Overview

overview

10

Static

static

1

lonelyscre...er.exe

windows7-x64

10

lonelyscre...er.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    264s
  • max time network
    344s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    15-12-2024 22:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    lonelyscreen-win-installer.exe

  • Size

    538KB

  • MD5

    64da00119c76c6e1d75f059ffc4a772d

  • SHA1

    ebaebff7db60430cad107d4efc45654d43f98075

  • SHA256

    039004b76a1bc5ac020958256bdcf97f1464398c13b0be2e0d0078f1aee8b3a7

  • SHA512

    d13544aa2ee6060510c0f906e3f174a4ec40878f36193a99d6c527b62fa6a379115e965e272069b0e3f0479df16e6899a096ede37fb0832262c72d3d24f824f3

  • SSDEEP

    12288:AS3yBV888888888888W88888888888pKfXGU69eTutORzK/AA9i6Zub02O9HtFbl:/3yLKfXG6wZ/D9kqtZaTq

Score
10/10
discoveryevasionpersistenceprivilege_escalation

Malware Config

Signatures

  • Modifies firewall policy service 3 TTPs 1 IoCs
    evasion
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 24 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Blocklisted process makes network request 5 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 8 IoCs
  • Drops file in Program Files directory 37 IoCs
  • Drops file in Windows directory 17 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 37 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\lonelyscreen-win-installer.exe
    "C:\Users\Admin\AppData\Local\Temp\lonelyscreen-win-installer.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1832
    • C:\Users\Admin\AppData\Local\Temp\is-PLV9R.tmp\lonelyscreen-win-installer.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-PLV9R.tmp\lonelyscreen-win-installer.tmp" /SL5="$30156,164153,114176,C:\Users\Admin\AppData\Local\Temp\lonelyscreen-win-installer.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2536
      • C:\Users\Admin\AppData\Local\Temp\is-MKCH2.tmp\setup.exe
        "C:\Users\Admin\AppData\Local\Temp\is-MKCH2.tmp\setup.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1700
        • C:\Users\Admin\AppData\Local\Temp\is-JA5QQ.tmp\setup.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-JA5QQ.tmp\setup.tmp" /SL5="$3015E,7573378,114176,C:\Users\Admin\AppData\Local\Temp\is-MKCH2.tmp\setup.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:924
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" http://www.lonelyscreen.com/installed.php?version=1.2.16
            5⤵
            • Loads dropped DLL
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1696
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1696 CREDAT:275457 /prefetch:2
              6⤵
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:1836
      • C:\Windows\SysWOW64\msiexec.exe
        "msiexec.exe" /qn /i C:\Users\Admin\AppData\Local\Temp\is-MKCH2.tmp\bonjour.msi
        3⤵
        • Event Triggered Execution: Installer Packages
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2200
      • C:\Program Files (x86)\LonelyScreen\lonelyscreen.exe
        "C:\Program Files (x86)\LonelyScreen\lonelyscreen.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:2032
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1044
    • C:\Windows\system32\MsiExec.exe
      C:\Windows\system32\MsiExec.exe -Embedding A70EA4B2035446FCECDBDCE9965E9FB6
      2⤵
      • Loads dropped DLL
      PID:2560
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 1BB6323827FD34DFD9DCE1497881D382
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2060
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 5C43D4912405031CAD17A342F3295E50 M Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2220
    • C:\Windows\system32\MsiExec.exe
      "C:\Windows\system32\MsiExec.exe" /Y "C:\Program Files\Bonjour\mdnsNSP.dll"
      2⤵
      • Loads dropped DLL
      PID:2668
    • C:\Windows\syswow64\MsiExec.exe
      "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Bonjour\mdnsNSP.dll"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2948
  • C:\Program Files\Bonjour\mDNSResponder.exe
    "C:\Program Files\Bonjour\mDNSResponder.exe"
    1⤵
    • Modifies firewall policy service
    • Executes dropped EXE
    PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

