URL:

https://tmpfiles.org/dl/26507390/luna.exe

Full analysis: https://app.any.run/tasks/6fdc4239-fd54-4222-89cf-199dd40d6e9b
Verdict: Malicious activity
Analysis date: April 29, 2025, 07:42:11
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
possible-phishing
github
crypto-regex
golang
Indicators:
MD5:

68CF00F29F4E69499A68DAA70FAFFB05

SHA1:

2DA63041227DF25405DE2528DC80BF44037D45B5

SHA256:

A5E729778EC61416B1D8D9247168DE5D8438C8B31EBC83E46113076786F6BD64

SSDEEP:

3:N8ALCjw0C:2ALC00C

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the login/logoff helper path in the registry

      • LunaUI.exe (PID: 1072)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 5084)
      • cmd.exe (PID: 920)

    • Changes the AppInit_DLLs value (autorun option)

      • LunaUI.exe (PID: 1072)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • luna.exe (PID: 6268)
      • MicrosoftEdgeWebview2Setup.exe (PID: 3268)
      • LunaUI.exe (PID: 1072)
      • Luna.exe (PID: 900)
      • Luna.exe (PID: 6184)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7744)

    • Possible Social Engineering Attempted

      • msedge.exe (PID: 7296)

    • Reads security settings of Internet Explorer

      • luna.exe (PID: 6268)
      • LunaUI.exe (PID: 6676)
      • LunaUI.exe (PID: 1072)
      • MicrosoftEdgeUpdate.exe (PID: 6228)

    • Adds/modifies Windows certificates

      • Luna.exe (PID: 1096)

    • Application launched itself

      • Luna.exe (PID: 1096)
      • LunaUI.exe (PID: 6676)
      • Luna.exe (PID: 7904)

    • Reads the date of Windows installation

      • LunaUI.exe (PID: 6676)
      • LunaUI.exe (PID: 1072)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeWebview2Setup.exe (PID: 3268)
      • MicrosoftEdgeUpdate.exe (PID: 6228)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7744)
      • MicrosoftEdgeUpdate.exe (PID: 6564)

    • Process drops legitimate windows executable

      • MicrosoftEdgeWebview2Setup.exe (PID: 3268)
      • Luna.exe (PID: 900)
      • MicrosoftEdgeUpdate.exe (PID: 6228)
      • Luna.exe (PID: 6184)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7744)
      • MicrosoftEdgeUpdate.exe (PID: 6564)

    • Starts itself from another location

      • LunaUI.exe (PID: 1072)

    • Disables SEHOP

      • MicrosoftEdgeUpdate.exe (PID: 6228)

    • Starts CMD.EXE for commands execution

      • LunaUI.exe (PID: 1072)
      • LunaUI.exe (PID: 5600)

    • Contacting a server suspected of hosting an CnC

      • LunaRuntime.exe (PID: 5408)

    • Found regular expressions for crypto-addresses (YARA)

      • Luna.exe (PID: 1096)

    • Connects to unusual port

      • LunaRuntime.exe (PID: 5408)
      • LunaRuntime.exe (PID: 2148)

    • The process executes via Task Scheduler

      • LunaRuntime.exe (PID: 5392)
      • LunaRuntime.exe (PID: 5416)
      • LunaRuntime.exe (PID: 2148)

  • INFO

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 2136)
      • msedge.exe (PID: 7296)
      • msedge.exe (PID: 4112)

    • Checks supported languages

      • identity_helper.exe (PID: 4172)
      • luna.exe (PID: 6268)
      • LunaUI.exe (PID: 6676)
      • Luna.exe (PID: 900)
      • Luna.exe (PID: 1096)
      • LunaUI.exe (PID: 1072)
      • MicrosoftEdgeWebview2Setup.exe (PID: 3268)
      • MicrosoftEdgeUpdate.exe (PID: 6228)
      • LunaRuntime.exe (PID: 5408)

    • Application launched itself

      • msedge.exe (PID: 2136)

    • Reads the computer name

      • identity_helper.exe (PID: 4172)
      • luna.exe (PID: 6268)
      • Luna.exe (PID: 900)
      • LunaUI.exe (PID: 6676)
      • Luna.exe (PID: 1096)
      • LunaUI.exe (PID: 1072)
      • MicrosoftEdgeUpdate.exe (PID: 6228)
      • LunaRuntime.exe (PID: 5408)

    • Create files in a temporary directory

      • luna.exe (PID: 6268)
      • Luna.exe (PID: 900)

