303f9af07006f7e03bf9bc7f6739aaa41f634ed875056557b285b247c6b1f6a2

Analysis

user interaction
yes
max time kernel
22s
max time network
10s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 15:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lunyq.exe
Size 9.4MB
Sample261022-s3c6ra1zhy
SHA256 303f9af07006f7e03bf9bc7f6739aaa41f634ed875056557b285b247c6b1f6a2
MD5 3aac39dbd32d623e00b0cd58026400d5
SHA1 1d45250c7880c073c9d0c74492389543ad2f8fcf
SHA512 488778797f07e469034e9514757f32e33dba9c83824bf73909c56667fe0232b924a4badfa9371872afa05e58a877e4d06d7a1796bbe3e566bb37cc978b6df2d5
SSDEEP 196608:CQkDIK4FZhrHJ3H8PQhdzrb6ijlrWWWzL6:WIK4FZhjJ3H8PQH6ilrqze
TLSH
T1FAA6CF03F6A185F9C0AEC1B483469637BB36BCCD8415B25B2BE43A512E76F546F0939C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lunyq.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Kills process with taskkill 10 IoCs

defense_evasion

pid	Process
4952	taskkill.exe
2332	taskkill.exe
1300	taskkill.exe
5676	taskkill.exe
6056	taskkill.exe
1372	taskkill.exe
2680	taskkill.exe
4804	taskkill.exe
2188	taskkill.exe
4400	taskkill.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5628	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4952	taskkill.exe
Token: SeDebugPrivilege	2680	taskkill.exe
Token: SeDebugPrivilege	4804	taskkill.exe
Token: SeDebugPrivilege	2332	taskkill.exe
Token: SeDebugPrivilege	1300	taskkill.exe
Token: SeDebugPrivilege	5676	taskkill.exe
Token: SeDebugPrivilege	6056	taskkill.exe
Token: SeDebugPrivilege	2188	taskkill.exe
Token: SeDebugPrivilege	4400	taskkill.exe
Token: SeDebugPrivilege	1372	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3564	lunyq.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 5628	3564	lunyq.exe	89
PID 5628 wrote to memory of 5876	5628	msedgewebview2.exe	90
PID 5628 wrote to memory of 5308	5628	msedgewebview2.exe	91
PID 5628 wrote to memory of 5308	5628	msedgewebview2.exe	91
PID 5628 wrote to memory of 5308	5628	msedgewebview2.exe	91
PID 5628 wrote to memory of 5308	5628	msedgewebview2.exe	91
PID 5628 wrote to memory of 1388	5628	msedgewebview2.exe	92
PID 5628 wrote to memory of 2624	5628	msedgewebview2.exe	93
PID 5628 wrote to memory of 2624	5628	msedgewebview2.exe	93
PID 5628 wrote to memory of 2624	5628	msedgewebview2.exe	93
PID 5628 wrote to memory of 5636	5628	msedgewebview2.exe	94
PID 5628 wrote to memory of 5636	5628	msedgewebview2.exe	94
PID 5628 wrote to memory of 5636	5628	msedgewebview2.exe	94
PID 5628 wrote to memory of 5636	5628	msedgewebview2.exe	94
PID 5628 wrote to memory of 5636	5628	msedgewebview2.exe	94
PID 3564 wrote to memory of 4952	3564	lunyq.exe	95
PID 3564 wrote to memory of 2680	3564	lunyq.exe	98
PID 3564 wrote to memory of 4804	3564	lunyq.exe	100
PID 3564 wrote to memory of 2332	3564	lunyq.exe	102
PID 3564 wrote to memory of 1300	3564	lunyq.exe	104
PID 3564 wrote to memory of 5676	3564	lunyq.exe	106
PID 3564 wrote to memory of 6056	3564	lunyq.exe	108
PID 3564 wrote to memory of 2188	3564	lunyq.exe	110
PID 3564 wrote to memory of 4400	3564	lunyq.exe	112
PID 3564 wrote to memory of 1372	3564	lunyq.exe	114

