Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
18/11/2023, 00:20
Behavioral task
behavioral1
Sample
NEAS.c468b837527444261cc2e6da32a0ebf0.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.c468b837527444261cc2e6da32a0ebf0.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.c468b837527444261cc2e6da32a0ebf0.exe
-
Size
272KB
-
MD5
c468b837527444261cc2e6da32a0ebf0
-
SHA1
d2ded509410073b1641268f22d3de401e6995afb
-
SHA256
9f461fcb30e847d4c60eb5fc652eca3b4fdff70f7c196eaf30611bd045490bc3
-
SHA512
ba884171f71db58acf9abf231f8795161578f3a422d2c83782dff5e3dd607719bc10178441ebd3e0710b7737cf17fed0d67295cafe25af630f4a523cac23923f
-
SSDEEP
6144:iurcFsygJ+0oD0kMbh/xaSfBJKFbhD7sYQpui6yYPaIGckZqByMG2fxCcv9:ii6n0oD0kQLnfBJKFbhDwBpV6yYP4qa
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 16 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dcadac32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ddigjkid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ednpej32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Enfenplo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" NEAS.c468b837527444261cc2e6da32a0ebf0.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dcenlceh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Enfenplo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad NEAS.c468b837527444261cc2e6da32a0ebf0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dcadac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ddigjkid.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ednpej32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ecejkf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dgjclbdi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dcenlceh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ecejkf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dgjclbdi.exe -
Malware Backdoor - Berbew 44 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/files/0x000e00000001201d-5.dat family_berbew behavioral1/files/0x000e00000001201d-9.dat family_berbew behavioral1/files/0x000e00000001201d-12.dat family_berbew behavioral1/files/0x000e00000001201d-14.dat family_berbew behavioral1/files/0x000e00000001201d-8.dat family_berbew behavioral1/files/0x0027000000016455-25.dat family_berbew behavioral1/files/0x0027000000016455-22.dat family_berbew behavioral1/files/0x0027000000016455-21.dat family_berbew behavioral1/files/0x0027000000016455-19.dat family_berbew behavioral1/files/0x0027000000016455-27.dat family_berbew behavioral1/memory/2392-32-0x00000000003B0000-0x00000000003E3000-memory.dmp family_berbew behavioral1/files/0x0007000000016c2b-33.dat family_berbew behavioral1/files/0x0007000000016c2b-40.dat family_berbew behavioral1/files/0x0007000000016c2b-37.dat family_berbew behavioral1/files/0x0007000000016c2b-36.dat family_berbew behavioral1/files/0x0007000000016c2b-42.dat family_berbew behavioral1/files/0x0008000000016ca3-47.dat family_berbew behavioral1/files/0x0008000000016ca3-51.dat family_berbew behavioral1/files/0x0008000000016ca3-54.dat