2
T1546

Component Object Model Hijacking

1
T1546.015

Installer Packages

1
T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

2
T1546

Component Object Model Hijacking

1
T1546.015

Installer Packages

1
T1546.016

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

4
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

System Binary Proxy Execution

1
T1218

Msiexec

1
T1218.007

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

2
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\f79ce99.rbs
    Filesize

    118KB

    MD5

    ea31e537c64100b1aabeae2e06b877b5

    SHA1

    eb67778d681cf8f6e1a926acb594d28b20832777

    SHA256

    3a91e9a7cc8b4c4aa8e702422b44fb1c44944ea5245214ddcfdf3ec5c03dfa51

    SHA512

    430d3b017b292ef2c1618175f22b84d732cc9e77974932f9a0358c73290230655856050b25c777c1fbb1d892f1cd73f01c1bd0ddfb9f0745bc4679be8678b364

    Download Submit

  • C:\Program Files (x86)\LonelyScreen\is-FIK99.tmp
    Filesize

    1.1MB

    MD5

    cc8b164c85cc68a2e6e0d10e452ef68b

    SHA1

    fed79b50a5f03c0e33071ff849ea19dfdaf3c464

    SHA256

    20590034969e110c4fba1d065da8ac53dad79f5b8a9bd68780164207a170c749

    SHA512

    bee540ceb2b1de587872cdb963d2c754ac4ba0f3cac8026c3d7c2882aae0bfeb31babae927361b2ef5484ab2085b4a19914cc99a504aafd3f08c34f9f626699d

    Download Submit

  • C:\Program Files (x86)\LonelyScreen\unins000.dat
    Filesize

    6KB

    MD5

    31b8d2e0a31801f91c2e54ecb15d2ecb

    SHA1

    a01b2f9bc3443652d1794b1c015a9a527cd835cf

    SHA256

    7f8a5d3d3a0345df04b589bf2d3deeaf52e49ae7f55ad0444f2d144ca52a8fbf

    SHA512

    4fc2953d553f6f1c1736225e8abd52db71a2e6772cfb4ac47bd1b87f57d754972095b3c28cf31047cf9cb4d7de019b68301b2625b3887a520b6d04059c15f194

    Download Submit

  • C:\Program Files\Bonjour\mDNSResponder.exe
    Filesize

    451KB

    MD5

    ebbcd5dfbb1de70e8f4af8fa59e401fd

    SHA1

    5ca966b9a5ff4ecd0e139e21b3e30f3ea48e1a88

    SHA256

    17bffc5df609ce3b2f0cab4bd6c118608c66a3ad86116a47e90b2bb7d8954122

    SHA512

    2fbfcff6bc25461e7c98aabdae0efb33f2df64140aaf4b2b0c253e34294e1606077ae47b000ebababb3600bd4d9154a945036c58e4e930da445a0dda765ac8a4

    Download Submit

  • C:\Program Files\Java\jre7\lib\ext\dns_sd.jar
    Filesize

    16KB

    MD5

    ca086bb31b598febd7e8d44daf14714a

    SHA1

    4838808e80df811cfb2bf7faf361b3cbc16f9f81

    SHA256

    3818abdee5b1d3d77ae4a5ace25a638b2d7d624605f8e8ce14dd6d4c6639c00c

    SHA512

    54188bf433a0da1b6b8f6f881af6d681a6bb629693191c7ee46f852953529cb94dfa894aca574e1cd7355985ea8d6187e7694c8144ea1db880922676f0dfe0c5

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
    Filesize

    734B

    MD5

    e192462f281446b5d1500d474fbacc4b

    SHA1

    5ed0044ac937193b78f9878ad7bac5c9ff7534ff

    SHA256

    f1ba9f1b63c447682ebf9de956d0da2a027b1b779abef9522d347d3479139a60

    SHA512

    cc69a761a4e8e1d4bf6585aa8e3e5a7dfed610f540a6d43a288ebb35b16e669874ed5d2b06756ee4f30854f6465c84ee423502fc5b67ee9e7758a2dab41b31d3