C:\Users\Admin\AppData\Local\Temp\lunyq.exe
"C:\Users\Admin\AppData\Local\Temp\lunyq.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=lunyq.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.lunyq.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3564.408.10898717619566814053 /pfhostedapp:263e3c5308d3feced915767a4caebfef17ce301a
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5628
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.lunyq.app\EBWebView /prefetch:4 /pfhostedapp:263e3c5308d3feced915767a4caebfef17ce301a --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.lunyq.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x160,0x7ffd7cc25fd8,0x7ffd7cc25fe4,0x7ffd7cc25ff0
    3⤵
    PID:5876
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lunyq.app\EBWebView" --webview-exe-name=lunyq.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1768 --field-trial-handle=1772,i,9585995705582466663,14386862557922962683,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:263e3c5308d3feced915767a4caebfef17ce301a
    3⤵
    PID:5308
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lunyq.app\EBWebView" --webview-exe-name=lunyq.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2224 --field-trial-handle=1772,i,9585995705582466663,14386862557922962683,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:263e3c5308d3feced915767a4caebfef17ce301a
    3⤵
    PID:1388
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lunyq.app\EBWebView" --webview-exe-name=lunyq.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2284 --field-trial-handle=1772,i,9585995705582466663,14386862557922962683,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:263e3c5308d3feced915767a4caebfef17ce301a
    3⤵
    PID:2624
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lunyq.app\EBWebView" --webview-exe-name=lunyq.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3348 --field-trial-handle=1772,i,9585995705582466663,14386862557922962683,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:263e3c5308d3feced915767a4caebfef17ce301a /prefetch:1
    3⤵
    PID:5636
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /im "Lunar Client.exe" /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4952
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /im "Lunar Client.exe" /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2680
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /im "Lunar Client.exe" /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4804
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /im "Lunar Client.exe" /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2332
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /im "Lunar Client.exe" /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1300
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /im "Lunar Client.exe" /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5676
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /im "Lunar Client.exe" /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6056
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /im "Lunar Client.exe" /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2188
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /im "Lunar Client.exe" /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4400
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /im "Lunar Client.exe" /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

agent.jar

Path C:\Users\Admin\.lunarclient\agents\agent.jar
Size 4.9MB
SHA256 f437790d9f8be697d7767bd4bcc1b7513aa2e7eb7782dc5ea2f0fa20a6e04ea2
MD5 3f169b79a0c711221928eaea3e362d4d
SHA1 967959777bec487924c9b2e1862eda0986c96e0a
SHA512 c3e7e917383e5a61288a47289caafa200c51b479a7920ef99c364a3e71808e0879aad57855825663a2f9018583491749aec773d07520f1628a90b01b8723c1aa
SSDEEP 98304:SfQ4FZh8yY7eJPPHWdniEPQsOCCJlTHrb6ILjlrWW3CCmypL:74FZhrHJ3H8PQhdzrb6ijlrWWWM
TLSH
T1F836F152B9C1DD3AD8B365B215804437BA7F17DEE4099012A8B469D228F7E8DDF223DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57815c78-361d-443b-8c3e-5b1f134602ae.tmp

Path C:\Users\Admin\AppData\Local\com.lunyq.app\EBWebView\57815c78-361d-443b-8c3e-5b1f134602ae.tmp
Size 3KB
SHA256 946b3280e5894ab769deacbe1b7a0316e2b948b8c22900c85e8086a2e1c82d79
MD5 0053a70056abe413f741d5a97f9e098f
SHA1 75ec8a1c4d4c56bdd24f7f10ef07d8f747d2a45c
SHA512 322da227d444e9b524b407e8983c911731f002a08598b9a11c790ee6f8fea4702fb801880ced3bde121381da945506ea23219afab2cb551bfc0a03d0104368ce
TLSH
T17B61B4776974A9378EF6DA04B9872B26E7B59127E6913F95C6EC0F0C01E72980342C27
MD5 SHA1 SHA512 TLSH

