Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
7Lunar Clie...er.exe
windows11-21h2-x64
4$PLUGINSDI...p.html
windows11-21h2-x64
4$PLUGINSDI...x.html
windows11-21h2-x64
4$PLUGINSDI...app.js
windows11-21h2-x64
3$PLUGINSDI...uts.js
windows11-21h2-x64
3$PLUGINSDI...dle.js
windows11-21h2-x64
3$PLUGINSDI...min.js
windows11-21h2-x64
3$PLUGINSDI...ons.js
windows11-21h2-x64
3$PLUGINSDI...ics.js
windows11-21h2-x64
3$PLUGINSDI...nds.js
windows11-21h2-x64
3$PLUGINSDI...ies.js
windows11-21h2-x64
3$PLUGINSDI...ate.js
windows11-21h2-x64
3$PLUGINSDI...der.js
windows11-21h2-x64
3$PLUGINSDI...ils.js
windows11-21h2-x64
3$PLUGINSDI...ler.js
windows11-21h2-x64
3$PLUGINSDI...ate.js
windows11-21h2-x64
3$PLUGINSDI...ler.js
windows11-21h2-x64
3$PLUGINSDI...ate.js
windows11-21h2-x64
3$PLUGINSDI...ler.js
windows11-21h2-x64
3$PLUGINSDI...ate.js
windows11-21h2-x64
3$PLUGINSDI...ler.js
windows11-21h2-x64
3$PLUGINSDI...ate.js
windows11-21h2-x64
3$PLUGINSDI...ler.js
windows11-21h2-x64
3$PLUGINSDI...ler.js
windows11-21h2-x64
3$PLUGINSDI...ate.js
windows11-21h2-x64
3$PLUGINSDI...ler.js
windows11-21h2-x64
3$PLUGINSDI...ate.js
windows11-21h2-x64
3$PLUGINSDI...ler.js
windows11-21h2-x64
3$PLUGINSDI...ate.js
windows11-21h2-x64
3$PLUGINSDI...ate.js
windows11-21h2-x64
3$PLUGINSDI...ler.js
windows11-21h2-x64
3$PLUGINSDI...s.html
windows11-21h2-x64
4Analysis
-
max time kernel
300s -
max time network
294s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
11/09/2024, 17:15
Behavioral task
behavioral1
Sample
Lunar Client - Installer.exe
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/app/cmp.html
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/app/index.html
Resource
win11-20240802-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/app/js/app.js
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/app/js/block_inputs.js
Resource
win11-20240802-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/app/js/libs/cmp.bundle.js
Resource
win11-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/app/js/libs/jquery-1.10.2.min.js
Resource
win11-20240802-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/app/js/models/notifications.js
Resource
win11-20240802-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/app/js/utils/analytics.js
Resource
win11-20240802-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/app/js/utils/commands.js
Resource
win11-20240802-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/app/js/utils/cookies.js
Resource
win11-20240802-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/app/js/utils/modal-events-delegate.js
Resource
win11-20240802-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/app/js/utils/strings-loader.js
Resource
win11-20240802-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/app/js/utils/utils.js
Resource
win11-20240802-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/app/js/windows/cri/cri-controller.js
Resource
win11-20240802-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/app/js/windows/cri/template.js
Resource
win11-20240802-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/app/js/windows/finish-with-recommended-app/finish-with-recommended-app-controller.js
Resource
win11-20240802-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/app/js/windows/finish-with-recommended-app/template.js
Resource
win11-20240802-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/app/js/windows/finish/finish-controller.js
Resource
