a8a84632f43da3e7feb8b4d64580daa17d92fcb09974770bf5f4492e46ca2125

Resubmissions

02/10/2024, 02:36

241002-c3x8xswgph 7

02/10/2024, 02:35

241002-c24djswgle 7

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 02:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

LunarEngineSetup.exe
Size

20.3MB
MD5

1e127e16166f6acc05b433f5c151af2e
SHA1

2e763303c5bf1969dd412d77452ffa7a18c52b8c
SHA256

a8a84632f43da3e7feb8b4d64580daa17d92fcb09974770bf5f4492e46ca2125
SHA512

2797915d0cb78178a75356fc790929905bde59ccf2f4ade3e23c7b9851926abbe3d30c3479569fefcdf3ea89522c9050c44638b032b76f57771d767050fedbf6
SSDEEP

393216:h4IffuuxDS1fDiq5jUcUgPeyJ7o48nG/qQ6o+1BbwmdsUywobkCT+:h4IeuFSDPvUCbJk48G/D/OtFyed

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
1340	LunarEngineSetup.tmp
2836	Lunar Engine.exe
2896	Lunarengine-x86_64-SSE4-AVX2.exe
2920	Tutorial-i386.exe

Loads dropped DLL 10 IoCs

pid	Process
2844	LunarEngineSetup.exe
1340	LunarEngineSetup.tmp
1340	LunarEngineSetup.tmp
2836	Lunar Engine.exe
2896	Lunarengine-x86_64-SSE4-AVX2.exe
2896	Lunarengine-x86_64-SSE4-AVX2.exe
2896	Lunarengine-x86_64-SSE4-AVX2.exe
2896	Lunarengine-x86_64-SSE4-AVX2.exe
2896	Lunarengine-x86_64-SSE4-AVX2.exe
2896	Lunarengine-x86_64-SSE4-AVX2.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
61	raw.githubusercontent.com
62	raw.githubusercontent.com