family_berbew behavioral1/files/0x0008000000016ca3-50.dat family_berbew behavioral1/files/0x0008000000016ca3-55.dat family_berbew behavioral1/files/0x0008000000016d01-60.dat family_berbew behavioral1/files/0x0008000000016d01-66.dat family_berbew behavioral1/files/0x0008000000016d01-63.dat family_berbew behavioral1/files/0x0008000000016d01-62.dat family_berbew behavioral1/files/0x0008000000016d01-67.dat family_berbew behavioral1/files/0x0006000000016d0a-73.dat family_berbew behavioral1/files/0x0006000000016d0a-76.dat family_berbew behavioral1/files/0x0006000000016d0a-81.dat family_berbew behavioral1/files/0x0006000000016d0a-80.dat family_berbew behavioral1/files/0x0006000000016d0a-75.dat family_berbew behavioral1/files/0x0006000000016d39-87.dat family_berbew behavioral1/files/0x0006000000016d39-94.dat family_berbew behavioral1/files/0x0006000000016d39-96.dat family_berbew behavioral1/files/0x0006000000016d39-91.dat family_berbew behavioral1/files/0x0006000000016d39-90.dat family_berbew behavioral1/files/0x002700000001658b-101.dat family_berbew behavioral1/files/0x002700000001658b-103.dat family_berbew behavioral1/files/0x002700000001658b-104.dat family_berbew behavioral1/files/0x002700000001658b-108.dat family_berbew behavioral1/files/0x002700000001658b-111.dat family_berbew behavioral1/files/0x002700000001658b-112.dat family_berbew behavioral1/files/0x002700000001658b-110.dat family_berbew behavioral1/files/0x002700000001658b-113.dat family_berbew -
Executes dropped EXE 8 IoCs
pid Process 2392 Dgjclbdi.exe 2668 Dcadac32.exe 2788 Dcenlceh.exe 2496 Ddigjkid.exe 2600 Ednpej32.exe 2620 Enfenplo.exe 2560 Ecejkf32.exe 2920 Fkckeh32.exe -
Loads dropped DLL 20 IoCs
pid Process 2280 NEAS.c468b837527444261cc2e6da32a0ebf0.exe 2280 NEAS.c468b837527444261cc2e6da32a0ebf0.exe 2392 Dgjclbdi.exe 2392 Dgjclbdi.exe 2668 Dcadac32.exe 2668 Dcadac32.exe 2788 Dcenlceh.exe 2788 Dcenlceh.exe 2496 Ddigjkid.exe 2496 Ddigjkid.exe 2600 Ednpej32.exe 2600 Ednpej32.exe 2620 Enfenplo.exe 2620 Enfenplo.exe 2560 Ecejkf32.exe 2560 Ecejkf32.exe 2908 WerFault.exe 2908 WerFault.exe 2908 WerFault.exe 2908 WerFault.exe -
Drops file in System32 directory 24 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Dgjclbdi.exe NEAS.c468b837527444261cc2e6da32a0ebf0.exe File opened for modification C:\Windows\SysWOW64\Dcenlceh.exe Dcadac32.exe File opened for modification C:\Windows\SysWOW64\Ddigjkid.exe Dcenlceh.exe File created C:\Windows\SysWOW64\Ednpej32.exe Ddigjkid.exe File created C:\Windows\SysWOW64\Enfenplo.exe Ednpej32.exe File created C:\Windows\SysWOW64\Lchkpi32.dll Ednpej32.exe File created C:\Windows\SysWOW64\Dgjclbdi.exe NEAS.c468b837527444261cc2e6da32a0ebf0.exe File created C:\Windows\SysWOW64\Dcadac32.exe Dgjclbdi.exe File opened for modification C:\Windows\SysWOW64\Dcadac32.exe Dgjclbdi.exe File created C:\Windows\SysWOW64\Eofjhkoj.dll Dgjclbdi.exe File created C:\Windows\SysWOW64\Dcenlceh.exe Dcadac32.exe File created C:\Windows\SysWOW64\Bjidgghp.dll Dcadac32.exe File created