win11-20240802-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/app/js/windows/finish/template.js
Resource
win11-20240802-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/app/js/windows/main/main-controller.js
Resource
win11-20240802-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/app/js/windows/main/template.js
Resource
win11-20240802-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/app/js/windows/modal/modal-controller.js
Resource
win11-20240802-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/app/js/windows/privacy/privacy-controller.js
Resource
win11-20240802-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/app/js/windows/privacy/template.js
Resource
win11-20240802-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/app/js/windows/progress/progress-1-controller.js
Resource
win11-20240802-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/app/js/windows/progress/template.js
Resource
win11-20240802-en
Behavioral task
behavioral28
Sample
$PLUGINSDIR/app/js/windows/settings/settings-controller.js
Resource
win11-20240802-en
Behavioral task
behavioral29
Sample
$PLUGINSDIR/app/js/windows/settings/template.js
Resource
win11-20240802-en
Behavioral task
behavioral30
Sample
$PLUGINSDIR/app/js/windows/welcome/template.js
Resource
win11-20240802-en
Behavioral task
behavioral31
Sample
$PLUGINSDIR/app/js/windows/welcome/welcome-controller.js
Resource
win11-20240802-en
Behavioral task
behavioral32
Sample
$PLUGINSDIR/app/progress.html
Resource
win11-20240802-en
General
-
Target
$PLUGINSDIR/app/index.html
-
Size
20KB
-
MD5
423d2e2f7e21b856cb5f3ee3dcbfa5a0
-
SHA1
eda0e357387913daf57a0c683c34b4b8a5d7baf7
-
SHA256
cd59efa2fe7cbe222d03a946c34eaacdb3761e922763952d7be4555addf8572c
-
SHA512
c403307549af9bf7cfd34295a8b1020e7b7489d104b5fdaf4320b495f85977134796774dbf4f20f8fd0b2d1f2188b881a1cc35cec56aa64a3dc84bf1c2d21b4b
-
SSDEEP
192:DgNb/cVDYmPkhHmY74deqmtRCtmK8WQI9gHcMlxh8Bi9LJFHab4rmgJnc5t/93jp:ENs+XaMr9n2uLy05SN1
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133705485583649301" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1268 chrome.exe 1268 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1268 chrome.exe 1268 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1268 chrome.exe Token: SeCreatePagefilePrivilege 1268 chrome.exe Token: SeShutdownPrivilege 1268 chrome.exe Token: SeCreatePagefilePrivilege 1268 chrome.exe Token: SeShutdownPrivilege 1268 chrome.exe Token: SeCreatePagefilePrivilege 1268 chrome.exe Token: SeShutdownPrivilege 1268 chrome.exe Token: SeCreatePagefilePrivilege 1268 chrome.exe Token: SeShutdownPrivilege 1268 chrome.exe Token: SeCreatePagefilePrivilege 1268 chrome.exe Token: SeShutdownPrivilege 1268 chrome.exe Token: SeCreatePagefilePrivilege 1268 chrome.exe Token: SeShutdownPrivilege 1268 chrome.exe Token: SeCreatePagefilePrivilege 1268 chrome.exe Token: SeShutdownPrivilege 1268 chrome.exe Token: SeCreatePagefilePrivilege 1268 chrome.exe Token: SeShutdownPrivilege 1268 chrome.exe Token: SeCreatePagefilePrivilege 1268 chrome.exe Token: SeShutdownPrivilege 1268 chrome.exe Token: SeCreatePagefilePrivilege 1268 chrome.exe Token: SeShutdownPrivilege 1268 chrome.exe Token: SeCreatePagefilePrivilege 1268 chrome.exe Token: SeShutdownPrivilege 1268 chrome.exe Token: SeCreatePagefilePrivilege 1268 chrome.exe Token: SeShutdownPrivilege 1268 chrome.exe Token: SeCreatePagefilePrivilege 1268 chrome.exe Token: SeShutdownPrivilege 