Submit Download

7fa22023-b164-478a-8176-0ec16d4126f2.tmp

Path C:\Users\Admin\AppData\Local\com.lunyq.app\EBWebView\7fa22023-b164-478a-8176-0ec16d4126f2.tmp
Size 15KB
SHA256 2bbaa0cc06f39a68be974cab7c38fbf335bb29f9e2af4877a02c044c43f6626f
MD5 a5bb18a19649caac9dc5e6d5aaff8e2d
SHA1 c067eff1a24459d80d190504f71f478878b82d82
SHA512 6b54082027db8efb306f51009d31eea819da1d9f639042c0b5c9ae11832df41ad8ba9618543ad4843164308a307de98f93cf154fe15ffced64cb9cceae86ff56
SSDEEP 384:R+OBqImmJvGBLx3NaFMJFNNBS8J1NMrRg6ra:ccvGtlNJ4rzW
TLSH
T1D472BEAB19756A636CFFC509BA8A3757CB79A243C0D17AD5CCEC4F0F11AB0901362852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.lunyq.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2ef26ad988b31ad00b54388673aa111d234ba75c4b59307dcf169e707b1c0075
MD5 6fc1fac8980156f085394b7cd549c1ef
SHA1 e4c239f9dfd6a1eb4d7b3d7f83916a62e6546872
SHA512 f9c78c8e9e2e3d3c371bd753c88c0ef316beb9d3631380dd2e662ab4831cf6dff8eb2b2df7becd17730a49710dc427337c8236f6fd39a1c7cdb758908bc028e9
TLSH
T16ED0122276120534C41034331802A5090400D11BC027401064298B2D1E484D51912441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.lunyq.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 aec17b42975e5a25f0d94b5cb000b8eed61af8275dbd2dd301ec1537b0462d29
MD5 9f67d002ee309a34bafb967a0cc1e1c9
SHA1 e0b462a6c95b62a82d8fb54406ad823bdedd3006
SHA512 52c6f8bc5e2696cfeaced7b9ffa77c947b2225873dfdbc4cc127e2ad1ef22bbaa2a5d251c7699aaa55ab793c15c4a231e51e650d9314844adbfae1ff5a582320
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.lunyq.app\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.lunyq.app\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 8e62a71aa47a7ed751c6e4786eee13b4fe2ae54ca117c5fe9596dada1a70e8e0
MD5 485c91950d1716e0addf1c527828be22
SHA1 413d852978edbf61a428ffbfc7dd1ce46f3c5fb8
SHA512 eb6853f339385974ebb9e487607279102a3d99c0b4c8dd54fc83ba1582a2868aabb027aa08eb7624338d9d8c019434d2d7411659ff8f68fe4338298aec1f3665
TLSH
T179A0023001401007C101237212C21BAE7A348821020367A5C7D281B9DDD1B404245176
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.lunyq.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 2bed7d85d447c5d81ff76604e2e7b3d47c09626129851b75253fbc4e5098100a
MD5 2acd85388fc58fec57a9773e859be2ad
SHA1 e0a288ea6e4bee34860d3bde98a87af20cbf1e73
SHA512 6f4d656b9022dff5d30fd175de533658ad99484b74fbd4308a5121b5a0f2bc9e81829f7ce1c23eb86bd7f28cb3bb5cd8c6c7ed0e5686252e529a03103645d6ee
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.lunyq.app\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.lunyq.app\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.lunyq.app\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.lunyq.app\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.lunyq.app\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.lunyq.app\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.lunyq.app\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.lunyq.app\EBWebView\Local State
Size 1KB
SHA256 333dedbf0c8cccc4a89bbb8c193fa09912acac561765dfe00a97b87a58a179ea
MD5 de4e0ec35bce34e5f7d735abdf1dbe3a
SHA1 3fcd56d798cc822da9b6ba54aed7002e259794c3
SHA512 facc515c5ea0bb9e6582e41a17984b30d48183b2f481479726e036de16aa9163a3f5a29a77f9c831b42d858016e6326fcecb081c891f17cf23a4eb0fc196c5f1
TLSH
T1652162F3A5745B33DDE5A24A3163AA639E31A16F93104E0091DE0B1D06E719DC61AC33
MD5 SHA1 SHA512 TLSH

Submit Download

c345e6d4-af6c-4ca9-b1c4-f61ac91b04d7.tmp

Path C:\Users\Admin\AppData\Local\com.lunyq.app\EBWebView\c345e6d4-af6c-4ca9-b1c4-f61ac91b04d7.tmp
Size 2KB
SHA256 d990f23644c50a4090999c75a5650e7134eefd08d416d3a7758a1ce2254d7d8c
MD5 ba257fe7551389ce66223359c1f66c48
SHA1 f7b49382132efc05c85a9a2e2c914ddba408b10e
SHA512 4c9deaf3c1998995a2fb5031f764b55f445aa880e3848284ac1cce2e05c7a31fab8525d25cc1b8f24920495e3523a89c5efa27a674e0a38b439473dcaa45f094
TLSH
T1F85195737824A637CEF6D60879972F23CA75A166AB512F50D6DD0B1C01E715D5302C37
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\lunyq\config.json
Size 389B
SHA256 ed844901060dbc52752ac0ecea6db4a82889b2e3c79be6f10d2dc66e2492ddcb
MD5 479e6626441eaa6e5d9b7c0ba4082ab9
SHA1 4dc9b298a42b7f64c1a3bbcd6bfd5501a20e0de4
SHA512 8b669fa0a7ac6c7068dee191c95390abc4a21ac0d68b25379b2723c709f5293efc6849c577820eca594c0571723a0c4b89687eee28c1bb0f7e1118d816898449
TLSH
T15CE0EE20C85824F802E5C87ED83EC037138ACC22020A3A38E5478A08A20DB3661F1EEB
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5308-198-0x00000157CC830000-0x00000157CC946000-memory.dmp

Download

memory/5308-27-0x00007FFD9EF80000-0x00007FFD9EF81000-memory.dmp

Download

memory/5636-219-0x00000213C8C90000-0x00000213C8DA6000-memory.dmp

Download

memory/5636-65-0x00007FFD9EF80000-0x00007FFD9EF81000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads