df14717182476091639c9c534f9b2e549d5f434f8f130aff318812eb8ca

SHA512
761f1f539eddafe0040864bed51a0fd8bdaa233c69c988750974302c080edec31e24459c7167aefa6e60f4cce1d3b05ce8ac7bc94263cb706d7ee9250ffa9084

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4558f25368b8c9211adeb476831c4a7

SHA1
03781a4cc4ca55c006f2b00fec99bc4d1c658e1e

SHA256
88701a187715ac966279808ed9ff439b67865c22601e6eab058a6af095b18c1e

SHA512
179edbcaa1bc45ef541069b079d41429cedd96916ebefac2bdb5c88293f7f65703c3ccc85aba4c0e2847890f45c127a9103da715e2cf040ce89ed2a5ed0aeec0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f124008843c4afc3a9479b6c3f621c1

SHA1
7d8e74ac7dcd65a4860e06ed8d115c9ae991537a

SHA256
6b04cace06569273994dd103465e8cbcf91200807a175fec5fe20ba86c502251

SHA512
2a3e0749588033cfea83ebbb60ece941149fa0dfa55e8925ab206cd54a4424461a73d3bfc54b5bebf4710dcbcfc0d486e0d4e6e7decfc07a6ac44a3b73d80812

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f766e9ab9971c399acc9c8b987919c6

SHA1
f0fd01e6eb2b5a145c6f68d9acba51ef2bd94d7a

SHA256
9158d95a530b8a755ee9691b130f5677a8e5c1dbcba5e6c2e4cfe19702c334a0

SHA512
cc78ac3967645fccd5126eb311d1cc9ebe4ba08f92b5949ccf57b10cf45389417f17d3685172b41535a0c70b0b91428cc051bbe93691cfd8305b30e5828a728d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d79ce89b52e54d316aa10c5a68234246

SHA1
236b439007e7e452001af872d81a16526580a242

SHA256
ca65953d7b1055d3f3b1c5729f84f052a894e282db691be7f15e662acdb3b884

SHA512
a047815ed88f9347aab1acd06cb349939c551a6ebbbc7aac88fa512cf76838fb823d98ec23f659895ce0de78b9f88db0463ec7d5cee1983b59c8471ef7555bcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b5a56a950ddd3c7d5d1c4a80ae846b0

SHA1
fda082b443eedd0a87cb4ecf3a592ad7efd209eb

SHA256
5f5a2ca5bdeb0de1c7f0f56ad81df981f1f942e273083c95c0547733911bf5f2

SHA512
b4e5da9656309627c07d311772fe23d870f6dd102415cb0fb6d053e7fc8dc638efb896e0d7ea71ccf3a19221b2017ebe65646123abfc3f5f06e533a5d0cc8f78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0abfd260ad46ac50c9ebe66913719829

SHA1
5588f44a3418a35cc7592eece6e8af06fca49c5d

SHA256
8c682b2d27397d0dc3f1e70897393d6508d2edb3df660051d93899821f36d63e

SHA512
ac9ec343c6502337a06b8b11507d5bc74d5da2e480c5caf0c76fcf41f9bbbb2473d77d2376ec533d2d124d1ab3b580c40a039c71cd4427d1e878070554d4e8ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0365af82804e9aa1138db737b75a815a

SHA1
b07d191f94260a5eca91e0f6a1692a6e83118c12

SHA256
18c9ddfda33f93e190377673817e8228ee13f9ce68eb7cade67ba3bef126d161

SHA512
1e13d89e4bde72de7590b1e5d8efc7a37abbdc2e1a19bc67ed46c2a1547bfd79a0be087cca6e18689249afdf98d135ec615669e4b7d5b8e25be091a251e0501d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e04b4cdd7b4cece13e5df5f1a54fb17

SHA1
9dc88c89dc5810bf9f7de357410f4b1dfd989be3

SHA256
b5541650d6d52cdcd2c8ce4c8a7d7f35143d2b196e11227be61c01acf0bfb587

SHA512
902b062545c51e6e96c2b98b900f4c409fa107f427f39c18f773b68cffbc90624aef6496abc7431e7ef07c90b5b21b1c301a924ade8a098e3d35be96bf70da5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43beb059f6282ae287eedefc2d69a476