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1E73DB4BC7EC7D53DAA55B0E346CCF24
    Filesize

    504B

    MD5

    6d7156f568dac461c6b6bb85c568132d

    SHA1

    748c85211bb93f33ee9fdfa91e768b3c753c3965

    SHA256

    8d5f5b5b6dafa8e98bf1494d23cfc649dcfe19a7f498c7650a4d6ee4c23e81ef

    SHA512

    2c9412c11dc2b52bfc640b462e1f6b1e2604ca647021504ff07b64ed72d2df69ac3d2711acba53f502443a2ab3052840a62707809d7bcf722e1646d6c434912d

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
    Filesize

    914B

    MD5

    e4a68ac854ac5242460afd72481b2a44

    SHA1

    df3c24f9bfd666761b268073fe06d1cc8d4f82a4

    SHA256

    cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

    SHA512

    5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
    Filesize

    192B

    MD5

    cf93597fbf1c822469a6de266857ba22

    SHA1

    001f08581157617d131b40921c2299abc9e93da9

    SHA256

    19e5b8f9a2654f55faf03601df53ed305a3b10162dd473ad3ca2048a4e1ecbdb

    SHA512

    6d7ba31e1a947185d3d1038154bb2eecc1588aaa40c9f1b8fa8227d9f377a46a9c82dcefd3aa709871c4afa257eeba11646e6bafa28ef4f95c32ce1fa65211d7

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1E73DB4BC7EC7D53DAA55B0E346CCF24
    Filesize

    546B

    MD5

    a452d67a0391814fccd1143ac445fdb8

    SHA1

    e024ab999e55319a916e6140453ae1660f5c08e1

    SHA256

    d1e52bbbb7a4b815b9a11ac769527d48b89b734aac898e1d4721c5cd39de28de

    SHA512

    52b7082c223cfde6da23974827a6dec36f9e1ba6db3104a04ada76dcf86179c9e43dae6498cafbe1c8c53d90ca6b968a6d5888fd0d98adc3505dfdf88b94817b

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
    Filesize

    252B

    MD5

    91c47339e3b9f393799dd45d255ad110

    SHA1

    959f85d52c8d29a471955ca21d83afc36c182957

    SHA256

    d03da3d95d5a102125779805937a451ca9846e9cdd9eacf5b0a65ff8aee1582b

    SHA512

    086c6bb7cc1fea2b2d07d2044c93ef59083f91b017d5f0d3b4cf121dd6d94b2be0c80aa3ef0b08ba43d1b249edb79fa41fd2a3f566d8b1c04ffc0bbb7c960a04

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    f80a8ca2aa566b2b34917429a65d3bbe

    SHA1

    3233470eb09e9ccbcc4a2ee48d41806234b53643

    SHA256

    d4c5940f3d366bd6b5f3ae2057c752bb236aa005f823f30a46ce9501aa0fb500

    SHA512

    68391f43deb8af9d364307504fc495d011424a8910ba74eca5322bbc1e5c3d90cbd8ac7a0d7cfed97cf61f2a9288a1fa6fcede034a6626df2a1bc44a8ca0d4f3

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    b4a60d9054542018aedcd7ffa889991e

    SHA1

    1a6cd5d2a8cb6eabe9ce3a76cd0ac7c0ce9d670b

    SHA256

    187be10d813ebe40cbe1bef1dd9d23480d9a0df64b28a25a538fdcda4da74c6e

    SHA512

    8bd5b8ba1af980da39ad218bbe767754c726e9e6fd6c24420766486a4166d6b9631dad21047f6910bc7f07f3f17197f7215864ab1c274e6a978c06253eeb6782

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    4b592afcc31b2e61f07553b6ae264285

    SHA1

    507bf9794cf3711e92bb64775d0398741cbe0f70

    SHA256

    757a8a7fdea6a8ad9eb99b20232ea983f2fb2b0636a25ba92f4d2d1b088a3959

    SHA512

    b755e9ec7a018d25f81df7214e1468bfa9a87419b20dae9b6e1c3387daf3ad4c633f9543a1dcc9e3bbd606078d2836c628220631fdbc4fa8cae7b62b4419f0b4