1268 chrome.exe Token: SeCreatePagefilePrivilege 1268 chrome.exe Token: SeShutdownPrivilege 1268 chrome.exe Token: SeCreatePagefilePrivilege 1268 chrome.exe Token: SeShutdownPrivilege 1268 chrome.exe Token: SeCreatePagefilePrivilege 1268 chrome.exe Token: SeShutdownPrivilege 1268 chrome.exe Token: SeCreatePagefilePrivilege 1268 chrome.exe Token: SeShutdownPrivilege 1268 chrome.exe Token: SeCreatePagefilePrivilege 1268 chrome.exe Token: SeShutdownPrivilege 1268 chrome.exe Token: SeCreatePagefilePrivilege 1268 chrome.exe Token: SeShutdownPrivilege 1268 chrome.exe Token: SeCreatePagefilePrivilege 1268 chrome.exe Token: SeShutdownPrivilege 1268 chrome.exe Token: SeCreatePagefilePrivilege 1268 chrome.exe Token: SeShutdownPrivilege 1268 chrome.exe Token: SeCreatePagefilePrivilege 1268 chrome.exe Token: SeShutdownPrivilege 1268 chrome.exe Token: SeCreatePagefilePrivilege 1268 chrome.exe Token: SeShutdownPrivilege 1268 chrome.exe Token: SeCreatePagefilePrivilege 1268 chrome.exe Token: SeShutdownPrivilege 1268 chrome.exe Token: SeCreatePagefilePrivilege 1268 chrome.exe Token: SeShutdownPrivilege 1268 chrome.exe Token: SeCreatePagefilePrivilege 1268 chrome.exe Token: SeShutdownPrivilege 1268 chrome.exe Token: SeCreatePagefilePrivilege 1268 chrome.exe Token: SeShutdownPrivilege 1268 chrome.exe Token: SeCreatePagefilePrivilege 1268 chrome.exe Token: SeShutdownPrivilege 1268 chrome.exe Token: SeCreatePagefilePrivilege 1268 chrome.exe Token: SeShutdownPrivilege 1268 chrome.exe Token: SeCreatePagefilePrivilege 1268 chrome.exe Token: SeShutdownPrivilege 1268 chrome.exe Token: SeCreatePagefilePrivilege 1268 chrome.exe Token: SeShutdownPrivilege 1268 chrome.exe Token: SeCreatePagefilePrivilege 1268 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1268 wrote to memory of 1952 1268 chrome.exe 80 PID 1268 wrote to memory of 1952 1268 chrome.exe 80 PID 1268 wrote to memory of 4428 1268 chrome.exe 81 PID 1268 wrote to memory of 4428 1268 chrome.exe 81 PID 1268 wrote to memory of 4428 1268 chrome.exe 81 PID 1268 wrote to memory of 4428 1268 chrome.exe 81 PID 1268 wrote to memory of 4428 1268 chrome.exe 81 PID 1268 wrote to memory of 4428 1268 chrome.exe 81 PID 1268 wrote to memory of 4428 1268 chrome.exe 81 PID 1268 wrote to memory of 4428 1268 chrome.exe 81 PID 1268 wrote to memory of 4428 1268 chrome.exe 81 PID 1268 wrote to memory of 4428 1268 chrome.exe 81 PID 1268 wrote to memory of 4428 1268 chrome.exe 81 PID 1268 wrote to memory of 4428 1268 chrome.exe 81 PID 1268 wrote to memory of 4428 1268 chrome.exe 81 PID 1268 wrote to memory of 4428 1268 chrome.exe 81 PID 1268 wrote to memory of 4428 1268 chrome.exe 81 PID 1268 wrote to memory of 4428 1268 chrome.exe 81 PID 1268 wrote to memory of 4428 1268 chrome.exe 81 PID 1268 wrote to memory of 4428 1268 chrome.exe 81 PID 1268 wrote to memory of 4428 1268 chrome.exe 81 PID 1268 wrote to memory of 4428 1268 chrome.exe 81 PID 1268 wrote to memory of 4428 1268 chrome.exe 81 PID 1268 wrote to memory of 4428 1268 chrome.exe 81 PID 1268 wrote to memory of 4428 1268 chrome.exe 81 PID 1268 wrote to memory of 4428 1268 chrome.exe 81 PID 1268 wrote to memory of 4428 1268 chrome.exe 81 PID 1268 wrote to memory of 4428 1268 chrome.exe 81 PID 1268 wrote to memory of 4428 1268 chrome.exe 81 PID 1268 wrote to memory of 4428 1268 chrome.exe 81 PID 1268 wrote to memory of 4428 1268 chrome.exe 81 PID 1268 wrote to memory of 4428 1268 chrome.exe 81 PID 1268 