SHA1
918d83fcc50c75a0b39780e5140ff8c95e10cd7e

SHA256
e8e1b9f7974df94c3f677892e46b1f09dd9c93c6aafe9e3e9efbbb6525e81ea7

SHA512
4f64068dd8cd8277771ab214c047d00853d74624195b30ff1136e02739ff0db728907ac87854f1890a92bd69d91692e5a4f73abb6b33170ed2127e050ea42e25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e56ecb1dc969c39cdc8c407ecf12a6b

SHA1
ea639d2a908e46c94afbb56e872ca519d477a95e

SHA256
656fc16947d3c72075697716e8f21cfc073e94329d79f3c6db836bd370dd76de

SHA512
eee0b68ead7682da53eafe315963d734e108a7fd3f2daf80d5dd2e615b8859ee6de51bff237dfb2a74d20bf460093ca8fe7565fef925df9ea6f1ef78576c45d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
360d52366d7566e42d6458b1b30e444c

SHA1
ef714dce91e20550aa56eef5727d574fa5149783

SHA256
d194f319c0fdfefb6bdd78cb399f9d133540da8c6905776393204d3b2a658abb

SHA512
0e9b9e82928797e250c02d23b943311b8e62577149e60d5d75b19d355f9bfc37a290f99bcbbe4834321e98c5a1b520a713745c06f0ba8c2ceca7d80ea0146b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7858f5052c431677403e2e72e3fb1616

SHA1
540392f376eb2c35c9506dbfdfe6604f4107153a

SHA256
9c461215fc8bfc2f2fc1300cc968d1b1acb930052b02b0d75205dc479638a8a0

SHA512
13b848c29b707d907b98de1b91855ddb6a0429d41a409c43bf20fb2e1385e387bb5ad3ade99b881abd3c264f6d726a57315b30f584c7a06cf466105fd7f244cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08010806a4d616dc9bf54b8ca84b3a1b

SHA1
6c2ca18496a95fda26e6d9e5c58d80fe2f9fe2ae

SHA256
f92bfd2609cb4041a235b5232fb0dc03010981de237bb4cf892a024a358b579b

SHA512
315210ebb9a2496ae66ef8312349c6d8cefdab62a3f3f7f9f96e3fda69fa3c7dc2c4868d252a84c9ad6a1dfd46c3cfbae30e933cfbcfe80ed8e371221a9280fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ab1ab1648bee42a026403bf311c768a

SHA1
1867d412c577b0ad05bffaa2622462143eb1bc4d

SHA256
08cc78a0fc8cc49317c3a1641b510f7965d3ff71a3fa5f7590583bc200a8970b

SHA512
802a0d92fde5d85f51e839b6cce5fb30cde1c81fd8371b54ec219d3a086bd2072e47d24c24492e2fcb8188b6995fa648156d65787301ecd699ffe1231e63c2a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34c057a1305c72fa8fd2df8887ad58d7

SHA1
053cba11c9bf81f3846cb381c2b70d48a2e474d6

SHA256
725784431f9e219d9b6d78ee9ca9b5ab6b94a6fa021ab102c0aaf3562e4c9df9

SHA512
5543e81bf2ea7e36468406ecbdb765223bc46e01699cc013cbd724b1224f1bf3f93634f9b4bc79a42f040ef9b01b5c6056ac3ab3154d39f16fc8ef48dee43e94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
441d64835cc9def9ed140c42ac9a090c

SHA1
c46f81b21a3c8e9724a6f4986697af3fb241ec11

SHA256
8836f75246bd60262a2b3c7115a4eb2e6e0336a21b184dd7cee5bb10f5bd9c47

SHA512
f0b6239e84af54753c0c52d588164e5786314870365a93b4214981677756e85cceb8dc97ea8207eb487051315f4219c2b9a82f8b0bc36fb39f6946a84198b9e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bce0bb362e829d5d7be487502ea702fa