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    667c13172c222c104243512ecdf52cc4

    SHA1

    e387f3039bcc82e077ec5045eff2415daf726b03

    SHA256

    613ed1a70ce8209f06f919460aac12e321038dd43236956b7c32946b3bc5e77f

    SHA512

    e6d82e96405a7564e5e00d5e8e46a9c3d83bccce138c34ee52f75bdf452ea4ce2679fc52fe1eb0702b73fce98ff4ccdddc20ee7e61e240acf9709acc8588a56e

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    fe764e660f2a34cb409c0ad3d4bf62a6

    SHA1

    000dbd18ffc765310be2428906444b052df246bd

    SHA256

    edf29877fa66caecf8e34769a616e115ac8587405b05da5f78f605f26d20a7c8

    SHA512

    40462132bb1dcf54c93ed9ff296421a518988017eb839f32925ef3b60f75064fbea36b40815f60ff42145c6236fc20264237f0834bbd536a6faad31a5e0bed5b

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    86bb64dedda8df706a0db77c7ea85afb

    SHA1

    712eef203d2cb8318a82076d6479650b8bbeb3e4

    SHA256

    471d4c45f9406bc3cc5d8c850fedee25fc99c809884ec18a04aa0d1d546a678e

    SHA512

    f18a15ed25b86404d899026d9c7916e47a274d5e17364b8182aab4ce7992040766751ecc6fa369d73fd1c4ba601eb74da82c5d83ef7c61f5d5b651ba5ebefc60

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    8acf5cb03e7f0e70416040470420c5ee

    SHA1

    626b4e44d8377a8fb29d97821b254936ed447ef4

    SHA256

    8c030245f3088663961d1df087bcc9abdda84dd20a4fdcd57257655b74d396d9

    SHA512

    ba30850e52332e4586b2958b8affe5eefd806ef9e24a83fb8ba9cbd2e61475b65c9502b716729f46e10747ecaec50391a195ab6f703a51e7dac54babbcf71c0b

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    c8cddc2d66c00afd034f9826d661541a

    SHA1

    49bd4a0686bea0d0f72bb0075f7a848ab3d06ce7

    SHA256

    e04efa4e121a90949b7b6a591b2e5b181ab0ede34669a116936eff84cc7771a1

    SHA512

    93fd2a814e2b9d62ec7a01af9fbf5bc26b9475ca4e565d2a0b6b2ff6145c47f0ee793c276ea67ae450836379b1503391736ce9f75340a5f5a9fbae2de53b19e2

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    1f6171ea6deaee9962f0c62be8f74140

    SHA1

    3a0c146ca4c64a333f8666603bc2fd88e5785c24

    SHA256

    b6430bb1e943c5695a603a14e57149b3af263d504c9c00dcaaa656594a2d58c2

    SHA512

    99252ac7ef5dc98097267ab6e44f81f283206c9210fe80099530b0a119b488e8ed58c9f8cd44bd0db26163a7b412fae52ee72d0d8cdaedc17b77976a109fda03

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    e2a136fcc013d9e65737c6808e904bf7

    SHA1

    04b3397ad2600d8e1131106ee137d7efcca61a53

    SHA256

    ef8edea10ebb657dbe6fb83b35dd5d586e00959665c5087abdf9ab7a4d479249

    SHA512

    853ce5044703c3eafd42dce6e21f7b0e3b2af46e339794de6b7ffeeb262975c6fb715e0e1b5a22e9e3aa07fd8f1ecb80ef967e8a467dda25a4877d37dccc1610

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    02d9297095b81e06c9db518fbe1abd3b

    SHA1

    7a1eba2d3a101285c528f1c11937e65f700fe1ce

    SHA256

    7aacfe78d9a12072362b50534e062fc889685800a9df2e389643e3d45b686fbc

    SHA512

    2db5d54e2a94cbd8ded7dd3169abd5822eb5a363b0040a92863105ad70a5c9b450a03c8f2179ef870c08be26f8e626a48938bfbb998d1dde6e7210890e0d40e8