wrote to memory of 4884 1268 chrome.exe 82 PID 1268 wrote to memory of 4884 1268 chrome.exe 82 PID 1268 wrote to memory of 4076 1268 chrome.exe 83 PID 1268 wrote to memory of 4076 1268 chrome.exe 83 PID 1268 wrote to memory of 4076 1268 chrome.exe 83 PID 1268 wrote to memory of 4076 1268 chrome.exe 83 PID 1268 wrote to memory of 4076 1268 chrome.exe 83 PID 1268 wrote to memory of 4076 1268 chrome.exe 83 PID 1268 wrote to memory of 4076 1268 chrome.exe 83 PID 1268 wrote to memory of 4076 1268 chrome.exe 83 PID 1268 wrote to memory of 4076 1268 chrome.exe 83 PID 1268 wrote to memory of 4076 1268 chrome.exe 83 PID 1268 wrote to memory of 4076 1268 chrome.exe 83 PID 1268 wrote to memory of 4076 1268 chrome.exe 83 PID 1268 wrote to memory of 4076 1268 chrome.exe 83 PID 1268 wrote to memory of 4076 1268 chrome.exe 83 PID 1268 wrote to memory of 4076 1268 chrome.exe 83 PID 1268 wrote to memory of 4076 1268 chrome.exe 83 PID 1268 wrote to memory of 4076 1268 chrome.exe 83 PID 1268 wrote to memory of 4076 1268 chrome.exe 83 PID 1268 wrote to memory of 4076 1268 chrome.exe 83 PID 1268 wrote to memory of 4076 1268 chrome.exe 83 PID 1268 wrote to memory of 4076 1268 chrome.exe 83 PID 1268 wrote to memory of 4076 1268 chrome.exe 83 PID 1268 wrote to memory of 4076 1268 chrome.exe 83 PID 1268 wrote to memory of 4076 1268 chrome.exe 83 PID 1268 wrote to memory of 4076 1268 chrome.exe 83 PID 1268 wrote to memory of 4076 1268 chrome.exe 83 PID 1268 wrote to memory of 4076 1268 chrome.exe 83 PID 1268 wrote to memory of 4076 1268 chrome.exe 83 PID 1268 wrote to memory of 4076 1268 chrome.exe 83 PID 1268 wrote to memory of 4076 1268 chrome.exe 83
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app\index.html1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff978e5cc40,0x7ff978e5cc4c,0x7ff978e5cc582⤵PID:1952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1780,i,12349551476025458889,15844075400461040459,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1768 /prefetch:22⤵PID:4428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2096,i,12349551476025458889,15844075400461040459,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2104 /prefetch:32⤵PID:4884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2176,i,12349551476025458889,15844075400461040459,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2280 /prefetch:82⤵PID:4076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3084,i,12349551476025458889,15844075400461040459,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3104 /prefetch:12⤵PID:1056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3092,i,12349551476025458889,15844075400461040459,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3164 /prefetch:12⤵PID:4960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4512,i,12349551476025458889,15844075400461040459,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4520 /prefetch:82⤵PID:1380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4764,i,12349551476025458889,15844075400461040459,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=736 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4300
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:652
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4104
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5b5ad5caaaee00cb8cf445427975ae66c
SHA1dcde6527290a326e048f9c3a85280d3fa71e1e22
SHA256b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8