SHA1
6d892f0d52bd28616921e7f77414f736f14e20c4

SHA256
83fcf783938215ffb22f409a9869886665df80fc35e150cc129b891a4a6b807b

SHA512
c00787d73dcade9a0d597efe98d7d22c414015b54cf0b33f6a1ea0c3b06dff06716b2fe578c834d5b60e9b9608395d1d5f48817dda185d279d14b68d4676da4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5fa33b113c23b5a5a542d78184ea22d

SHA1
9465444da6f7deea6221300ce54a6677dccf05bc

SHA256
fdeb5078baaf1d19085b017a159b66a48bcc0a376475fedcd559ed099a06ba07

SHA512
f002dba10fd614e5de599a0907fcf8930286513cea4273af91ff7cdfbab5c99e589d5911a573a7eb9c2c19215332cbabc5bb3a9a5a3a193704007a156bc8cc2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a67461f31c768a33331fada4f819b6b

SHA1
055873e81f795db31fe96f50d0cef7d17e2781f1

SHA256
d7e96b43d05c05e570b3b15708ca3710398d2bb17a319a57b85dd6cc839faff1

SHA512
d669da18a825cae7496f777df1b2704424f23f707889f0c014585933c14e0fb03cd4042d085279fb79cb2931eab3b5a25bc3d52cb0d6486dfed3b85fc188d7ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c83ea6d5f4119d9f2eebca14fba4aec

SHA1
5ceb9ba3a85e9140174276dab410ba7ca9c85d83

SHA256
45a3730607289b6a8b37edb1bbd1fdb15cec3467a1bb10ef17de6f56d72083bc

SHA512
25415e5fad99de210b3e67b982d5952cddd9db88dcfc6a9d6c29c5293456451552989445d3b7ff5b0a0b2dd5be2c97d16cca40b0f8ca793d31c999c75aa57aa8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7890cfc6233661adfdaf8abc45b8104a

SHA1
36fcd904edd6c3094d307a652b24a60da684d608

SHA256
2c4cf250b45bc23912c90f116d7fa299aa5beb27f452d105041f7e6d8194a46c

SHA512
6f7caa88a295acf2db155dfe0081d6543fe157c08d8d12bf98281f7f0d2f5f9a63dfe90a8b0687aa19e8d0a447769dd4cde34f187c6de540f0f159225e9337a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0c0a7e7acea5df3fc0eabbed30f6943

SHA1
99a01fcb3d0d5fda9d8937690a2c484042bd27a6

SHA256
8277a8091fc9a53b3f2988d28c8fd9554c0ddcaccd99c901d8d9ca0584d06b28

SHA512
332ad9f881cd7cbba4339a5dea0d2989b884bee9abea4d3d81073307f9d42b9aad4103de212bc0373b0d400b3db5c59c8bb6e68fc2be6474d3b69b990203c3d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef020227445639ce795f87bf0a8a474f

SHA1
2e038e539cfded609ec88ec10557ef4e227475a6

SHA256
3561d43323638165065f4338cf62c0cade9028b7838ad7a5fe16ad4a04e8766d

SHA512
b10b8dd0635efaf150b3fc5d029b5500698d0836079781ab4808969e09c4d3ca4b2022dfc7cffce31162f75bd88b52eed66e68a91f0028949a62169e2f53680e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
247d4744f68757d299030b9119c3baa4

SHA1
eb75cf9ba9be9bef4327b3eee58be01958d83486

SHA256
654ab5731ec1c394153986cd2117130c5dee4df6f019b2b72559305370616267

SHA512
a0ad5cc15eb0856918a42a66e9a8376feec46f31c85e80d5dd48c8dbb979c797fdc4e9a089e7dfc05644cec81ccab0e210346ad0882a8f042a6c3162c0c85b2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\gsz3hkd\imagestore.dat

Filesize
99KB

MD5
174579652a9f86e30e18e35a632ee83e

SHA1
bcb03fc34828ff95c270a3b7267dfb1dff609073

SHA256
40f463a4f31f780e08adc06e467ff3f2bee3d74e0d26d18810b291a4f9e411c0

SHA512
9b10dc010867b05ab26d143e42b671055a497949177bd1bfa32a065bf891db7a43def1dbaff86d9db720871db099f6942ea9014840ad77e676f3758d3dad0a52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1LNUKNV0\favicon[1].ico