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    33d2ec7c35fc037de4b0c1fa1fe2dd93

    SHA1

    2b2c7076ab2a337fc90ad9699432a25913a2f3bb

    SHA256

    d94e4bb3c673290b0e40ee45f693505ea95256dac35f0d75d496cc150ab32718

    SHA512

    0280697d0bf464a46a2cca3cad77d3cb36451eb339091141b33d8245614b9916cedd99cad5233d380b2f41d9cdd62a56abc1228f4829cbadbfea35f2f18ad723

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    f9a64571ec69b72085b5cf2fbdfaec37

    SHA1

    3793a3f027d467aadd294fc16a574b5765c97aa9

    SHA256

    ca41b9f7877f4d0e65b3c71985597b4a24be6b459457d2268d40463376a9a61d

    SHA512

    97f6a4b28b1fe2a14c4bcae3ffd936b787da39022523fc213126dab7f013a87a409bfc3665e25179642cd8b6ee7fe1dc1e1a8c4f0927761bb5e80e6b0c2c2a63

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    24df01f48ce1828e2ee583f1c049efcd

    SHA1

    c2f667f311c8710eecbfd3987dc44760cf20fa14

    SHA256

    0c744b84b1e5cda2d45af226ffae7af4fe742f88657f71dc073f817c4fb3a6e7

    SHA512

    ee6b05dde545b2d549ecf709138648b51a20568c11f1cd8a7957fc018d218fd82071ffaf0208082040bd11d2ee111429e57f82be4cfa0c1b3367d310ba0f04ef

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    a1a756179f793994f689b56e68989e6f

    SHA1

    373f3e5d1873c7dba8ce49f8c5cbd6d12b4e9fa4

    SHA256

    d722b5adbfdce3d4e0c5d3204ae683ad069d30dfa1f1259ce13288570bc6b155

    SHA512

    2eb35efb215016ff6fa8188935ad2ad59873edf78eee0c4d62c2b573073675cf1bbad5aba10e85b0308127d0a7530c9c89613a261311f28c04b4d98c60014c7e

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    efba12b1bfaa85d0ffeb23bfd73c8118

    SHA1

    47c895a7529ab21156ac4fdee159d011c8824ed6

    SHA256

    d8a4c18d35710c869714bf795a59b1f590b273ddecb06354cfb0bcd048163069

    SHA512

    f4dc5cb3af1d9ee1de75cb74d2ab43ebda93b1144b215fb698af703fca2a45b984dbbb223291e584bd1cfad6090a5a8c4d838854231a75fdefe1b2f7e3c85eac

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    c790bb79a7337b026b005a90fbd11b82

    SHA1

    c6a5ae2dc0b19700d31077f499303f4214f9b338

    SHA256

    5339646e5bd0a64266601c9e66166f351cf0afd1e049011fde3b6d0477299a19

    SHA512

    aada15210ba78645216425cf622ec46fcc165f8d1811e90d9f561e2d9413740ee1bfb2564afc8452dc1d54568674a9e21a94e8f0ac9fabb12a4d8c54aacc274d

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    8e47dc8132e54a6ec7048a5b9168ddb8

    SHA1

    3b461b1a028d0157611dfb5d9de3f6051488a120

    SHA256

    65b53ae512006f3cbce80363e10b1237b316724a6946cd19f0d201af32b6566f

    SHA512

    fe4c9bfdce7c614f5a2fc401d2ba2ece140e027e922a233cf6e83b95c17b068b48e341de5bd8de81d83692fb3fcd05589de6bf467610c8dd2b9f9454aa5fc487

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    2830fc29ea5e8643e004bf2e7f6e22a5