Drops file in System32 directory 52 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\imagehlp.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\USER32.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\opengl32.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\GLU32.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\MSCTF.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\ws2_32.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\NSI.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\wsock32.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\wininet.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\msimg32.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\GDI32.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\advapi32.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\CLBCatQ.DLL	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\DUser.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\shfolder.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\propsys.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\shell32.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\SHLWAPI.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\DCIMAN32.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\CRYPTBASE.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\explorerframe.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\oleaut32.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\RPCRT4.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\comdlg32.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\psapi.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\normaliz.DLL	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\hhctrl.ocx	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\ntdll.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\kernel32.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\ole32.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\LPK.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\SETUPAPI.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\dwmapi.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\imm32.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\KERNELBASE.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\iertutil.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\DUI70.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\msvcrt.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\USP10.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\sechost.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\version.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\DDRAW.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\CFGMGR32.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\DEVOBJ.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\uxtheme.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\profapi.dll	Lunarengine-x86_64-SSE4-AVX2.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Lunar Engine 7.2\badassets\is-UB8EA.tmp	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\plugins\is-AVO69.tmp	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\plugins\example-c\is-IQVD6.tmp	LunarEngineSetup.tmp
File opened for modification	C:\Program Files (x86)\Lunar Engine 7.2\ced3d9hook64.dll	LunarEngineSetup.tmp
File opened for modification	C:\Program Files (x86)\Lunar Engine 7.2\libipt-64.dll	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\is-1D7SD.tmp	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\is-47UAF.tmp	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\autorun\ceshare\is-D84OB.tmp	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\plugins\c# template\CEPluginLibrary\SDK\is-3P309.tmp	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\plugins\example-c\is-6NR39.tmp	LunarEngineSetup.tmp
File opened for modification	C:\Program Files (x86)\Lunar Engine 7.2\LunarEngine.chm	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\is-E52ND.tmp	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\is-E43QN.tmp	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\languages\is-RLGC1.tmp	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\is-BSN1U.tmp	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\autorun\ceshare\is-VDR36.tmp	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\badassets\is-JP4VQ.tmp	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\autorun\is-8J6EC.tmp	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\autorun\ceshare\forms\is-PVRTQ.tmp	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\autorun\dlls\64\is-5D94O.tmp	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\plugins\c# template\CEPluginLibrary\is-TERGT.tmp	LunarEngineSetup.tmp
File opened for modification	C:\Program Files (x86)\Lunar Engine 7.2\lunarengine-x86_64.exe	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\is-6INKP.tmp	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\is-60O32.tmp	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\is-M510L.tmp	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\autorun\dlls\src\Mono\MonoDataCollector\is-A2SDP.tmp	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\plugins\c# template\CEPluginLibrary\SDK\is-6929H.tmp	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\is-B1JDD.tmp	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\autorun\ceshare\forms\is-B1SGH.tmp	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\autorun\ceshare\images\is-3IRD8.tmp	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\autorun\dlls\src\Mono\is-ICDRO.tmp	LunarEngineSetup.tmp
File opened for modification	C:\Program Files (x86)\Lunar Engine 7.2\d3dhook64.dll	LunarEngineSetup.tmp
File opened for modification	C:\Program Files (x86)\Lunar Engine 7.2\win64\symsrv.dll	LunarEngineSetup.tmp
File opened for modification	C:\Program Files (x86)\Lunar Engine 7.2\lua53-32.dll	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\autorun\is-P1I7D.tmp	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\autorun\dlls\src\Common\is-SNN9M.tmp	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\plugins\is-QPDPO.tmp	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\autorun\dlls\32\is-OG54D.tmp	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\plugins\c# template\CEPluginLibrary\SDK\is-P9R12.tmp	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\win32\is-G5KB8.tmp	LunarEngineSetup.tmp
File opened for modification	C:\Program Files (x86)\Lunar Engine 7.2\DotNetDataCollector32.exe	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\is-62JE9.tmp	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\is-SJQAV.tmp	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\win64\is-PAFAC.tmp	LunarEngineSetup.tmp