C:\Windows\SysWOW64\Ecejkf32.exe Enfenplo.exe File created C:\Windows\SysWOW64\Ddigjkid.exe Dcenlceh.exe File created C:\Windows\SysWOW64\Mledlaqd.dll Dcenlceh.exe File opened for modification C:\Windows\SysWOW64\Ednpej32.exe Ddigjkid.exe File created C:\Windows\SysWOW64\Bpbbfi32.dll Ddigjkid.exe File created C:\Windows\SysWOW64\Fkckeh32.exe Ecejkf32.exe File created C:\Windows\SysWOW64\Clkmne32.dll Ecejkf32.exe File created C:\Windows\SysWOW64\Qbgpffch.dll NEAS.c468b837527444261cc2e6da32a0ebf0.exe File opened for modification C:\Windows\SysWOW64\Enfenplo.exe Ednpej32.exe File opened for modification C:\Windows\SysWOW64\Ecejkf32.exe Enfenplo.exe File created C:\Windows\SysWOW64\Bdacap32.dll Enfenplo.exe File opened for modification C:\Windows\SysWOW64\Fkckeh32.exe Ecejkf32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2908 2920 WerFault.exe 35 -
Modifies registry class 27 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dcadac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mledlaqd.dll" Dcenlceh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dcenlceh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 NEAS.c468b837527444261cc2e6da32a0ebf0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eofjhkoj.dll" Dgjclbdi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjidgghp.dll" Dcadac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ddigjkid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lchkpi32.dll" Ednpej32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Enfenplo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID NEAS.c468b837527444261cc2e6da32a0ebf0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ecejkf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dgjclbdi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ednpej32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ddigjkid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ecejkf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831} NEAS.c468b837527444261cc2e6da32a0ebf0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Enfenplo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clkmne32.dll" Ecejkf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qbgpffch.dll" NEAS.c468b837527444261cc2e6da32a0ebf0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" NEAS.c468b837527444261cc2e6da32a0ebf0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dcadac32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dcenlceh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ednpej32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node NEAS.c468b837527444261cc2e6da32a0ebf0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dgjclbdi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpbbfi32.dll" Ddigjkid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdacap32.dll" Enfenplo.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 2280 wrote to memory of 2392 2280 NEAS.c468b837527444261cc2e6da32a0ebf0.exe 28 PID 2280 wrote to memory of 2392 2280 NEAS.c468b837527444261cc2e6da32a0ebf0.exe 28 PID 2280 wrote to memory of 2392 2280 NEAS.c468b837527444261cc2e6da32a0ebf0.exe 28 PID 2280 wrote to memory of 2392 2280 NEAS.c468b837527444261cc2e6da32a0ebf0.exe 28 PID 2392 wrote to memory of 2668 2392 Dgjclbdi.exe 29 PID 2392 wrote to memory of 2668 2392 Dgjclbdi.exe 29 PID 2392 wrote to memory of 2668 2392 Dgjclbdi.exe 29 PID 2392 wrote to memory of 2668 2392 Dgjclbdi.exe 29 PID 2668 wrote to memory of 2788 2668 Dcadac32.exe 30 PID 2668 wrote to memory of 2788 2668 Dcadac32.exe 30 PID 2668 wrote to memory of 2788 2668 Dcadac32.exe 30 PID 2668 wrote to memory of 2788 2668 Dcadac32.exe 30 PID 2788 wrote to memory of 2496 2788 Dcenlceh.exe 31 PID 2788 wrote to memory of 2496 2788 Dcenlceh.exe 31 PID 2788 wrote to memory of 2496 2788 Dcenlceh.exe 31 PID 2788 wrote to memory of 2496 2788 Dcenlceh.exe 31 PID 2496 wrote to memory of 2600 2496 Ddigjkid.exe 32 PID 2496 wrote to memory of 2600 2496 Ddigjkid.exe 32 PID 2496 wrote to memory of 2600 2496 Ddigjkid.exe 32 PID 2496 wrote to memory of 2600 2496 Ddigjkid.exe 32 PID 2600 wrote to memory of 2620 2600 Ednpej32.exe 33 PID 2600 wrote to memory of 2620 2600 Ednpej32.exe 33 PID 2600 wrote to memory of 2620 2600 Ednpej32.exe 33 PID 2600 wrote to memory of 2620 2600 Ednpej32.exe 33 PID 2620 wrote to memory of 2560 2620 Enfenplo.exe 34 PID 2620 wrote to memory of 2560 2620 Enfenplo.exe 34 PID 2620 wrote to memory of 2560 2620 Enfenplo.exe 34 PID 2620 wrote to memory of 2560 2620 Enfenplo.exe 34 PID 2560 wrote to memory of 2920 2560 Ecejkf32.exe 35 PID 2560 wrote to memory of 2920 2560 Ecejkf32.exe 35 PID 2560 wrote to memory of 2920 2560 Ecejkf32.exe 35 PID 2560 wrote to memory of 2920 2560 Ecejkf32.exe 35 PID 2920 wrote to memory of 2908 2920 Fkckeh32.exe 36 PID 2920 wrote to memory of 2908 2920 Fkckeh32.exe 36 PID 2920 wrote to memory of 2908 2920 Fkckeh32.exe 36 PID 2920 wrote to memory of 2908 2920 Fkckeh32.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.c468b837527444261cc2e6da32a0ebf0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.c468b837527444261cc2e6da32a0ebf0.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\Dgjclbdi.exeC:\Windows\system32\Dgjclbdi.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\Dcadac32.exeC:\Windows\system32\Dcadac32.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\Dcenlceh.exeC:\Windows\system32\Dcenlceh.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\Ddigjkid.exeC:\Windows\system32\Ddigjkid.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\Ednpej32.exeC:\Windows\system32\Ednpej32.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\SysWOW64\Enfenplo.exeC:\Windows\system32\Enfenplo.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\Ecejkf32.exeC:\Windows\system32\Ecejkf32.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\Fkckeh32.exeC:\Windows\system32\Fkckeh32.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 14010⤵
- Loads dropped DLL
- Program crash
PID:2908
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5dabd29ecf7bd11781982d831f90d7c0c