Filesize
98KB

MD5
86a9f54e1e7e6911fc80f844c8a9ebf9

SHA1
383ee96826805cadd19909a0c9ee28f5414d129e

SHA256
cd51992107746615390ac94e62cf1ff312ae50793b5ca505a1fac0ee4130f861

SHA512
f6f41760895f5d7785ca7f40b26f467c838fc305d1a766575b3bf24466360b9612f8aa8cf3d88d23270973c0337ed20f48c13ea14b3601311ebb74733e80c8f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEB97.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEC36.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-6O6LP.tmp\bonjour.msi

Filesize
2.6MB

MD5
8dcf5c9eaacdaf4568220d103f393dea

SHA1
27f68596398b68ba048f95752b4eeb4aa013c23f

SHA256
53be81cc6e2dc95a1041e8f3d8f500fad4259ab20a1aac151b5fc7a64d354a93

SHA512
10f8ffb6fa5e7163f0a83190ddf211479f12e16635389b49ac041eceafd7f04c040d830065adc89b1003f38d8381851c09150a5bc8edced6ecae8ee5ae801088

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-VSADO.tmp\lonelyscreen-win-installer.tmp

Filesize
1.1MB

MD5
f120c361b527a9d090782300aa8f1ce5

SHA1
ed82441da0dc7a5695ef96839fc2aea0f0c7e376

SHA256
9209a83ac4b0127081327b6e03960e2a4325dbb31f0bba2b56dfb785583f9825

SHA512
60fc418c4296f67b923e1fff4e6034ed41eeba61604b14d560cfd84e7476b59311c6029aee7ee602d8fdc635107855e5c05dcf6a0137c6ba89db7134e63e5555

Download Submit
C:\Windows\Installer\MSIEEEB.tmp

Filesize
75KB

MD5
08c031fa82a09aae1079378669678fe6

SHA1
b109251d2fef08bd446be0c92369e6f11eb67093

SHA256
8764d060558a9d4ef24adb43201d5178033171a649ad497f79ce3b6cc8eda98a

SHA512
d133a7c02ee8e6e4a971ed4a6537c11cb58516a5ac0501672169805f7b97591d7cffd3a72133bd1df4b8d8a4f4965ddf324a83cd9be0d8af15e646a121e2ea4c

Download Submit
C:\Windows\Installer\MSIF16F.tmp

Filesize
75KB

MD5
6f8e3e4f72620bddc633f0175f47161e

SHA1
53ed75a208cc84f1a065e9e4ece356371cac0341

SHA256
2adf199f6baf245f0b07d31a3a1401d4262c3e6c98b8f10df923ceb2c937291e

SHA512
80187277e78f59b7ea71ed3caa55452e730d93b8c296d5820d470776a428cbb7e7fead87240e811436f85e4d89df2b9f31d6d16658d21abf59395cab7074a869

Download Submit
C:\Windows\SysWOW64\dnssd.dll

Filesize
71KB

MD5
062373995eae5f0eac9eaa9192136bfb

SHA1
b421e274da7d34aba8bf09ec2d3e7b4a01392b84

SHA256
0392d5656bd677c4c5cb74c96e7b85b0867f2535a37950aec7f5c4a1a70d19ae

SHA512
89c01c6c0abb7462a0dff6d9d03141f5dc42d08fcb22e44e532d8a87dd9d8c7db2fc272a1a52a147645e54d0116db94878fedc81f5fe4e5bf7d15292d95b2b88

Download Submit
\Program Files (x86)\LonelyScreen\LonelyScreen.exe

Filesize
22.3MB

MD5
a3ff7e328f41f4a6af82266bfe12036f

SHA1
79f0e44415ffe74b320dfb27c8988d326dc80b2e

SHA256
9f2a9f89adda3003c587e4a9bdf5decf3260beefb135180e44845aee7730f731

SHA512
472625b9ab26e83845a72423722e4b1286dce950597a52e95dff385bb33c1a1e4870755f273c8a02dea0793d04bdad7779cc05c786dff7ed624f5feb46d0a803