File opened for modification	C:\Program Files (x86)\Lunar Engine 7.2\lua53-64.dll	Lunarengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files (x86)\Lunar Engine 7.2\allochook-x86_64.dll	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\autorun\is-PVHLD.tmp	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\autorun\forms\is-CT0N0.tmp	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\clibs32\is-29GUS.tmp	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\plugins\c# template\is-7ND2S.tmp	LunarEngineSetup.tmp
File opened for modification	C:\Program Files (x86)\Lunar Engine 7.2\libmikmod32.dll	LunarEngineSetup.tmp
File opened for modification	C:\Program Files (x86)\Lunar Engine 7.2\gtutorial-x86_64.exe	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\autorun\is-N1OR6.tmp	LunarEngineSetup.tmp
File opened for modification	C:\Program Files (x86)\Lunar Engine 7.2\allochook-i386.dll	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\is-6PSJG.tmp	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\autorun\is-EMKK9.tmp	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\autorun\ceshare\forms\is-SKJ6K.tmp	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\autorun\dlls\src\Mono\MonoDataCollector\is-C2B5C.tmp	LunarEngineSetup.tmp
File opened for modification	C:\Program Files (x86)\Lunar Engine 7.2\libmikmod64.dll	LunarEngineSetup.tmp
File opened for modification	C:\Program Files (x86)\Lunar Engine 7.2\autorun\dlls\64\CEJVMTI.dll	LunarEngineSetup.tmp
File opened for modification	C:\Program Files (x86)\Lunar Engine 7.2\autorun\dlls\DotNetInterface.dll	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\autorun\dlls\src\Mono\MonoDataCollector\is-MBCQE.tmp	LunarEngineSetup.tmp
File created	C:\Program Files (x86)\Lunar Engine 7.2\win64\is-8Q9CH.tmp	LunarEngineSetup.tmp
File opened for modification	C:\Program Files (x86)\Lunar Engine 7.2\Lunarengine-x86_64-SSE4-AVX2.exe	Lunarengine-x86_64-SSE4-AVX2.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32.dll	Lunarengine-x86_64-SSE4-AVX2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LunarEngineSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LunarEngineSetup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lunar Engine.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tutorial-i386.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1340	LunarEngineSetup.tmp
1340	LunarEngineSetup.tmp
1056	chrome.exe
1056	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2896	Lunarengine-x86_64-SSE4-AVX2.exe
Token: SeTcbPrivilege	2896	Lunarengine-x86_64-SSE4-AVX2.exe
Token: SeTcbPrivilege	2896	Lunarengine-x86_64-SSE4-AVX2.exe
Token: SeLoadDriverPrivilege	2896	Lunarengine-x86_64-SSE4-AVX2.exe
Token: SeCreateGlobalPrivilege	2896	Lunarengine-x86_64-SSE4-AVX2.exe
Token: SeLockMemoryPrivilege	2896	Lunarengine-x86_64-SSE4-AVX2.exe
Token: 33	2896	Lunarengine-x86_64-SSE4-AVX2.exe
Token: SeSecurityPrivilege	2896	Lunarengine-x86_64-SSE4-AVX2.exe
Token: SeTakeOwnershipPrivilege	2896	Lunarengine-x86_64-SSE4-AVX2.exe
Token: SeManageVolumePrivilege	2896	Lunarengine-x86_64-SSE4-AVX2.exe
Token: SeBackupPrivilege	2896	Lunarengine-x86_64-SSE4-AVX2.exe
Token: SeCreatePagefilePrivilege	2896	Lunarengine-x86_64-SSE4-AVX2.exe
Token: SeShutdownPrivilege	2896	Lunarengine-x86_64-SSE4-AVX2.exe
Token: SeRestorePrivilege	2896	Lunarengine-x86_64-SSE4-AVX2.exe
Token: 33	2896	Lunarengine-x86_64-SSE4-AVX2.exe
Token: SeIncBasePriorityPrivilege	2896	Lunarengine-x86_64-SSE4-AVX2.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
1340	LunarEngineSetup.tmp
2896	Lunarengine-x86_64-SSE4-AVX2.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 1340	2844	LunarEngineSetup.exe	31
PID 2844 wrote to memory of 1340	2844	LunarEngineSetup.exe	31
PID 2844 wrote to memory of 1340	2844	LunarEngineSetup.exe	31
PID 2844 wrote to memory of 1340	2844	LunarEngineSetup.exe	31
PID 2844 wrote to memory of 1340	2844	LunarEngineSetup.exe	31
PID 2844 wrote to memory of 1340	2844	LunarEngineSetup.exe	31
PID 2844 wrote to memory of 1340	2844	LunarEngineSetup.exe	31
PID 1340 wrote to memory of 2836	1340	LunarEngineSetup.tmp	32
PID 1340 wrote to memory of 2836	1340	LunarEngineSetup.tmp	32
PID 1340 wrote to memory of 2836	1340	LunarEngineSetup.tmp	32
PID 1340 wrote to memory of 2836	1340	LunarEngineSetup.tmp	32
PID 2836 wrote to memory of 2896	2836	Lunar Engine.exe	33
PID 2836 wrote to memory of 2896	2836	Lunar Engine.exe	33
PID 2836 wrote to memory of 2896	2836	Lunar Engine.exe	33
PID 2836 wrote to memory of 2896	2836	Lunar Engine.exe	33
PID 2896 wrote to memory of 2920	2896	Lunarengine-x86_64-SSE4-AVX2.exe	34
PID 2896 wrote to memory of 2920	2896	Lunarengine-x86_64-SSE4-AVX2.exe	34
PID 2896 wrote to memory of 2920	2896	Lunarengine-x86_64-SSE4-AVX2.exe	34
PID 2896 wrote to memory of 2920	2896	Lunarengine-x86_64-SSE4-AVX2.exe	34
PID 1056 wrote to memory of 2940	1056	chrome.exe	36
PID 1056 wrote to memory of 2940	1056	chrome.exe	36
PID 1056 wrote to memory of 2940	1056	chrome.exe	36
PID 1056 wrote to memory of 2888	1056	chrome.exe	38
PID 1056 wrote to memory of 2888	1056	chrome.exe	38
PID 1056 wrote to memory of 2888	1056	chrome.exe	38
PID 1056 wrote to memory of 2888	1056	chrome.exe	38
PID 1056 wrote to memory of 2888	1056	chrome.exe	38
PID 1056 wrote to memory of 2888	1056	chrome.exe	38
PID 1056 wrote to memory of 2888	1056	chrome.exe	38
PID 1056 wrote to memory of 2888	1056	chrome.exe	38
PID 1056 wrote to memory of 2888	1056	chrome.exe	38
PID 1056 wrote to memory of 2888	1056	chrome.exe	38
PID 1056 wrote to memory of 2888	1056	chrome.exe	38
PID 1056 wrote to memory of 2888	1056	chrome.exe	38
PID 1056 wrote to memory of 2888	1056	chrome.exe	38
PID 1056 wrote to memory of 2888	1056	chrome.exe	38
PID 1056 wrote to memory of 2888	1056	chrome.exe	38
PID 1056 wrote to memory of 2888	1056	chrome.exe	38
PID 1056 wrote to memory of 2888	1056	chrome.exe	38
PID 1056 wrote to memory of 2888	1056	chrome.exe	38
PID 1056 wrote to memory of 2888	1056	chrome.exe	38
PID 1056 wrote to memory of 2888	1056	chrome.exe	38
PID 1056 wrote to memory of 2888	1056	chrome.exe	38
PID 1056 wrote to memory of 2888	1056	chrome.exe	38
PID 1056 wrote to memory of 2888	1056	chrome.exe	38
PID 1056 wrote to memory of 2888	1056	chrome.exe	38
PID 1056 wrote to memory of 2888	1056	chrome.exe	38
PID 1056 wrote to memory of 2888	1056	chrome.exe	38
PID 1056 wrote to memory of 2888	1056	chrome.exe	38
PID 1056 wrote to memory of 2888	1056	chrome.exe	38
PID 1056 wrote to memory of 2888	1056	chrome.exe	38
PID 1056 wrote to memory of 2888	1056	chrome.exe	38
PID 1056 wrote to memory of 2888	1056	chrome.exe	38
PID 1056 wrote to memory of 2888	1056	chrome.exe	38
PID 1056 wrote to memory of 2888	1056	chrome.exe	38
PID 1056 wrote to memory of 2888	1056	chrome.exe	38
PID 1056 wrote to memory of 2888	1056	chrome.exe	38
PID 1056 wrote to memory of 2888	1056	chrome.exe	38
PID 1056 wrote to memory of 2888	1056	chrome.exe	38
PID 1056 wrote to memory of 2888	1056	chrome.exe	38
PID 1056 wrote to memory of 2888	1056	chrome.exe	38
PID 1056 wrote to memory of 1520	1056	chrome.exe	39
PID 1056 wrote to memory of 1520	1056	chrome.exe	39
PID 1056 wrote to memory of 1520	1056	chrome.exe	39