    • Reads Environment values

      • identity_helper.exe (PID: 4172)
      • Luna.exe (PID: 900)
      • Luna.exe (PID: 1096)
      • MicrosoftEdgeUpdate.exe (PID: 6228)
      • LunaRuntime.exe (PID: 5408)

    • Process checks computer location settings

      • luna.exe (PID: 6268)
      • LunaUI.exe (PID: 6676)
      • LunaUI.exe (PID: 1072)
      • MicrosoftEdgeUpdate.exe (PID: 6228)

    • Reads the machine GUID from the registry

      • LunaUI.exe (PID: 6676)
      • Luna.exe (PID: 900)
      • Luna.exe (PID: 1096)
      • LunaUI.exe (PID: 1072)
      • LunaRuntime.exe (PID: 5408)

    • Reads the software policy settings

      • Luna.exe (PID: 900)
      • Luna.exe (PID: 1096)
      • MicrosoftEdgeUpdate.exe (PID: 6228)
      • LunaRuntime.exe (PID: 5408)

    • Creates files in the program directory

      • MicrosoftEdgeWebview2Setup.exe (PID: 3268)
      • LunaUI.exe (PID: 1072)

    • The sample compiled with english language support

      • Luna.exe (PID: 900)
      • MicrosoftEdgeWebview2Setup.exe (PID: 3268)
      • MicrosoftEdgeUpdate.exe (PID: 6228)
      • Luna.exe (PID: 6184)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7744)
      • MicrosoftEdgeUpdate.exe (PID: 6564)
      • msedge.exe (PID: 4112)

    • Application based on Golang

      • Luna.exe (PID: 1096)

    • Checks proxy server information

      • MicrosoftEdgeUpdate.exe (PID: 6228)

    • Detects GO elliptic curve encryption (YARA)

      • Luna.exe (PID: 1096)

    • Manual execution by a user

      • luna.exe (PID: 8048)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
224
Monitored processes
85
Malicious processes
9
Suspicious processes
3

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs sppextcomobj.exe no specs slui.exe msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs luna.exe lunaui.exe no specs luna.exe no specs luna.exe luna.exe lunaui.exe microsoftedgewebview2setup.exe microsoftedgeupdate.exe cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs lunaruntime.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs svchost.exe wermgr.exe lunaruntime.exe no specs rundll32.exe no specs luna.exe no specs lunaui.exe no specs luna.exe no specs luna.exe luna.exe cmd.exe no specs conhost.exe no specs schtasks.exe no specs lunaruntime.exe no specs msedge.exe no specs microsoftedgewebview2setup.exe msedge.exe no specs microsoftedgeupdate.exe slui.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs lunaruntime.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
632"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3528 --field-trial-handle=2372,i,9608517504821167458,14381894324494794578,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
672schtasks /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "C:\Program Files\CrashReports\robloxcrashhandler.exe" /RL HIGHEST C:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
672"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3512 --field-trial-handle=2372,i,9608517504821167458,14381894324494794578,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
744"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.3636 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3520 --field-trial-handle=2372,i,9608517504821167458,14381894324494794578,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
900C:\Users\admin\AppData\Local\Temp\Luna.exeC:\Users\admin\AppData\Local\Temp\Luna.exe
Luna.exe
User:
admin
Company:
Luna
Integrity Level:
HIGH
Description:
Luna
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\luna.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\powrprof.dll
920"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "C:\Program Files\CrashReports\robloxcrashhandler.exe" /RL HIGHEST & exitC:\Windows\System32\cmd.exe—LunaUI.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
924"CMD" /c schtasks /run /i /tn "Microsoft\Windows\WAppCrashNvTew"C:\Windows\System32\cmd.exe—LunaUI.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1072"C:\Users\admin\AppData\Local\Temp\LunaUI.exe" C:\Users\admin\AppData\Local\Temp\LunaUI.exe
LunaUI.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\lunaui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1096"C:\Users\admin\AppData\Local\Temp\Luna.exe" C:\Users\admin\AppData\Local\Temp\Luna.exe
luna.exe
User:
admin
Company:
Luna
Integrity Level:
HIGH
Description:
Luna
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\luna.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\powrprof.dll
1676"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --mojo-platform-channel-handle=4600 --field-trial-handle=2372,i,9608517504821167458,14381894324494794578,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
34 666
Read events
34 592
Write events
67
Delete events
7

