deeaf5f60bba6d1ca9c1f1802a5a07851efd3edede2fdba9930449517eb7fb7c

Analysis

max time kernel
86s
max time network
92s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 06:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Luna (1).exe
Size 9.5MB
Sample260808-g3pc8saq6t
SHA256 deeaf5f60bba6d1ca9c1f1802a5a07851efd3edede2fdba9930449517eb7fb7c
MD5 84741e7b136f40c4cb3ee031c2fe93f7
SHA1 06c34dc2148ae26741ee67e6fd3383c7867d315c
SHA512 6b64f43e38f3f5e9c4966f4d17f8e255425ae926f5257c5fec7e522d543aa67ca37d674a9f0d99401d67cff842db74ceada0b1d01616c5e203399e04650f81a8
SSDEEP 196608:keltmbDts0938472MpK4i3mtziM7jnZec7QJjvyMMX2ZRrM73S4BK91Xs:k1R7pK4i20+RMjtMXcJ4qX
TLSH
T18DA63316C91227A8E831A97609D60C1E33E787C49D4D97DFD912587BBB72002D3E7B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan upx

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Luna (1).exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3168-0-0x00007FF774300000-0x00007FF778C17000-memory.dmp	upx
behavioral2/memory/3168-167-0x00007FF774300000-0x00007FF778C17000-memory.dmp	upx
behavioral2/memory/3168-187-0x00007FF774300000-0x00007FF778C17000-memory.dmp	upx
behavioral2/memory/3168-199-0x00007FF774300000-0x00007FF778C17000-memory.dmp	upx
behavioral2/memory/3168-209-0x00007FF774300000-0x00007FF778C17000-memory.dmp	upx
behavioral2/memory/3168-219-0x00007FF774300000-0x00007FF778C17000-memory.dmp	upx
behavioral2/memory/3168-221-0x00007FF774300000-0x00007FF778C17000-memory.dmp	upx
behavioral2/memory/3168-223-0x00007FF774300000-0x00007FF778C17000-memory.dmp	upx
behavioral2/memory/3168-249-0x00007FF774300000-0x00007FF778C17000-memory.dmp	upx

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe
3168	Luna (1).exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4552	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3168	Luna (1).exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 4552	3168	Luna (1).exe	89
PID 4552 wrote to memory of 4308	4552	msedgewebview2.exe	90
PID 4552 wrote to memory of 4380	4552	msedgewebview2.exe	91
PID 4552 wrote to memory of 4380	4552	msedgewebview2.exe	91
PID 4552 wrote to memory of 4380	4552	msedgewebview2.exe	91
PID 4552 wrote to memory of 4380	4552	msedgewebview2.exe	91
PID 4552 wrote to memory of 5936	4552	msedgewebview2.exe	92
PID 4552 wrote to memory of 1228	4552	msedgewebview2.exe	93
PID 4552 wrote to memory of 1228	4552	msedgewebview2.exe	93
PID 4552 wrote to memory of 1228	4552	msedgewebview2.exe	93
PID 4552 wrote to memory of 3812	4552	msedgewebview2.exe	94
PID 4552 wrote to memory of 3812	4552	msedgewebview2.exe	94
PID 4552 wrote to memory of 3812	4552	msedgewebview2.exe	94
PID 4552 wrote to memory of 3812	4552	msedgewebview2.exe	94
PID 4552 wrote to memory of 3812	4552	msedgewebview2.exe	94

C:\Users\Admin\AppData\Local\Temp\Luna (1).exe
"C:\Users\Admin\AppData\Local\Temp\Luna (1).exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="Luna (1).exe" --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Luna (1).exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=3168.1748.8309467513071544377 /pfhostedapp:d6c698cba425c5fbc35c0d8325faca101f888ff1
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Luna (1).exe\EBWebView" /prefetch:4 /pfhostedapp:d6c698cba425c5fbc35c0d8325faca101f888ff1 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Luna (1).exe\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffd09975fd8,0x7ffd09975fe4,0x7ffd09975ff0
    3⤵
    PID:4308
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Luna (1).exe\EBWebView" --webview-exe-name="Luna (1).exe" --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1784 --field-trial-handle=1788,i,13197146631748628967,429436935628171435,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:d6c698cba425c5fbc35c0d8325faca101f888ff1
    3⤵
    PID:4380
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Luna (1).exe\EBWebView" --webview-exe-name="Luna (1).exe" --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2148 --field-trial-handle=1788,i,13197146631748628967,429436935628171435,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:d6c698cba425c5fbc35c0d8325faca101f888ff1
    3⤵
    PID:5936
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Luna (1).exe\EBWebView" --webview-exe-name="Luna (1).exe" --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2360 --field-trial-handle=1788,i,13197146631748628967,429436935628171435,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:d6c698cba425c5fbc35c0d8325faca101f888ff1
    3⤵
    PID:1228
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Luna (1).exe\EBWebView" --webview-exe-name="Luna (1).exe" --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3528 --field-trial-handle=1788,i,13197146631748628967,429436935628171435,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:d6c698cba425c5fbc35c0d8325faca101f888ff1 /prefetch:1
    3⤵
    PID:3812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3a0d4bf4-bf94-4db7-9e98-c94b1b70366f.tmp

Path C:\Users\Admin\AppData\Roaming\Luna (1).exe\EBWebView\3a0d4bf4-bf94-4db7-9e98-c94b1b70366f.tmp
Size 2KB
SHA256 e013254bbc28e720d5a163fd9273e6c48dfe6a73ae9d00f626a601128427a18b
MD5 d92ff6a39875ef73927ac60296595a77
SHA1 c8dd48a35e5ea87aecb5e11bba51899801aeb682
SHA512 c0f087f9a25b91914d09a30f4e0fbd2bb4360e9dc3110ca5efe387dc9c772f8b524ddda8177235a20ad7bcf5f7b49d87233218f99c91a7600b1ebc34621f8627
TLSH
T137518733BC20A7778AA38604795B3F27DE35819696523F61DADC1B0C11DB15C1342C3B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Luna (1).exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1047653088dac946c63da1351c9c03fd9ccbb23e2789b310d564212005ef8677
MD5 abcc475b0a48539ddb271158e816e864
SHA1 84e8729f077f1d516af67fd19caa6f6422e95c5a
SHA512 4df42def944c4e5b5185e39baa73befcb0252d1541a1ed028c826c163547710cff9de28b35f62a9553a490143744dd039f1c2c691e8f723ec1861056a437d07f
TLSH
T1DED0122332418938D0102833001262490800C50FC0064004982DDD1D5A444540903451
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Luna (1).exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1345e3dd662fa2a05f0c518b20d3ca12b7980b2cb7a6d95f7c01258923c49324
MD5 d327bdfa21b8812e059dca7aed4182cc
SHA1 5bad38dcb5818629ffe96dbf9afca69276bf97f6
SHA512 6c1825f30d71db0d580ddc390e885e232d7a2377e02a539cdd967856e6282eea4f4eb0f3633db84b41e20719bd8722e17788b105ae29582e7a96a95ae54542dd
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\Luna (1).exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

26e2d49b-7608-4e00-af5d-045af9686867.tmp

Path C:\Users\Admin\AppData\Roaming\Luna (1).exe\EBWebView\Default\26e2d49b-7608-4e00-af5d-045af9686867.tmp
Size 6KB
SHA256 f946695ae45db9d47409c4b9e27689409eb9cbdf7507a435d28eb1d942e908cb
MD5 815ba2656cfbf3bfdf942390edf32966
SHA1 ceec9092bee486974b265416763e0dc5dd51ee4d
SHA512 8f69d52246c897667519d7a3c5ec0e250bbb25baa60edcf61d2bdfa2c59dfbfb28834a3276b09049dac55b0c501328649afee0cf96e6866953afa76f9aa4683c
SSDEEP 96:stiXd1/+3b9FkYo5h16Z5nUCs7/x+6MhmuecSlI11eje1K+gjmg128XM1C7K:stGvetoKnhsV+F2+1QjHgg1G6K
TLSH
T130D1B6115E28797B4CC6F509BA39BB03E2F5647271D52E58EBF8462C18EB6DC630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Luna (1).exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 f5a904a42f80ce657d91796de72e64af47e655cec0a5bde4002a53d2e1da4481
MD5 1f3063e1ba34a7118d544bc4679c998e
SHA1 0ec239bc5220964d760a1e6100d2369a13087939
SHA512 5234722e059d000948e0086b1fb50c3386ad47545a47aa3892f6ada67fe35a1bc75762b92d2c00946d08326e3f80c4979a5689de4f60bbfe256e06ff1b3a4c80
TLSH
T1D1A0022042815663CD46937211C342483334AC144B170B05C1F065B4C851740414250D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59bde7.TMP

Path C:\Users\Admin\AppData\Roaming\Luna (1).exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59bde7.TMP
Size 48B
SHA256 dcf77da11df434b04c8ff2ff2be5b8bb8866ebe34658b3f786a334e4935192f7
MD5 930a2ff196a302c1bb3d0b016c9b24db
SHA1 6ad2d4b4d6661f87aab50584111ec5944f5fb017
SHA512 b21e43fc505015c05843bb6f9e5bd0d527d79706ce18f95373a074b8072f407b7a2a9a7269219ad95b3545d190cb4b705293b049661cff7ef9fecbe56b66cdc1
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Luna (1).exe\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 5449e777fb89e4fecc0d875fe29428a0910bacc7519e1acb32eeb3b8c8c25a45
MD5 6523d35455ab315b9b33196cf7704ab0
SHA1 a92f208827b133032f4184e60375c18809a7b81a
SHA512 90b1f9506d1afc911616d93dd0e58d79410981923db545b00aa4675442cf728b5a148dce7542c3e09e10a0ec267bec8ef22e7114ea9b77f128e40d9c459f6da8
TLSH
T140214DB2C3E4CA3D884162E427247917CD2D051952282A37CDD6FBFA5FE2472DB10A4E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a7fc0.TMP

Path C:\Users\Admin\AppData\Roaming\Luna (1).exe\EBWebView\Default\Network\Network Persistent State~RFe5a7fc0.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\Luna (1).exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\Luna (1).exe\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\Luna (1).exe\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Luna (1).exe\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Luna (1).exe\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Luna (1).exe\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Luna (1).exe\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Luna (1).exe\EBWebView\Local State
Size 3KB
SHA256 2945b41d9472fa00f1c251883436be53d5687b3324e3c9bba8b968307c07cf4b
MD5 7751c8c9e75e35c88b08db1a6dfee4aa
SHA1 26432a8def566960b346f1588ba53247356bfb17
SHA512 ba18c977141e0c84c3bf8a983269a8a932375c346e92a291fc30b8c1d434ca1d6e49ec253dfafb32cf4d859c21feb56d985210db480bed177c6437274e62bc01
TLSH
T1AF717536B874AA7B4EE3D505B9863B06FAA58167D5853FA5C6EC0F0C12D729C134281B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Luna (1).exe\EBWebView\Local State
Size 15KB
SHA256 97dea4a76fad8133f385c6a1cb3e04a877c4a1292421446d5b31a198de300b50
MD5 390c044978cc7af6fd409dfa99179aa2
SHA1 3582c0c691e78884798e3f0ce624a0add39c5155
SHA512 d5cc909ed557131abe11622d9632e07d9d82d467b38126185db94909d20f3f6253ab62eaf25a4ecdad862a408e5fb8e7353a6ba4fc998751f86a53036fa46b89
SSDEEP 384:X+aQikB+z/xvxjg/qhEhNBS4lYZ4AZ8AVdprP9zC:m/UxvxjgC+gj8UTFC
TLSH
T14D72AF37A8357E3795F7EA05795D0B8BDBB888B290C13EB44AE95F0D07C72981342816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Luna (1).exe\EBWebView\Local State
Size 3KB
SHA256 ecc49fba509e9b11a19aa7b191cff333ecf5b4a046026ceae6db1554edac84ef
MD5 a64b12c20fe8d919fa330f02e82151d1
SHA1 4026ff6ebcab1b1f465a95b3706a2f219a137663
SHA512 7dd2898a79aa63bcd527538658a455e16fdf764e15e3013a01cc5d92924312f512836af6f78b988fec88886091126dc5c83c6554acb781612380d4569838b284
TLSH
T1E4616437BD70A6374EA3CA0578862B16FB654167E5853FA5C6EC1F0C11D729C1342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5967c8.TMP

Path C:\Users\Admin\AppData\Roaming\Luna (1).exe\EBWebView\Local State~RFe5967c8.TMP
Size 1KB
SHA256 4523d4b46ef49307b1aca882d49438b9a12ab1888fc9d78c1fa46ab1a506f709
MD5 f9cd1fb4baa4ebe2cf5cb6e71a38f7ba
SHA1 7816e5eb7b338a1c6cbde037b3705ed96e303e0a
SHA512 d5fcc0d76ae980d6d106c29f0418f75d771c482a903d619adfde894616e9db4b427568760f5e1acf1a86ac28cac1b0d533d4d12fb33d9452f5a1348b2f6447f8
TLSH
T1962184B3FC7057739E969246205B6B6BAE3142EBC2401F10D1CD071C13D705C9627836
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3168-187-0x00007FF774300000-0x00007FF778C17000-memory.dmp

Download

memory/3168-199-0x00007FF774300000-0x00007FF778C17000-memory.dmp

Download

memory/3168-167-0x00007FF774300000-0x00007FF778C17000-memory.dmp

Download

memory/3168-209-0x00007FF774300000-0x00007FF778C17000-memory.dmp

Download

memory/3168-0-0x00007FF774300000-0x00007FF778C17000-memory.dmp

Download

memory/3168-219-0x00007FF774300000-0x00007FF778C17000-memory.dmp

Download

memory/3168-221-0x00007FF774300000-0x00007FF778C17000-memory.dmp

Download

memory/3168-223-0x00007FF774300000-0x00007FF778C17000-memory.dmp

Download

memory/3168-249-0x00007FF774300000-0x00007FF778C17000-memory.dmp

Download

memory/3812-104-0x00007FFD2AD60000-0x00007FFD2AD61000-memory.dmp

Download

memory/4380-180-0x00000235A3560000-0x00000235A3723000-memory.dmp

Download

memory/4380-40-0x00007FFD2AD60000-0x00007FFD2AD61000-memory.dmp

Download