C:\Users\Admin\AppData\Local\Temp\LunarEngineSetup.exe
"C:\Users\Admin\AppData\Local\Temp\LunarEngineSetup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Users\Admin\AppData\Local\Temp\is-T95OL.tmp\LunarEngineSetup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-T95OL.tmp\LunarEngineSetup.tmp" /SL5="$30146,20482105,803840,C:\Users\Admin\AppData\Local\Temp\LunarEngineSetup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Program Files (x86)\Lunar Engine 7.2\Lunar Engine.exe
    "C:\Program Files (x86)\Lunar Engine 7.2\Lunar Engine.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\Program Files (x86)\Lunar Engine 7.2\Lunarengine-x86_64-SSE4-AVX2.exe
      "C:\Program Files (x86)\Lunar Engine 7.2\Lunarengine-x86_64-SSE4-AVX2.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2896
    - - C:\Program Files (x86)\Lunar Engine 7.2\Tutorial-i386.exe
        
        "C:\Program Files (x86)\Lunar Engine 7.2\Tutorial-i386.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef73d9758,0x7fef73d9768,0x7fef73d9778
  2⤵
  PID:2940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1260,i,198288262728017195,9413395453212429822,131072 /prefetch:2
  2⤵
  PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1536 --field-trial-handle=1260,i,198288262728017195,9413395453212429822,131072 /prefetch:8
  2⤵
  PID:1520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1660 --field-trial-handle=1260,i,198288262728017195,9413395453212429822,131072 /prefetch:8
  2⤵
  PID:320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2276 --field-trial-handle=1260,i,198288262728017195,9413395453212429822,131072 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2288 --field-trial-handle=1260,i,198288262728017195,9413395453212429822,131072 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1420 --field-trial-handle=1260,i,198288262728017195,9413395453212429822,131072 /prefetch:2
  2⤵
  PID:3012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1492 --field-trial-handle=1260,i,198288262728017195,9413395453212429822,131072 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3420 --field-trial-handle=1260,i,198288262728017195,9413395453212429822,131072 /prefetch:8
  2⤵
  PID:1544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3532 --field-trial-handle=1260,i,198288262728017195,9413395453212429822,131072 /prefetch:8
  2⤵
  PID:2708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3408 --field-trial-handle=1260,i,198288262728017195,9413395453212429822,131072 /prefetch:8
  2⤵
  PID:2824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3668 --field-trial-handle=1260,i,198288262728017195,9413395453212429822,131072 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=1676 --field-trial-handle=1260,i,198288262728017195,9413395453212429822,131072 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2568 --field-trial-handle=1260,i,198288262728017195,9413395453212429822,131072 /prefetch:8
  2⤵
  PID:2636

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Lunar Engine 7.2\Lunar Engine.exe

Filesize
375KB

MD5
468970b7180be88ba5ffb1c8955bb509

SHA1
cacfeeb43ef11b0cb5692dba5d743618c7341de1

SHA256
c8c24599f11415f567f1e59e2d2f10260f232d601d3c3180c30e90ae76c27a2b

SHA512
b32af4e483e98f7f13610337bf87309a9385a7bf4b98bf9d6262720ccb8099d2a29a7f02af0ec6f8ba2156c8017dc93242586ac0702c322f6712cb74a12c3d5c

Download Submit
C:\Program Files (x86)\Lunar Engine 7.2\Lunarengine-x86_64-SSE4-AVX2.exe

Filesize
14.2MB

MD5
4bd55492de860dd425fe35b7f2fdc33f

SHA1
f16c62888414f46b0e5701be77b6adeff04f4407

SHA256
e70ceaecdd68a2373bf6247d318487f5688e135a6ab05729c99fd729f76a3cbb

SHA512
a1e21bfa2aa1ac77afb24b4fd4b82fe6e65d44d80846421736cec617b631c2d9f1ce86212ce234d6dc8419af29bdcfb8450104db2cdd7a7f42f6216be1907ba6

Download Submit
C:\Program Files (x86)\Lunar Engine 7.2\Tutorial-i386.exe

Filesize
2.3MB

MD5
eff330bb3036a7281998da676ca2dcdf

SHA1
c1406f3a976b71c4ceb6bc8dbc1d373d6cec76fb

SHA256
7d05ca15a568550c2ec6750862b7c03b3c05611f2ff4ba9480bae1c99ace8904

SHA512
75ef62ddd64779a3e25930d7b9af09633480c11471635b0195f7bdff085b77b7e93821c11570661c6a842ba4fdaf073bdb74484a4a8fcd09db94fe85898b1763

Download Submit
C:\Program Files (x86)\Lunar Engine 7.2\autorun\DotNetInject.lua

Filesize
6KB

MD5
6fecbdcaac54e6f9cf6b5ff07e0d47c5

SHA1
bb22202c3ecd421ae843822ec4715a72c9891f6c

SHA256
a3c0a76e8654384dc6896fc73664fdf7f2ed94e95433f34f9668e3e04cb7354e

SHA512
baea3a88281decad200641df2df5903ee326d59df54349629ac3ed75154322dafe61f8cbebdc21af2f5ac4c639a557ef34cd8a236562779c2b10d3f8b9da96a5

Download Submit
C:\Program Files (x86)\Lunar Engine 7.2\autorun\DotNetInterface.lua

Filesize
5KB

MD5
602ea720e7ce9376d736bc348f3988d2

SHA1
483699d71387b874b7e21eb0a5b3a237e10f5e82

SHA256
dfed591417fdf76524e127bfdb022fa6a32394e3a42303f896b39d441bfa6f8e

SHA512
e72bcb9483eb7b503a5a273efac6891b51e6a379920957a831b26d15e06868b65d4abaed0674c0c004d0a42005d91f2b16924765f60a3dc1ec5e505644a7c8f1

Download Submit
C:\Program Files (x86)\Lunar Engine 7.2\autorun\addtonewgroup.lua

Filesize
1KB

MD5
3e20f1013fb48a67fe59bede7b8e341b

SHA1
8c8a4cb49c3b29db2c47f84aafd0416101722bfe

SHA256
96e4429192f9ab26f8bf9f9429f36b388aa69c3624781c61ea6df7e1bca9b49b

SHA512
99cf3f88c8b06da0dbe8085dee796bec7a9533990a55fbce7524a4f941b5ecf0e8ec975a4b032eb2aaabd116c0804995a75036c98a5e4058f25d78d08a11f3f2

Download Submit
C:\Program Files (x86)\Lunar Engine 7.2\autorun\autosave.lua

Filesize
9KB

MD5
c1e85c7fe41526e18c6c88c002620604

SHA1
0efe9166821436461918fccd462ee58a6226b6e0

SHA256
8886694fa6c4ed1e177ce90f033c006d1df2848a327c91a0b777bf8787406426

SHA512
838b9dca4d1bde467f056ba0a38802362d2dc46c85d14b81713b56c0c46773a48021b4b7d3978618c9170f8dbbbaec00b6850c58b50023f21ef8096f12e40d9a