SHA1a10edf62580478a9f47ff7857233b131bec0986d
SHA256678993d1a4de2e56ff26a8c1f25992ea89a087418109ae697074b71ddb840182
SHA512b0fe4aeca47491e4b7b29c9ef0205dd7b0d9413b44debceb855b2a4fdc51c981e82080914885f5a6c85da9b06a713ec3fea98e3848287bc8a3aa8e20e954cf37
-
Filesize
272KB
MD56bb4ac0f10cba7bbd9d4ed7b526f28dd
SHA18786e5c30e1f57bd2a83a472ea93253910b93b57
SHA2560929777a2a83b906b135364493e3f78a09c3d010464fde159f4ed6396b08e80c
SHA512c65ac79fbd0f50a5e647766947bc308f8f08ac0ca4a8a78b2cc70d762fd737fc38f5b5779060e4ea231a8488a04cbda8550fd081ad50bb35836622e86e201e89
-
Filesize
272KB
MD56bb4ac0f10cba7bbd9d4ed7b526f28dd
SHA18786e5c30e1f57bd2a83a472ea93253910b93b57
SHA2560929777a2a83b906b135364493e3f78a09c3d010464fde159f4ed6396b08e80c
SHA512c65ac79fbd0f50a5e647766947bc308f8f08ac0ca4a8a78b2cc70d762fd737fc38f5b5779060e4ea231a8488a04cbda8550fd081ad50bb35836622e86e201e89
-
Filesize
272KB
MD56bb4ac0f10cba7bbd9d4ed7b526f28dd
SHA18786e5c30e1f57bd2a83a472ea93253910b93b57
SHA2560929777a2a83b906b135364493e3f78a09c3d010464fde159f4ed6396b08e80c
SHA512c65ac79fbd0f50a5e647766947bc308f8f08ac0ca4a8a78b2cc70d762fd737fc38f5b5779060e4ea231a8488a04cbda8550fd081ad50bb35836622e86e201e89
-
Filesize
272KB
MD5a55d6e95c52bd61fe54e2c68f942e8f6
SHA1b34d74e040e82b86e64a50ba8c74d60c9d27fc09
SHA256adf6888aba7baa75948be39cf1065acf5a6abe89669a47032525700931d52989
SHA512274ca295cdf15fc886d2b2e0dad08be7aa089b57d93dc1b55e99aae9b25062ceadc5aca94b70a27b985f2687df9c1e6467793b3bdd71180eed32ea2cb9a7eb25
-
Filesize
272KB
MD5a55d6e95c52bd61fe54e2c68f942e8f6
SHA1b34d74e040e82b86e64a50ba8c74d60c9d27fc09
SHA256adf6888aba7baa75948be39cf1065acf5a6abe89669a47032525700931d52989
SHA512274ca295cdf15fc886d2b2e0dad08be7aa089b57d93dc1b55e99aae9b25062ceadc5aca94b70a27b985f2687df9c1e6467793b3bdd71180eed32ea2cb9a7eb25
-
Filesize
272KB
MD5a55d6e95c52bd61fe54e2c68f942e8f6
SHA1b34d74e040e82b86e64a50ba8c74d60c9d27fc09
SHA256adf6888aba7baa75948be39cf1065acf5a6abe89669a47032525700931d52989
SHA512274ca295cdf15fc886d2b2e0dad08be7aa089b57d93dc1b55e99aae9b25062ceadc5aca94b70a27b985f2687df9c1e6467793b3bdd71180eed32ea2cb9a7eb25
-
Filesize
272KB
MD55da9a1f1e4e77893f98ec094b866b7a6
SHA13318068606f1ddcdb32b63b6e04c8c438ba008af
SHA2560eb2f02cdc7c69ceea044f5b6ceb653dc3e971a2187cca65f637682b22ba006d
SHA512d0629e79e61f2122db60614bacec292fa8f04556c3dbd946f298511377d0fbca0047f821fc3b7780187352464442dc9af4b7a3a70b2e91d32b8373cb276e0550
-
Filesize
272KB
MD55da9a1f1e4e77893f98ec094b866b7a6
SHA13318068606f1ddcdb32b63b6e04c8c438ba008af
SHA2560eb2f02cdc7c69ceea044f5b6ceb653dc3e971a2187cca65f637682b22ba006d
SHA512d0629e79e61f2122db60614bacec292fa8f04556c3dbd946f298511377d0fbca0047f821fc3b7780187352464442dc9af4b7a3a70b2e91d32b8373cb276e0550
-
Filesize
272KB
MD55da9a1f1e4e77893f98ec094b866b7a6
SHA13318068606f1ddcdb32b63b6e04c8c438ba008af
SHA2560eb2f02cdc7c69ceea044f5b6ceb653dc3e971a2187cca65f637682b22ba006d
SHA512d0629e79e61f2122db60614bacec292fa8f04556c3dbd946f298511377d0fbca0047f821fc3b7780187352464442dc9af4b7a3a70b2e91d32b8373cb276e0550