    SHA1

    b4774a374fb1c8a1d8d6624b12ea6f6cc49fa208

    SHA256

    9db2a705a5d299f7826cc86358ab9c7586e5152047c0cca210ca16bd7f0553df

    SHA512

    e171cb0b80ea3ff5eb0bad82c4a09418ffc03d2ec06707fcf9d08c652c50dd5ab5e8db347016d1070984edd0c0d60bd81166fd62a3adb67de59d685c3c06009e

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    9392bbd607d210ddd9f047a8bcf0a83b

    SHA1

    e07099b6f7b363cf77d493bea21bf65bff2a7739

    SHA256

    a28fc874814b77abd2cf11e46bcbe533c46536d43fd8cfbeeb02eef49f327bf7

    SHA512

    c19f9f97dcaa739aac165262aa8614f62d4268e64552e8e119530611f93cc5f629cfe94b5e924fd0ff1eb246660b361f73069ee1feeed3020393e3af49a5d015

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    56d0ca2ddc513c421af92da28c2bf4a0

    SHA1

    521ab7bf461510646a5ef6dc27d94ef63b1cf066

    SHA256

    d3791baf446a0732654913c9ad58cf8148cc883a20cadf4ed8f01691624d2761

    SHA512

    9567d53ba6920cd5dcda70e5785daa488354aef4e655b4846c611302a5916f1bf869d0c0790b8577e33be5830dbfb51197d63cc4ce2a784be692024721076ba9

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    c01731591de680e47ac87e411c19e7ae

    SHA1

    4ff2b55879ba75180d0247ae7a41448561440cbc

    SHA256

    9180c6547f39280a5d84ec38b0c3fc8bcbce9e54f68637290af1a8209ad1c16d

    SHA512

    42dcc2f102b37e96536384cbbb1edf2689132e2ac0ce56641f0a37fd812b1746234b18f4a7981736e28e7e33d2315f4f4ff78f543256acb6927f13ba2e41a0ff

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    e33b41a83147a12060dc6a5b4440b563

    SHA1

    f549bfa1624eb673c0b749f1317229fc0ce6a054

    SHA256

    68330f9d0138147fc8c727a40168fa6731490c1eb10abda4ffbcfc93382d81a7

    SHA512

    827178acae8a0d71d14a9565800548544a44d2721ae396127d8d1262af4e0aadbcdfff477621d32bc774eac3e3820e6476b91b62433a7d5c458b04ca29a9ce24

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
    Filesize

    242B

    MD5

    0a5a14e5ae190067dae406adb7889a7a

    SHA1

    9b0fed84ae3335d4bda516f26ab4b7b0ce334cf2

    SHA256

    bf5dc852b86a86e23be1e2f0a3be643b36e4eb02b14e4880f0dab70cce727bbd

    SHA512

    62e6a27871e9ccd4f9da70cd5cfebd5b2732606fd074ea7e9693bfa5ec35c700bbb265d1ef1e15f5ded83eeaf8d8f64c6eed259737df7fa32cc9e64c0083efb2

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\melo7gx\imagestore.dat
    Filesize

    99KB

    MD5

    0a2a9051364e2b2609bdf02734176737

    SHA1

    ab620dd9b4ef967633e041478d66b4df659ddb24

    SHA256

    60642277cac3a2996f22c77c20b9a69b8cfdc64055035d15eb3301a106821d21

    SHA512

    b872c4959424658503aa2a54a03db5e43336885fa2a65dab095315cd7dd8d1d5f795e841850228034b0fcbfaafde9ecb1cfb12c16923da0fa3ac94264dd7fd07

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NT668XG4\favicon[1].ico
    Filesize

    98KB

    MD5

    86a9f54e1e7e6911fc80f844c8a9ebf9

    SHA1

    383ee96826805cadd19909a0c9ee28f5414d129e

    SHA256

    cd51992107746615390ac94e62cf1ff312ae50793b5ca505a1fac0ee4130f861

    SHA512

    f6f41760895f5d7785ca7f40b26f467c838fc305d1a766575b3bf24466360b9612f8aa8cf3d88d23270973c0337ed20f48c13ea14b3601311ebb74733e80c8f6