Modification events

(PID) Process:(2136) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\197458
Operation:writeName:WindowTabManagerFileMappingId
Value:
{F4C1D95F-B316-410E-B4FD-823A720685EC}
(PID) Process:(2136) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
134766397C922F00
(PID) Process:(2136) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MicrosoftEdgeAutoLaunch_29EBC4579851B72EE312C449CF839B1A
Value:
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
(PID) Process:(2136) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\Clients\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\Commands\on-logon-autolaunch
Operation:writeName:Enabled
Value:
0
(PID) Process:(2136) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2136) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(2136) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(2136) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(2136) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
AE4917397C922F00
(PID) Process:(2136) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
8D7B22397C922F00
Executable files
325
Suspicious files
370
Text files
79
Unknown types
0

Dropped files

PID
Process
Filename
Type
2136msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF10c110.TMP —
MD5:—
SHA256:—
2136msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
2136msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF10c110.TMP —
MD5:—
SHA256:—
2136msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
2136msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF10c110.TMP —
MD5:—
SHA256:—
2136msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF10c110.TMP —
MD5:—
SHA256:—
2136msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
2136msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
2136msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF10c14e.TMP —
MD5:—
SHA256:—
2136msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
52
TCP/UDP connections
74
DNS requests
73
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.164.9:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
864
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
864
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5744
wermgr.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5744
wermgr.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5116
svchost.exe
HEAD
200
23.48.23.7:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/5cbc98ff-b69b-4fda-ad94-17ec2f9cf48b?P1=1746409785&P2=404&P3=2&P4=cFyTRtCJ1pjZtDHq8F%2bmHXYyEvaGSd%2f7Z90fA00v%2bWrucZIblNhPrJs1jF6EwtxgK3pozyDvqWnD1DWN5rscug%3d%3d
unknown
—
—
whitelisted
5116
svchost.exe
GET
206
23.48.23.7:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/5cbc98ff-b69b-4fda-ad94-17ec2f9cf48b?P1=1746409785&P2=404&P3=2&P4=cFyTRtCJ1pjZtDHq8F%2bmHXYyEvaGSd%2f7Z90fA00v%2bWrucZIblNhPrJs1jF6EwtxgK3pozyDvqWnD1DWN5rscug%3d%3d
unknown
—
—
whitelisted
5116
svchost.exe
GET
206
23.48.23.7:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/5cbc98ff-b69b-4fda-ad94-17ec2f9cf48b?P1=1746409785&P2=404&P3=2&P4=cFyTRtCJ1pjZtDHq8F%2bmHXYyEvaGSd%2f7Z90fA00v%2bWrucZIblNhPrJs1jF6EwtxgK3pozyDvqWnD1DWN5rscug%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.16.164.9:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7296
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7296
msedge.exe
150.171.28.11:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7296
msedge.exe
104.21.21.16:443
tmpfiles.org
—
—
suspicious
7296
msedge.exe
13.107.6.158:443
business.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7296
msedge.exe
13.107.253.45:443
edge-mobile-static.azureedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.174
whitelisted
crl.microsoft.com
  • 2.16.164.9
  • 2.16.164.106
  • 2.16.164.72
  • 2.16.164.49
  • 2.16.164.120
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 2.23.246.101
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 150.171.28.11
  • 150.171.27.11
  • 150.171.30.11
  • 150.171.29.11
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.253.45
whitelisted
tmpfiles.org
  • 104.21.21.16
  • 172.67.195.247
unknown
business.bing.com
  • 13.107.6.158
whitelisted
bzib.nelreports.net
  • 2.16.168.113
  • 2.16.168.107
whitelisted

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO Temporary File Hosting Domain in DNS Lookup (tmpfiles .org)
—
—
Possible Social Engineering Attempted
SUSPICIOUS [ANY.RUN] Domain Marked as Malicious (tmpfiles .org)
—
—
Misc activity
ET INFO Temporary File Hosting Domain in DNS Lookup (tmpfiles .org)
—
—
Possible Social Engineering Attempted
SUSPICIOUS [ANY.RUN] Domain Marked as Malicious (tmpfiles .org)
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
—
—
Misc activity
ET TA_ABUSED_SERVICES Tunneling Service in DNS Lookup (* .ply .gg)
—
—
A Network Trojan was detected
MALWARE [ANY.RUN] Suspected domain Associated with Malware Distribution (.ply .gg)
—
—
Potentially Bad Traffic
ET INFO playit .gg Tunneling Domain in DNS Lookup
—
—
Domain Observed Used for C2 Detected
ET MALWARE Generic AsyncRAT/zgRAT Style SSL Cert
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://tmpfiles.org/dl/26507390/luna.exe