-
Filesize
272KB
MD57f382332250aa1d13cc818d7bc9e59d9
SHA10ebccd0cad43004e36038f6d072698772e850ada
SHA256680a336872c563cf8d5c6c1be7ff047a443d09df8d3ea54dae2743f6f1bb1eca
SHA5129816ef1a86274e51267f1a67f47e72305c02f75868b9b6618fee1c7a722b951370679b1b77a1baff6bfdc53cf54f1a99d0b8466022cf09c734fb2e2191e3a086
-
Filesize
272KB
MD57f382332250aa1d13cc818d7bc9e59d9
SHA10ebccd0cad43004e36038f6d072698772e850ada
SHA256680a336872c563cf8d5c6c1be7ff047a443d09df8d3ea54dae2743f6f1bb1eca
SHA5129816ef1a86274e51267f1a67f47e72305c02f75868b9b6618fee1c7a722b951370679b1b77a1baff6bfdc53cf54f1a99d0b8466022cf09c734fb2e2191e3a086
-
Filesize
272KB
MD57f382332250aa1d13cc818d7bc9e59d9
SHA10ebccd0cad43004e36038f6d072698772e850ada
SHA256680a336872c563cf8d5c6c1be7ff047a443d09df8d3ea54dae2743f6f1bb1eca
SHA5129816ef1a86274e51267f1a67f47e72305c02f75868b9b6618fee1c7a722b951370679b1b77a1baff6bfdc53cf54f1a99d0b8466022cf09c734fb2e2191e3a086
-
Filesize
272KB
MD5db7e8590414a4c8a0867277b84515506
SHA10b3b2ef6efad537bde25f1016d0fb4087df5a5fd
SHA25674b922b962af018509a3e94b5060928c79e044dafca0051ec24e76f16a0c4cf0
SHA512de4719a5690c72f45bed7b9a469782f005d6628169985efbd19e21037803cc7f45bc75b612c202dd386ba7d2beffbd997e6bb33ba90083011a888f628e40d748
-
Filesize
272KB
MD5db7e8590414a4c8a0867277b84515506
SHA10b3b2ef6efad537bde25f1016d0fb4087df5a5fd
SHA25674b922b962af018509a3e94b5060928c79e044dafca0051ec24e76f16a0c4cf0
SHA512de4719a5690c72f45bed7b9a469782f005d6628169985efbd19e21037803cc7f45bc75b612c202dd386ba7d2beffbd997e6bb33ba90083011a888f628e40d748
-
Filesize
272KB
MD5db7e8590414a4c8a0867277b84515506
SHA10b3b2ef6efad537bde25f1016d0fb4087df5a5fd
SHA25674b922b962af018509a3e94b5060928c79e044dafca0051ec24e76f16a0c4cf0
SHA512de4719a5690c72f45bed7b9a469782f005d6628169985efbd19e21037803cc7f45bc75b612c202dd386ba7d2beffbd997e6bb33ba90083011a888f628e40d748
-
Filesize
272KB
MD546af953b73977c1c93d3225bd52db0b0
SHA14fa47b6c31b60032c02b0060f82eb8dff979014d
SHA2561b76524c38aacdc1bef50416c55391ed76f21e32de3713f4511998afe032b21b
SHA512ee8c2f7dedbefc65c6fc7faa8930b3ad92348632a52af017db180dffe7d30146147ad8c2bf583ca338a790d35c31ba2ccd33243a744eeaa8f329ef01cb047f52
-
Filesize
272KB
MD546af953b73977c1c93d3225bd52db0b0
SHA14fa47b6c31b60032c02b0060f82eb8dff979014d
SHA2561b76524c38aacdc1bef50416c55391ed76f21e32de3713f4511998afe032b21b
SHA512ee8c2f7dedbefc65c6fc7faa8930b3ad92348632a52af017db180dffe7d30146147ad8c2bf583ca338a790d35c31ba2ccd33243a744eeaa8f329ef01cb047f52
-
Filesize
272KB
MD546af953b73977c1c93d3225bd52db0b0
SHA14fa47b6c31b60032c02b0060f82eb8dff979014d
SHA2561b76524c38aacdc1bef50416c55391ed76f21e32de3713f4511998afe032b21b
SHA512ee8c2f7dedbefc65c6fc7faa8930b3ad92348632a52af017db180dffe7d30146147ad8c2bf583ca338a790d35c31ba2ccd33243a744eeaa8f329ef01cb047f52
-
Filesize
272KB
MD5534efe6b083e20e207fe4ac54b024a6e
SHA13e2807fb4ad9ea640c049a0d1783b5e34d245b63
SHA2568076cb777d53164ba23938d893b8dfa4980ed94deef733c47318bc59b64ca023
SHA5121cdaa47bea623c51ae92fcd6b2bbecda7786efec78b548adab058eaf3c213f20dacbf94d8d3e21611efa157326285eb914bf9e397207b0b084f6cc541e59ee10