Download Submit
C:\Program Files (x86)\Lunar Engine 7.2\autorun\bigendian.lua

Filesize
7KB

MD5
e76fcd2ecd5b956d4579a676aa3eea01

SHA1
49ecba5ccc531a40ad7805a126d38b44b4a36576

SHA256
0339ba0043af5c058cf3a19de9f90312d18f6bb2728f454ef403b531bd57ae42

SHA512
8443c213d4a626a358631f76a0cc4c106543ce58c94d34a96b88574b3e32ae742f28878b259a17823ca07ec521b06e32e572e7bc77e10951bc0984b07c0571c6

Download Submit
C:\Program Files (x86)\Lunar Engine 7.2\autorun\ceshare.lua

Filesize
13KB

MD5
a22ff784e6441ea953a250b0587d8590

SHA1
8491f984e3ca22f5b97b4ffd4c471d5373284eba

SHA256
4d7a2ce9a19b784ed17bdec01923076b9f446296a6e665bc366c725cc37ae95b

SHA512
c67cb7c3906a898c7ecea1502f6652059766258b2685a27e99d52b72968afa7acc97c5285d13301690479d35150d18758881778c9bc3b0f5b8e12b2c1d7c0548

Download Submit
C:\Program Files (x86)\Lunar Engine 7.2\autorun\dotnetinfo.lua

Filesize
53KB

MD5
880fdcbd218df2aedb1eaf3be84734b7

SHA1
3a54200be38433dff112a428aa2c4f2c25ffff1c

SHA256
41df4679278eb1b39b872799eb5fd39a166eaad1ac2442ca428c91b90b21a0d5

SHA512
e2c7d3a0d3390ef516d12d653d45488e2467b7d3b9621a8ab8d5ef60a2408a16fcb2d51df20d6d79c5af279f56ac4a0be66a48d1051f6dee9378b04175756f74

Download Submit
C:\Program Files (x86)\Lunar Engine 7.2\autorun\dotnetsearch.lua

Filesize
11KB

MD5
ee8bb6ab0b341b467c918b93fe129822

SHA1
5fccccb78e5cc1780c86fbddabbb3e58629ba45d

SHA256
dea79bdbda952bbc2e0070c95c7e41d8ce5f9bdb5f18957f31c38b77c31444cb

SHA512
3fd8afcc9ef8de42e3341640c2db7a81261121f6bf0e8e7d8eb01a7a8f957360810c4f82220210978d6ff0dd2a019f528030aa4e22dcb6f50ae48df590e424b7

Download Submit
C:\Program Files (x86)\Lunar Engine 7.2\autorun\images\export128x128.png

Filesize
1KB

MD5
a9bcd80603fbcf041bc462918ca48a64

SHA1
a7908250f042b3454d8ddcb5cb20e569839be135

SHA256
3e671ac6a8e77f11b4c6547cf810bc06327e84961c7657340f5ca0f622a966d9

SHA512
ce82c8caaba0329656c26efd5f7c86a0b35a161856b975c9918fd1cd503b32b133d6f0b01dafb92aae132dd4c19f23c7349bf146123554700e05aa94320fc0af

Download Submit
C:\Program Files (x86)\Lunar Engine 7.2\autorun\images\import128x128.png

Filesize
1KB

MD5
660d8acf876ead3b985f9df515160838

SHA1
78a858326c16fa917c4a5284a606b824f025af00

SHA256
4923fbf164d8dc0111e28dc1864bac8ca2503fee2b7a688845b4616465529ee6

SHA512
81bff98bce7cc6ee066fe8e1ab1fa957e56c62084a33d879a87ca22afdf6d88012f1ecdf5dcf2493d816b96dd08073782f31f36da9bca37c53fc81ccfab1e17a

Download Submit
C:\Program Files (x86)\Lunar Engine 7.2\autorun\java.lua

Filesize
62KB

MD5
52c68829c8411f27787d66e7014457b7

SHA1
a3ede27b8474fa003d3a4a9bbf33da6465be52c0

SHA256
88444e50a8bae38982c3eec6633b3c460b3cd1140d5b622bdb4338b6b7a27968

SHA512
635b606feb524a8fec9453a8aa2e8475287a5c472a1a4c4005cd27f15589001810b62065c5a719b1bdb3cac1a59076b962df91ba7d93461f82e2e0b4b3708e48

Download Submit
C:\Program Files (x86)\Lunar Engine 7.2\autorun\javaClassEditor.lua

Filesize
52KB

MD5
96a64006f752ecd75faed81f86212f93

SHA1
1889ebb9c206866a7096f6ecd5b7cec628dcdcbe

SHA256
4f0e7249a20147fb1e364b5b182d990e6d00bf6a2624edaa368b65142dd08408

SHA512
01f01661b7c8dddc2940fb8a6e3384c5bebd1560703e510e7ec029a294aa0a49486b6948851d99c01594cbddf75295d2f38ab4c1e7760afa3e40b15151b0fb2b

Download Submit
C:\Program Files (x86)\Lunar Engine 7.2\autorun\javaclass.lua

Filesize
17KB

MD5
e4fa493cbf4f5e932dce648a78800616

SHA1
b82c12b23ae06ac07ae61b0b599f055dc879c949

SHA256
acfb9fda20c347d8b7b2e513d38d2692bd054ae90b88e846460e66b986dd8d1c

SHA512
e0c4b9b757d4f38dbdb2c5ce11fa27ee742eda97a20f098d38300c8dcf27015d5cfc8bfd658b6a7f48cfdece9645da633c32b18050598a368432f7b026826823

Download Submit
C:\Program Files (x86)\Lunar Engine 7.2\autorun\luasymbols.lua

Filesize
629B

MD5
a356e72d8a316482bbe1da9cc4f67a06

SHA1
c6af109f6b7f21f35e59954bf11c7c6e3ba9daf5

SHA256
0cc807da632d247a4935f06f16e809e7a98be1abb562633e6615538c9b099b2a

SHA512
0160a0ddc9964c260dbbfbf0ae404391399796be980a8de514aa5fbc6126f823a9654d4ace0df87152fc775e8d1c0aece0cd16d988565887466da52398913ee9

Download Submit
C:\Program Files (x86)\Lunar Engine 7.2\autorun\modulelistscan.lua

Filesize
1KB

MD5
4372daabc8b0a135a7f0831614a86e97

SHA1
79ebf71be35f6cf15c4a11323c5e11345f60e9a5

SHA256
d279c424b37293b847c7c66f46ceeda091f5b42037bf9a4b012c3ebe0c254b2e

SHA512
c24ac12cbba690b90921b13d80ae9205caccfd430911a4193247ae1002a5838f5b4a7f9e53a2fee3667b7659324e7a80f6c4c80f36bd1c328fc2af1e54a559b1

Download Submit
C:\Program Files (x86)\Lunar Engine 7.2\autorun\monoscript.lua

Filesize
116KB

MD5
3393ce7553edb17f0088e5f7f2c2d481

SHA1
af8942d05e6c2c1355bdc2958f60fc958ebe9f28

SHA256
9ceda14dc519cf75a88199686048b466823d24fddc2be33296be4662981ee509

SHA512
f25755282fed15f84a53b5c01eea730522c7290154dbde3792c2b3e2bbb9788ee9902ff637a0bd49a1ea55ef848df58bc1a4881abd45de74f0998884c842a3e4

Download Submit
C:\Program Files (x86)\Lunar Engine 7.2\autorun\patchscan.lua

Filesize
12KB

MD5
6f0fd668f948516718d9cda51b12e2e6

SHA1
cbfc00a277771d838afd8fdc41b9865109eeaa8f

SHA256
b19cbe6c64c86b292283fec429859b74f776a1bcc8c8d1929538da430441c380

SHA512
ffee9500a17d3bda6d4d993ab1a8a21d2613b792106db91e47539411c61c07552cfd57d4c86303057512b3772adb863021a5db2654e03255afaf16e1a1d97246

Download Submit
C:\Program Files (x86)\Lunar Engine 7.2\autorun\pseudocode.lua

Filesize
7KB

MD5
2be703bf1ff1ea4dd6d1eff673367e48

SHA1
13c122cfd7eb38d298fa91f3d6021f025578b508

SHA256
6704bef60f60f85e76aa19b96a43aca74c4aa8905b4033a20c24b75171b33d0a

SHA512
e1fc1c55574f5fecef535734a23db9738d4c5762e085dea721f9cd7f5f9f364dd1428f669f26149f1e49414f38a4c00bc7fd4f5e1a5c03a0e53b24c859b25c5e

Download Submit
C:\Program Files (x86)\Lunar Engine 7.2\autorun\pseudocodediagram.lua

Filesize
56KB

MD5
9aa63713ffdbd693118c12bc996f20f0

SHA1
cee5dae609fd0ca4dace8582e940d708e36b67d3

SHA256
e865d648aa7a2c9d42411abea839c490bd8fa09a5917fc7d4a71f45afe0e5949

SHA512
4147c153e95b822de662717021a76d5a3b85ff93aa4a861054421fc31c9fbe4c3a0f14aedcf6fd66373f1cf8050397c2f376a6a28c4da27cef92f0d3fb62f988

Download Submit
C:\Program Files (x86)\Lunar Engine 7.2\autorun\savesession.lua

Filesize
8KB

MD5
7c42524b407f3fbfe203221ddb7f9ecb

SHA1
1ad383e25691669ff712aab0599282c4de351dae

SHA256
7efa1b41e0b85cf026d92d3111e7ae183a00517d43f9e327c99ff1b6fe96e218

SHA512
62cd22c59f35bc1236d03fb9979b37dd7a1a070b034ee4116a9d126d6434cccc7ec6d829c60ea5719077d36fedae50d6ae584dc41f0d2fd64f0df3af13235f8a

Download Submit
C:\Program Files (x86)\Lunar Engine 7.2\autorun\versioncheck.lua

Filesize
7KB

MD5
63bcc6f7ae23663a24127f2f89aa8531

SHA1
10593aefca306740a5779f38a762918b2e068bf5

SHA256
78f4a726b511e5924cdf43f30c142a0abfd4eb51a3b82fbff7483b41190f66fd

SHA512
9a697be27fc0dc58bfe27dcc3620c10b28d8b15a6850af86797764b594f967d413c4716ee3a4af70582348b29581111651b86409c1ad4c878660e429e9a84a08

Download Submit
C:\Program Files (x86)\Lunar Engine 7.2\autorun\xml\xmlSimple.lua

Filesize
5KB

MD5
274946677cb1fb1c63a04aeb641e21d0

SHA1
b4c71b59792773f20878e3ba582331cf4ea7d592

SHA256
05258e280f53c5905ae374f808f4383cfd0898f6e620d875136edeb0fdba34f5

SHA512
aac74d0da491ac3e9465964a3861f93eacd63d2c445c1f235fed444f60f9ce19d3bf5069bd012ae72593516db96ca4a0fdfa07e83218466743551cbf1a6a64ef

Download Submit
C:\Program Files (x86)\Lunar Engine 7.2\commonmodulelist.txt

Filesize
1KB

MD5
cc0f8b66bfedc67da8dbb2a7df2aa006

SHA1
c6d86cc43a042581e389dc9a28affddf64294ac8

SHA256
cddd0f35f7351e6f19486ccd7eee5d31f0134c5c3554a12c7d51131dde8e29cd

SHA512
a4aec40ac6bea2adacf15829aeeebe66117473a542303024669a828710c6afd072c0f4890a6a334b35ac894a1a80a5bdd5e91a6ffcb7149540e304117a7e5800

Download Submit
C:\Program Files (x86)\Lunar Engine 7.2\defines.lua

Filesize
11KB

MD5
33077a49abdbfff3eb149d5c27929444

SHA1
ed3ffc77432b5b55851b9e7a1c2bb47b74b12e90

SHA256
9cae73a9cb1146308669974d685f1f8dff5d0ab1aa650fbce862da67775516f4

SHA512
bfe6c4a759fde521f0e792233abee011c877f3e9a91422bf2dfc6b96f3df9c6b612a7fed5d22b1fa96a7488633d82841425e63e0f48e43ff3a532a83204282ff

Download Submit
C:\Program Files (x86)\Lunar Engine 7.2\languages\language.ini

Filesize
283B

MD5
af5ed8f4fe5370516403ae39200f5a4f

SHA1
9299e9998a0605182683a58a5a6ab01a9b9bc037

SHA256
4aa4f0b75548d45c81d8e876e2db1c74bddfd64091f102706d729b50a7af53a5

SHA512
f070049a2fae3223861424e7fe79cbae6601c9bee6a56fadde4485ad3c597dc1f3687e720177ab28564a1faab52b6679e9315f74327d02aa1fb31e7b8233a80f

Download Submit
C:\Program Files (x86)\Lunar Engine 7.2\main.lua

Filesize
201B

MD5
62771a63fdc87764bff87d82918ab02a

SHA1
8e468ded8ced87a10470bd5594337a854ff344ba

SHA256
5c16124ba0b39214becb1af4161bd82147ad8468879a3fd8e9facc656a1d2e6f

SHA512
8d1792b712504336cac0b175146f2b7eaeda043bd3941c7b7c54cf926a4ba4835f0eff7a2ad5c7b5509f80e7420c3f5f94200d4c3f922db92b807e20e09a84d0

Download Submit
C:\Program Files (x86)\Lunar Engine 7.2\win64\dbghelp.dll

Filesize
1.4MB

MD5
893ec728b6fa9d7277963847bd408f4f

SHA1
99d461999f631457b38df82d849d81b8fad946aa

SHA256
21c398a2292f04652795c7d4ee7890bb62ac7039e58ac04ece91ff05ee0801ee

SHA512
44d6b3073e2363e0cf8a8aec7384a5a386d2a8eb21716640569a2eb00ad5dd75d1b6d159aa59cea9e60d5b4305573f206a85e54b40d2160d2d2416d2882b6a76

Download Submit
C:\Program Files (x86)\Lunar Engine 7.2\win64\sqlite3.dll

Filesize
1.3MB

MD5
c11138204609ea63a3e88b4c8c09b035

SHA1
b0829124f7e275b0f341c6af0fdd3dd5f65667a4

SHA256
60c16c2fab14b344b8343778dcd6bbfdee3dfe5f83d1ac8d2e50c6877419eee4

SHA512
28d9e92498433c1f6ec41893fc17db76d6cb7a1c565461eb6e67eebc2b924dd4aa65486c29874caa9ac5c78f804a8799c7ce1c641dd9f080bf1bf94b58ca208c

Download Submit
C:\Program Files (x86)\Lunar Engine 7.2\win64\symsrv.dll

Filesize
139KB

MD5
896ab17393ec4956d4dfded6a769bbbc

SHA1
4d32d29ff4c90c1607b4210875cbb8f91f3a4de8

SHA256
62e6e7efba96592e2e13af4c7f3ec7aaa0750f10e63984c26c7f26e11a0e528e

SHA512
96a10f0f3253f39e6424f80b0331984c1b1c380768ae67cfec96d7a1a8b862d25482aa5032ca826ee475a8d81bb8fa0f40876240c1edc2545417c75b2668455b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d7f807ad1e49013af6b43d0fbc6d31a

SHA1
34a5342f00e1eaefc0129c7b2e3fb795f881af95

SHA256
4449a557a3e4cde125c38ff36d7bd41302a8fb2a01b2fd906d0105edf30aed7e

SHA512
f713507fcc5889e9e627ad5ca7998cdb663c39a2cc98d2545b4fea5bdcd61751b4d36099db79f70e67b349d4893002de0eaea9b76adfc8aa325ba29113b06352

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
782f733666dc49cbffaf20aaa1df185a

SHA1
495b5ac9ab1474432473b659b721457a69a2aa30

SHA256
cb6d5674cfc11e7a30c86cd4a4a46713edd33eac55f118af579c62a7695b24b5

SHA512
3b27260e6bf80584aa4b69829b47acd4ca496522558cfeb8f31ebc92c338fce0152ae34064b3cd1cbd5322f6ecca7d96047790e8dfded0fdb064f509bd61b5e8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
ca264f790aca8ee5f5a4f398564505fa

SHA1
0ede3d7fb529b591e5101ec53ce1df4686b95e19

SHA256
584c30c71f88401c5a826a624007231326c8376f1748bc6292d305f3d58c1f2c

SHA512
364db9240bcde930b4d6d0c3c49b44b20e0be9f59bffffa24e57798474812bf2ed5f29b8201d09eb5181407c94126ab91ab65e0e877bc7629fe5194e2dae9c43

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
d6ec130a313354beacb2f01278c26b7a

SHA1
ddd0aa5c19e8944e3dc468972973373935149070

SHA256
25128b3f2eb65fdfbffdfc625ed91f0e852d2be13b35d5e4436a10cb433fcf9b

SHA512
c74683facdcf46055a4e78c63fa78513dc031204c3bcf5ece60571763c1632cd353f881d847f69abd85a15bc9906cb0aeec3cea7faf1c26a774dfa2eb9678a8b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
5db6dc52c6f67512c4b52e8b6189eb35

SHA1
a810823493d6469b7a5c84da47c5c678d497b3d1

SHA256
c19ca63bfd4a2046e36273eaf1411487cca3d54d65dbe2f015883ef9784fd967

SHA512
8b5fd7239b9478b61947d1285d3ba8f5252cb3419d8347907d81d165442fe57e3be0492e5c7bcfb63831423de875fe1d435a0430f03e3de4e671539940f764c5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
d432c245623b28fcf317bb737142f3e2

SHA1
530f341f70e9e60b1a7439ee029aa940d3a32c9c

SHA256
ba7efcd8f9399941f11a70ac9cc8de2fa9e6cbeeb46a91370455a7dcb75ce646

SHA512
a901c1c94d8c6e85d86b7b0aaa3f86ed20fb273a796e7fc188e2c81bda9f4d50f77739da0dae5550aeb5674d440cb9b987dbffa27ee3c329f5b2598144d978d2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
985e7be65025800b66f3c0f08c9456d9

SHA1
1b91f933238fd1126d3f2fbe6b45ca8cc9088c68

SHA256
2985ab33879121ade8566b4d238a182db0afc2770592ce793294e8e4ce546cf5

SHA512
894a25b04fe028a161434b4327b0cfcc3fbef6ca65644cc609e206c41770a76c431e081186b28b0a43cdbc08b2d873c1d30745eee778b64591a6c2ff91105e5b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
a1f72c68828c2b174a301d1fb6cffc01

SHA1
030c0274f2cec546db605bdaa3f38e28a404ef83

SHA256
47f62ccc1afee8d58c016b000731a6128c3746b6268c5629bbfeb0d9157dd561

SHA512
93ec2c9c62a77a7180eca26b8140a10b16d6af3ad87852aa2445bb48460c9a300e30290896e99958ceda9b1252ced4ecdf2d141ac5576cde145ce2225499bcd1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
a01f6cf18349ed64e8d99fa87fd6507d

SHA1
dfe245933adbe9e67c9fd22b2b3ef2c06e561423

SHA256
2fcfd7f55a11011b81da166688727145d93705dfbf276c6311cf215925cdb42c

SHA512
0276bda20da38e18e49da606e00a60b5fa2a19761a31509482114550651effdb0b7052cc6960fe41b77bf57cd6ee3a3bb9803d437c0535702a9b7a37a70e2169

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC489.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC48C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Program Files (x86)\Lunar Engine 7.2\clibs64\lfs.dll

Filesize
125KB

MD5
5e8ad34ff069b6a2e1ae00bdfe96b612

SHA1
3c83aa3ebd95d9a060ed1f06e236e046c6cd93a7

SHA256
4ee8d3375f2eeb8e5afb230d13c2cf9ee0379b0edfa76ad8dbf5ebc686a629c1

SHA512
54404199c3b5b3597dc8fb5a6e3c6772f2729045aa5c9aee648c4306358481def2bc15538899ab5e0f5e33d202cec863348830a090b144e00d1662ccf4175828

Download Submit
\Program Files (x86)\Lunar Engine 7.2\lua53-64.dll

Filesize
515KB

MD5
13100b2466570bf52c48725199c4e3c6

SHA1
166cc1d388de4d292d4cd9331ef65ee3a158a31e

SHA256
002dcb8ae68f51d54927b05e4726601640c6ddd6a063cc306640a7245b655f57

SHA512
5e916722673d431417400836e9555148b433a4f9a15e06076ec3eb1c0ba986915c4f4d6940e7f88dcbb2f9599458e14d692bcaaa56dc1e2253005ab295d8589d

Download Submit
\Users\Admin\AppData\Local\Temp\is-T95OL.tmp\LunarEngineSetup.tmp

Filesize
2.9MB

MD5
f31521b77adbdc92477145bd455cc27b

SHA1
72a14f4d08a6cc91b1e4ddf515fd32117e82a042

SHA256
ffe7da1193245df53a0706f1b32a0ea9dc849e8061866d2ab73cdd5d4b66fcbb

SHA512
79275b79e87e2aca18d07eef7ec1ba07bc579a0aa64f6ef5b350f23eeefa66d78aad1483ac0e22eb60c58f2f0997df837525d3d7d57519fbd25cfe3327326d63

Download Submit
memory/1340-9-0x0000000000400000-0x00000000006F4000-memory.dmp

Filesize
3.0MB

Download
memory/1340-425-0x0000000000400000-0x00000000006F4000-memory.dmp

Filesize
3.0MB

Download
memory/1340-12-0x0000000000400000-0x00000000006F4000-memory.dmp

Filesize
3.0MB

Download
memory/2844-426-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/2844-10-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/2844-0-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/2844-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download