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\CabCF22.tmp
    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TarD05B.tmp
    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-MKCH2.tmp\bonjour.msi
    Filesize

    2.6MB

    MD5

    8dcf5c9eaacdaf4568220d103f393dea

    SHA1

    27f68596398b68ba048f95752b4eeb4aa013c23f

    SHA256

    53be81cc6e2dc95a1041e8f3d8f500fad4259ab20a1aac151b5fc7a64d354a93

    SHA512

    10f8ffb6fa5e7163f0a83190ddf211479f12e16635389b49ac041eceafd7f04c040d830065adc89b1003f38d8381851c09150a5bc8edced6ecae8ee5ae801088

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-PLV9R.tmp\lonelyscreen-win-installer.tmp
    Filesize

    1.1MB

    MD5

    f120c361b527a9d090782300aa8f1ce5

    SHA1

    ed82441da0dc7a5695ef96839fc2aea0f0c7e376

    SHA256

    9209a83ac4b0127081327b6e03960e2a4325dbb31f0bba2b56dfb785583f9825

    SHA512

    60fc418c4296f67b923e1fff4e6034ed41eeba61604b14d560cfd84e7476b59311c6029aee7ee602d8fdc635107855e5c05dcf6a0137c6ba89db7134e63e5555

    Download Submit

  • \Program Files (x86)\Bonjour\mdnsNSP.dll
    Filesize

    118KB

    MD5

    40947436a70e0034e41123df5a0a7702

    SHA1

    6c27e1dd1c1533feb6435190a5074300ac2a9822

    SHA256

    5d40fd92da5ca59c1badb58ad509db6a6d613f18660a9a270a53eca85d34c3a9

    SHA512

    ba5634cc82f306245f9f0350bfa0b91e2f5ffc6c355b1452a95483f47e6acdb42c4e063f6c15115faf0f0630005df4fe8ef0e01539c270031cbd07a34a929704

    Download Submit

  • \Program Files (x86)\LonelyScreen\LonelyScreen.exe
    Filesize

    22.3MB

    MD5

    a3ff7e328f41f4a6af82266bfe12036f

    SHA1

    79f0e44415ffe74b320dfb27c8988d326dc80b2e

    SHA256

    9f2a9f89adda3003c587e4a9bdf5decf3260beefb135180e44845aee7730f731

    SHA512

    472625b9ab26e83845a72423722e4b1286dce950597a52e95dff385bb33c1a1e4870755f273c8a02dea0793d04bdad7779cc05c786dff7ed624f5feb46d0a803

    Download Submit

  • \Program Files (x86)\LonelyScreen\unins000.exe
    Filesize

    1.1MB

    MD5

    ff44a037ca0ef8d88c768cb284098170

    SHA1

    39be03cb8e657a10b0e88c9a4608a4fb536a1187

    SHA256

    e94b86d8116aa6dbe60e8dc3891be64e2dcb4e4b4fd511eacac4c28af541d8dd

    SHA512

    28de42438577f40b22b306cd5a8f99c97ece757abbb114810e9134a6593611fbe1a9c3f6b50a207f01fecd218916e560705487708178121f77a28f3e71841359

    Download Submit

  • \Program Files\Bonjour\mdnsNSP.dll
    Filesize

    129KB

    MD5

    f9d908de6b166dac9b89bf62fa291ce8

    SHA1

    938b53238291fc41ae852fdde51eed7a2bff0604

    SHA256

    d0a918ad60221623bb0278ea94cd6938744617fdbb2054968afafc2940648f02

    SHA512

    6643a7066974abfd5904df73ed225fd5eed4a84341b12199b6eb9a8a2ad234dba865d50f8ccff8a88002ce4c6ae2131745cf43aac88a3a0a66b596fb0d93e56e