SHA51292f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f
-
Filesize
4B
MD5f49655f856acb8884cc0ace29216f511
SHA1cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA2567852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
-
Filesize
1008B
MD5d222b77a61527f2c177b0869e7babc24
SHA13f23acb984307a4aeba41ebbb70439c97ad1f268
SHA25680dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747
SHA512d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff
-
Filesize
649B
MD593ab3cf985f18b29fa539e8cd66905a0
SHA115a5b06503e275a6671e456b955962755ba5d04b
SHA25663db8d63533c3e8110217674c97981a980c42fdd39bd70a49f842263bbff7333
SHA512c32c21ef53bf42dc45d6e10b0bbbe1efe3fdd0d95f0ff3cbf82484a13f8cf4cbe693c54346fe4165ec63adcbf9f6486052e48eb6c9c8561287271755d5a0b6c6
-
Filesize
1KB
MD5d007baef5aae98cccae79cd69f87d0d1
SHA166000e0353e862793d0fdb2867143348e5a288b8
SHA25656838cfb62ccab8122619c10a56bf537e7bb06a0e1cce7556773c6564a860559
SHA512de5415ac8a7aee89b3fe32a78b75fbd1fd9ca93cd186f2a82b30f2447ad085a4b59f6d76865de47e651959f5404019edce26706875928058e9d0f44888acdaeb
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
520B
MD571e159c589587f921af1893248b15bf4
SHA1d5c355e8aef3adb8f6437a85458b07b0c742a7d7
SHA2560280c734db6e6d33550eab5858f4a1e9d2f9f54dd30406f025ab2febb0694815
SHA512c524a78acce2056dd1a2b4112084e81c2b0533d2815b660b4e636b2c6b8504538ec1b4c4caec4e2d34677378d1b33674221bdd7f4bf842444bf795eab5d8b7ca
-
Filesize
9KB
MD57290eb9ea05738f2cd4fe0369643b4e9
SHA1d66e1e1e03e4e13c620470cca4b9a8f6ac15d6f9
SHA256dbd1fee1ab03f601ccd1c8dd91e1989f95b4978f00b1b93a23a2496bbbcd0049
SHA512f52301e1e1db4ce5f1b60e213090662051afefadf48a5c6f87b9b21b11c3dfc74940679ca1bd348aa0c3aa4aa8de3942c5f46895d2d4f1308e04ed7fb651dc40
-
Filesize
9KB
MD51d4489bdf0facbaeebe1fd3a749825e6
SHA1fc02a5423063d269ca3baed74aa4bfe38cf34c19
SHA256b547dcfd812004862d0ba610eec2ff5c6d081333ada30b598413aa20251994d5
SHA5129fb72a46393f0fc201325dff8e1b5fbf980475a8608f299dc9f17a242074043a53df04dd74542e7c4b235c407027ac9ac7f12cd1e91003d81a521f18168e68fa
-
Filesize
9KB
MD5697c27b5c8e9f598e4f05cb7425bdff9
SHA1a27b37d4b3a634d216ad5bc8a0a4466a9e068503
SHA25650e6f81a3a9300a2b1cb3e9f9c362eb73e8f8ba534c732fbec94b976b444c386
SHA5123a38540da421f1e85cc4702dc4a177d1e5ad133bbb2d504b8bd17e7e15c8357f01a7fda296d447aec6f6c48a7c78dc838ff9e4eeeccd79c9570cf8a11c12646b
-
Filesize
9KB
MD5060d257a431a497330c2d7ca4f8b9e1a
SHA1ff70be802b01e510411a0109421ffab7e054c738
SHA256d3eb22ea725a05227fef0bd331ade2e5bcbf36c41d89b32cdf297554486320e4
SHA512780ada7e66c8cd05165a66edb55abb7cc6028c2fc196c633bfe807523baf7c85b53621952a7e1aef467225918b06ede52e7468420d545ad903eb608f1f88e223
-
Filesize
9KB
MD5710266cd8af8faaf845716ef0483f5b8
SHA14637ef26c1436e99dc5d5ba3cf1237db30c11a38
SHA2566e6792c7fbb0f697633bbcc796aa81df01833304000098395ff9137d123653c6
SHA512e8c546c66b949a1b4e4bb91962dd6fbdf1e5d7dc54eab53b81e1a05a16a81c544ec8d28846873fb9722636dc7dabdd67f55cbb88c9657ff7b5c009092f266707
-
Filesize
9KB
MD59fd9086eccddcf60ced21748e233e59f
SHA149213c12f46197db0f506a422254055d7b987edc
SHA256a3c59eb677f3756e5120e63a4e0af09f10c84d4e0ddc0b5b8f13c6dd21cd5a84
SHA5125929cc41e6ea400a8179f13aee21b5952a896fd8315975143815ce69a2966842e80a59b324d217cb7c0064a273efa20252f5c19b5d6cc66b8f16c385139832ca
-
Filesize
9KB
MD5c1379caa3f501fd07aecc44b8d1a2442
SHA120fb7af3974d8ab5aec7d0147dfaf37465a25230
SHA256b5f668081e156410d65e6d4715ba75b26fc9f63caa2301d61f1d04f4ebbb10e4