Download Submit
\Program Files (x86)\LonelyScreen\unins000.exe

Filesize
1.1MB

MD5
ff44a037ca0ef8d88c768cb284098170

SHA1
39be03cb8e657a10b0e88c9a4608a4fb536a1187

SHA256
e94b86d8116aa6dbe60e8dc3891be64e2dcb4e4b4fd511eacac4c28af541d8dd

SHA512
28de42438577f40b22b306cd5a8f99c97ece757abbb114810e9134a6593611fbe1a9c3f6b50a207f01fecd218916e560705487708178121f77a28f3e71841359

Download Submit
\Program Files\Bonjour\mDNSResponder.exe

Filesize
451KB

MD5
ebbcd5dfbb1de70e8f4af8fa59e401fd

SHA1
5ca966b9a5ff4ecd0e139e21b3e30f3ea48e1a88

SHA256
17bffc5df609ce3b2f0cab4bd6c118608c66a3ad86116a47e90b2bb7d8954122

SHA512
2fbfcff6bc25461e7c98aabdae0efb33f2df64140aaf4b2b0c253e34294e1606077ae47b000ebababb3600bd4d9154a945036c58e4e930da445a0dda765ac8a4

Download Submit
\Program Files\Bonjour\mdnsNSP.dll

Filesize
129KB

MD5
f9d908de6b166dac9b89bf62fa291ce8

SHA1
938b53238291fc41ae852fdde51eed7a2bff0604

SHA256
d0a918ad60221623bb0278ea94cd6938744617fdbb2054968afafc2940648f02

SHA512
6643a7066974abfd5904df73ed225fd5eed4a84341b12199b6eb9a8a2ad234dba865d50f8ccff8a88002ce4c6ae2131745cf43aac88a3a0a66b596fb0d93e56e

Download Submit
\Users\Admin\AppData\Local\Temp\is-6O6LP.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-6O6LP.tmp\isxdl.dll

Filesize
131KB

MD5
16881920cbe9ddb46c3ef29ee405a857

SHA1
0f76cffc2e57cf5c481a8015d203b96638d36ef5

SHA256
59abe5f46020cb56e1079df8dc1145b2033e4b1459ae3d92f637064a6b618bc1

SHA512
f07d1f4133a2ba2bda92fa6f55360fae73e44b97756ee3044f31af5f9e01cda34e7efbb1520c0b5aa2a496edc03ed4fefdc4ad419c1028b1ce6457b69aabeba0

Download Submit
\Users\Admin\AppData\Local\Temp\is-6O6LP.tmp\setup.exe

Filesize
7.6MB

MD5
7a2f16b1053362d8e8edae5e320dd4d9

SHA1
8cda4387a93287f38d2b48fb109bd54a77bcdcf9

SHA256
d2c7d87fad0c0fa94a4e2acdca4524cda696f2fd0c53ea9ddbe927da839707fa

SHA512
2277ee7ac98560093a652019bf3a2fb18f02718580ef6711532498aaa17b87705266ed83093ffd4cfc73ec608a76359336a1780586679838633ac403bf683bcd

Download Submit
memory/1528-81-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1528-45-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2212-80-0x0000000000400000-0x0000000000529000-memory.dmp

Filesize
1.2MB

Download
memory/2308-59-0x0000000000400000-0x0000000000529000-memory.dmp

Filesize
1.2MB

Download
memory/2308-182-0x0000000000400000-0x0000000000529000-memory.dmp

Filesize
1.2MB

Download
memory/2308-36-0x0000000000400000-0x0000000000529000-memory.dmp

Filesize
1.2MB

Download
memory/2308-19-0x0000000000400000-0x0000000000529000-memory.dmp

Filesize
1.2MB

Download
memory/2308-8-0x0000000000400000-0x0000000000529000-memory.dmp

Filesize
1.2MB

Download
memory/2308-455-0x0000000000400000-0x0000000000529000-memory.dmp

Filesize
1.2MB

Download
memory/2892-37-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2892-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2892-2-0x0000000000401000-0x0000000000410000-memory.dmp

Filesize
60KB

Download
memory/2892-456-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download