    Download Submit

  • \Users\Admin\AppData\Local\Temp\is-MKCH2.tmp\_isetup\_shfoldr.dll
    Filesize

    22KB

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

    Download Submit

  • \Users\Admin\AppData\Local\Temp\is-MKCH2.tmp\isxdl.dll
    Filesize

    131KB

    MD5

    16881920cbe9ddb46c3ef29ee405a857

    SHA1

    0f76cffc2e57cf5c481a8015d203b96638d36ef5

    SHA256

    59abe5f46020cb56e1079df8dc1145b2033e4b1459ae3d92f637064a6b618bc1

    SHA512

    f07d1f4133a2ba2bda92fa6f55360fae73e44b97756ee3044f31af5f9e01cda34e7efbb1520c0b5aa2a496edc03ed4fefdc4ad419c1028b1ce6457b69aabeba0

    Download Submit

  • \Users\Admin\AppData\Local\Temp\is-MKCH2.tmp\setup.exe
    Filesize

    7.6MB

    MD5

    7a2f16b1053362d8e8edae5e320dd4d9

    SHA1

    8cda4387a93287f38d2b48fb109bd54a77bcdcf9

    SHA256

    d2c7d87fad0c0fa94a4e2acdca4524cda696f2fd0c53ea9ddbe927da839707fa

    SHA512

    2277ee7ac98560093a652019bf3a2fb18f02718580ef6711532498aaa17b87705266ed83093ffd4cfc73ec608a76359336a1780586679838633ac403bf683bcd

    Download Submit

  • \Windows\Installer\MSID988.tmp
    Filesize

    75KB

    MD5

    08c031fa82a09aae1079378669678fe6

    SHA1

    b109251d2fef08bd446be0c92369e6f11eb67093

    SHA256

    8764d060558a9d4ef24adb43201d5178033171a649ad497f79ce3b6cc8eda98a

    SHA512

    d133a7c02ee8e6e4a971ed4a6537c11cb58516a5ac0501672169805f7b97591d7cffd3a72133bd1df4b8d8a4f4965ddf324a83cd9be0d8af15e646a121e2ea4c

    Download Submit

  • \Windows\Installer\MSIDEE8.tmp
    Filesize

    75KB

    MD5

    6f8e3e4f72620bddc633f0175f47161e

    SHA1

    53ed75a208cc84f1a065e9e4ece356371cac0341

    SHA256

    2adf199f6baf245f0b07d31a3a1401d4262c3e6c98b8f10df923ceb2c937291e

    SHA512

    80187277e78f59b7ea71ed3caa55452e730d93b8c296d5820d470776a428cbb7e7fead87240e811436f85e4d89df2b9f31d6d16658d21abf59395cab7074a869

    Download Submit

  • \Windows\SysWOW64\dnssd.dll
    Filesize

    71KB

    MD5

    062373995eae5f0eac9eaa9192136bfb

    SHA1

    b421e274da7d34aba8bf09ec2d3e7b4a01392b84

    SHA256

    0392d5656bd677c4c5cb74c96e7b85b0867f2535a37950aec7f5c4a1a70d19ae

    SHA512

    89c01c6c0abb7462a0dff6d9d03141f5dc42d08fcb22e44e532d8a87dd9d8c7db2fc272a1a52a147645e54d0116db94878fedc81f5fe4e5bf7d15292d95b2b88

    Download Submit

  • memory/924-124-0x0000000000400000-0x0000000000529000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/924-109-0x0000000000400000-0x0000000000529000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/924-83-0x0000000000400000-0x0000000000529000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/1700-82-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/1700-125-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/1700-67-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/1832-35-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/1832-2-0x0000000000401000-0x0000000000410000-memory.dmp

    Filesize

    60KB

    Download

  • memory/1832-0-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/1832-496-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2536-220-0x0000000000400000-0x0000000000529000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2536-34-0x0000000000400000-0x0000000000529000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2536-19-0x0000000000400000-0x0000000000529000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2536-41-0x0000000000400000-0x0000000000529000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2536-81-0x0000000000400000-0x0000000000529000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2536-8-0x0000000000400000-0x0000000000529000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2536-495-0x0000000000400000-0x0000000000529000-memory.dmp

    Filesize

    1.2MB

    Download