-
Filesize
272KB
MD5534efe6b083e20e207fe4ac54b024a6e
SHA13e2807fb4ad9ea640c049a0d1783b5e34d245b63
SHA2568076cb777d53164ba23938d893b8dfa4980ed94deef733c47318bc59b64ca023
SHA5121cdaa47bea623c51ae92fcd6b2bbecda7786efec78b548adab058eaf3c213f20dacbf94d8d3e21611efa157326285eb914bf9e397207b0b084f6cc541e59ee10
-
Filesize
272KB
MD5534efe6b083e20e207fe4ac54b024a6e
SHA13e2807fb4ad9ea640c049a0d1783b5e34d245b63
SHA2568076cb777d53164ba23938d893b8dfa4980ed94deef733c47318bc59b64ca023
SHA5121cdaa47bea623c51ae92fcd6b2bbecda7786efec78b548adab058eaf3c213f20dacbf94d8d3e21611efa157326285eb914bf9e397207b0b084f6cc541e59ee10
-
Filesize
272KB
MD531cf9c1c7d328b163e2bb4dc93af82d0
SHA16d8169778c83ccf7678980ae11cc019e8125735a
SHA256f27a932f213338fb8885e7c29bbd1a57d753b0a916a835355c29fae0d5a50791
SHA512b95428c55f053046a116c8dd623b53d3df22ff0fb89bf3328761fd9ec2541c708db8f8da69c565cc4ec97eb19d3ed9da1f49d7a3478952db99d6af328fde8bbf
-
Filesize
272KB
MD531cf9c1c7d328b163e2bb4dc93af82d0
SHA16d8169778c83ccf7678980ae11cc019e8125735a
SHA256f27a932f213338fb8885e7c29bbd1a57d753b0a916a835355c29fae0d5a50791
SHA512b95428c55f053046a116c8dd623b53d3df22ff0fb89bf3328761fd9ec2541c708db8f8da69c565cc4ec97eb19d3ed9da1f49d7a3478952db99d6af328fde8bbf
-
Filesize
272KB
MD56bb4ac0f10cba7bbd9d4ed7b526f28dd
SHA18786e5c30e1f57bd2a83a472ea93253910b93b57
SHA2560929777a2a83b906b135364493e3f78a09c3d010464fde159f4ed6396b08e80c
SHA512c65ac79fbd0f50a5e647766947bc308f8f08ac0ca4a8a78b2cc70d762fd737fc38f5b5779060e4ea231a8488a04cbda8550fd081ad50bb35836622e86e201e89
-
Filesize
272KB
MD56bb4ac0f10cba7bbd9d4ed7b526f28dd
SHA18786e5c30e1f57bd2a83a472ea93253910b93b57
SHA2560929777a2a83b906b135364493e3f78a09c3d010464fde159f4ed6396b08e80c
SHA512c65ac79fbd0f50a5e647766947bc308f8f08ac0ca4a8a78b2cc70d762fd737fc38f5b5779060e4ea231a8488a04cbda8550fd081ad50bb35836622e86e201e89
-
Filesize
272KB
MD5a55d6e95c52bd61fe54e2c68f942e8f6
SHA1b34d74e040e82b86e64a50ba8c74d60c9d27fc09
SHA256adf6888aba7baa75948be39cf1065acf5a6abe89669a47032525700931d52989
SHA512274ca295cdf15fc886d2b2e0dad08be7aa089b57d93dc1b55e99aae9b25062ceadc5aca94b70a27b985f2687df9c1e6467793b3bdd71180eed32ea2cb9a7eb25
-
Filesize
272KB
MD5a55d6e95c52bd61fe54e2c68f942e8f6
SHA1b34d74e040e82b86e64a50ba8c74d60c9d27fc09
SHA256adf6888aba7baa75948be39cf1065acf5a6abe89669a47032525700931d52989
SHA512274ca295cdf15fc886d2b2e0dad08be7aa089b57d93dc1b55e99aae9b25062ceadc5aca94b70a27b985f2687df9c1e6467793b3bdd71180eed32ea2cb9a7eb25
-
Filesize
272KB
MD55da9a1f1e4e77893f98ec094b866b7a6
SHA13318068606f1ddcdb32b63b6e04c8c438ba008af
SHA2560eb2f02cdc7c69ceea044f5b6ceb653dc3e971a2187cca65f637682b22ba006d
SHA512d0629e79e61f2122db60614bacec292fa8f04556c3dbd946f298511377d0fbca0047f821fc3b7780187352464442dc9af4b7a3a70b2e91d32b8373cb276e0550
-
Filesize
272KB
MD55da9a1f1e4e77893f98ec094b866b7a6
SHA13318068606f1ddcdb32b63b6e04c8c438ba008af
SHA2560eb2f02cdc7c69ceea044f5b6ceb653dc3e971a2187cca65f637682b22ba006d
SHA512d0629e79e61f2122db60614bacec292fa8f04556c3dbd946f298511377d0fbca0047f821fc3b7780187352464442dc9af4b7a3a70b2e91d32b8373cb276e0550