SHA5120cc514c5a16cd993a1f72cb573b213350180d81c5908b00fbfd0fe94612184254c499902f749119d7c8885e08cf6b9bb0d8f0fde8dbc591b4b4cd17b249ff70a
-
Filesize
9KB
MD562601d7bbde6f382887f1462825c901e
SHA18ac17526ca783fd4ae0d5680dfd08331eab3e9d9
SHA2560d391a4fd2c78c3c20cd940f2ddc6f7e7118514de51b05fd49f86bdf31b2f142
SHA51277e8956b21000cd814cc4bfd5e1a56474988a6e11fcc5474abdb0197fb55e0f18ef99620e20f19cfef199c76c6ec4b81a8ad9635be955367fd4c090599f94d4b
-
Filesize
9KB
MD522b5e6f7c70000ecebcb9e86d16e0ab6
SHA1edb3a2ba663dbce1e6619d8e004d28397b78dc4e
SHA256463141f62b00f746a3e1c8318e15f99279f09a9b43e96d9e9f2c92fdc592e8ec
SHA5121bca521073cee5b223e26b5917f9d13930b1d2e1293f0e02dd190f7afb48e829cd31915f5b5f83f09036fb9c3b1cda0278ea39f74f1aadf737dda5e3c473e939
-
Filesize
9KB
MD5021a0c8891508fc25d96fa0abf38b710
SHA154ed36569218fd687f99660c887be310fe029753
SHA25616b42b1ef068d60f98b2615ac5bdef646658b462b8156d975c8d9c366c779995
SHA512af59df515df0a053536e105806c0eb75299b9e24638b1fe69a1e3fa50d15bcd999444329a44a88c90489d1b7318f5d1cd320e6b8f17598da930d6ea53f1d9fec
-
Filesize
9KB
MD5d0869e834d502ebf847070fe6f9fa0f6
SHA18222edbfa5f9e58f95eb505e3a2d0330bc8be9ce
SHA25606cb3705ee2d1fe4b02ccebbe00a50770f615306eb0468f38e9266b88d98ef71
SHA512b3f8ec30d4e528a0f75856b1fd4087684a072c9a9d9912e9855bb5933e867a8c08a3aa884578110b1f4641b3ed439006e2324fb288c701186b55bad5ceb4bae3
-
Filesize
9KB
MD5fd794a2f578567107e4b0c3a23426983
SHA1b68a6b2286d36e2ff65eb4d47ea640c16aa8f021
SHA2566720404b5ac409824a3e26f92d178fc298afefa32861c0d4a80d7eabb12ce583
SHA5122ed11847abfd1da78b5446efa2f59257cd4163db342be097651f302455743b01a86d1891d89bb9d18550484354ad6c5b7348dd8491698b031dbd3c2b2e821d6c
-
Filesize
9KB
MD567ceff64568af66469a9cc93d2d06193
SHA1e5a1c61b6a4ed098aa21e026a03b06fcdbcfc15f
SHA25639cf9038d8d049f9a2fe94cd6cef2d8858d1b28e94ea8c97e358c63999384af5
SHA512d692957f53b87e48ef9e93d72473b173ea742d123696a09f67d05cdd0e003128e428d16721188749bbeb6c51d2f0bc338a0f1e52d8eeef9032d74c58ea7e1840
-
Filesize
9KB
MD50fc968b9316318e9db770ec50fc4bfbb
SHA189627de393b02594cf7032259512e4530f3c2d3e
SHA2564313470ddbaef3a751920db195fb226fbefbec1399e61e4765d6f57f57b23591
SHA51239c97d6cf92ead37e0285b09609a560a2bfc4e7a4cb082a872fa8e55fc959bc6b3e5e61f9b657d98b16c26a8d46e3dbc56f33c9fe3f44f7ef4b362cfe55e10f4
-
Filesize
9KB
MD50d9642663ea8af2fcab10f95da21ecc6
SHA112b68c8791ef50e162ad9c517b63e76d81651628
SHA256e71d3cbcd1970587974f55570874f63ff128d28c1ba3c97a30d4d275bfb8839c
SHA51206ddcb895c41b8bf1941b42987817815759d40aec3ca829ff096425321eb3abc3ab6e60ef8690a913a446bfa046c43a52181564603bce272f4279f898284fa35
-
Filesize
9KB
MD5b30a76b6d2bbca38df07b6af4cdbe839
SHA1c2bbf2afbddd8df35a15ca0354e6fff455b744f4
SHA256ee5aad42cefbae72899ad75f48d363b5908c6b3881a6e81ee6fd425d3cae2663
SHA512e615b1ff51d776697db6248cd2451bd339028a178d34bf455e5bf03360988de5bf883f3410770ecece91c5e5165976ce501552307a71a44cbe780bd78f4f9f4f
-
Filesize
99KB
MD596214c190d1a62894598147c569c1e9b
SHA136fb4e3c56200c1a5aefba14111a87b77a653918
SHA256cd3571dd583773c8dbf276c6eb5f4aceab7900f615b36d25eb5cb6867dfa6314
SHA512f4c79d489c1ec3922d02f0c1405e5e1dd04d72accd3e2acb3cfc1d6d01cbad5d818d9476c48857e9d41551a2a50064a48443f68de04dfbe077b6a8fc6bb1e1b3
-
Filesize
99KB
MD5274d1ee4b98b8106b0055a3709d31951
SHA12af5d5e624035d914d5656871b248e45d3376ec8
SHA25648af44aaff1bda9d34d2baffeb7de9e84c941d5afae2105f523fd9922fe9228e
SHA51206dafefdbe75509e5e5ab4a14c88cd00061d3c4a53f0864ab9bf3a6927299fda7248f9dd5be03f870a5070dcc872f2ac00f47c281e60d4386fb2aa133ffb6d4d