-
Filesize
272KB
MD57f382332250aa1d13cc818d7bc9e59d9
SHA10ebccd0cad43004e36038f6d072698772e850ada
SHA256680a336872c563cf8d5c6c1be7ff047a443d09df8d3ea54dae2743f6f1bb1eca
SHA5129816ef1a86274e51267f1a67f47e72305c02f75868b9b6618fee1c7a722b951370679b1b77a1baff6bfdc53cf54f1a99d0b8466022cf09c734fb2e2191e3a086
-
Filesize
272KB
MD57f382332250aa1d13cc818d7bc9e59d9
SHA10ebccd0cad43004e36038f6d072698772e850ada
SHA256680a336872c563cf8d5c6c1be7ff047a443d09df8d3ea54dae2743f6f1bb1eca
SHA5129816ef1a86274e51267f1a67f47e72305c02f75868b9b6618fee1c7a722b951370679b1b77a1baff6bfdc53cf54f1a99d0b8466022cf09c734fb2e2191e3a086
-
Filesize
272KB
MD5db7e8590414a4c8a0867277b84515506
SHA10b3b2ef6efad537bde25f1016d0fb4087df5a5fd
SHA25674b922b962af018509a3e94b5060928c79e044dafca0051ec24e76f16a0c4cf0
SHA512de4719a5690c72f45bed7b9a469782f005d6628169985efbd19e21037803cc7f45bc75b612c202dd386ba7d2beffbd997e6bb33ba90083011a888f628e40d748
-
Filesize
272KB
MD5db7e8590414a4c8a0867277b84515506
SHA10b3b2ef6efad537bde25f1016d0fb4087df5a5fd
SHA25674b922b962af018509a3e94b5060928c79e044dafca0051ec24e76f16a0c4cf0
SHA512de4719a5690c72f45bed7b9a469782f005d6628169985efbd19e21037803cc7f45bc75b612c202dd386ba7d2beffbd997e6bb33ba90083011a888f628e40d748
-
Filesize
272KB
MD546af953b73977c1c93d3225bd52db0b0
SHA14fa47b6c31b60032c02b0060f82eb8dff979014d
SHA2561b76524c38aacdc1bef50416c55391ed76f21e32de3713f4511998afe032b21b
SHA512ee8c2f7dedbefc65c6fc7faa8930b3ad92348632a52af017db180dffe7d30146147ad8c2bf583ca338a790d35c31ba2ccd33243a744eeaa8f329ef01cb047f52
-
Filesize
272KB
MD546af953b73977c1c93d3225bd52db0b0
SHA14fa47b6c31b60032c02b0060f82eb8dff979014d
SHA2561b76524c38aacdc1bef50416c55391ed76f21e32de3713f4511998afe032b21b
SHA512ee8c2f7dedbefc65c6fc7faa8930b3ad92348632a52af017db180dffe7d30146147ad8c2bf583ca338a790d35c31ba2ccd33243a744eeaa8f329ef01cb047f52
-
Filesize
272KB
MD5534efe6b083e20e207fe4ac54b024a6e
SHA13e2807fb4ad9ea640c049a0d1783b5e34d245b63
SHA2568076cb777d53164ba23938d893b8dfa4980ed94deef733c47318bc59b64ca023
SHA5121cdaa47bea623c51ae92fcd6b2bbecda7786efec78b548adab058eaf3c213f20dacbf94d8d3e21611efa157326285eb914bf9e397207b0b084f6cc541e59ee10
-
Filesize
272KB
MD5534efe6b083e20e207fe4ac54b024a6e
SHA13e2807fb4ad9ea640c049a0d1783b5e34d245b63
SHA2568076cb777d53164ba23938d893b8dfa4980ed94deef733c47318bc59b64ca023
SHA5121cdaa47bea623c51ae92fcd6b2bbecda7786efec78b548adab058eaf3c213f20dacbf94d8d3e21611efa157326285eb914bf9e397207b0b084f6cc541e59ee10
-
Filesize
272KB
MD531cf9c1c7d328b163e2bb4dc93af82d0
SHA16d8169778c83ccf7678980ae11cc019e8125735a
SHA256f27a932f213338fb8885e7c29bbd1a57d753b0a916a835355c29fae0d5a50791
SHA512b95428c55f053046a116c8dd623b53d3df22ff0fb89bf3328761fd9ec2541c708db8f8da69c565cc4ec97eb19d3ed9da1f49d7a3478952db99d6af328fde8bbf
-
Filesize
272KB
MD531cf9c1c7d328b163e2bb4dc93af82d0
SHA16d8169778c83ccf7678980ae11cc019e8125735a
SHA256f27a932f213338fb8885e7c29bbd1a57d753b0a916a835355c29fae0d5a50791
SHA512b95428c55f053046a116c8dd623b53d3df22ff0fb89bf3328761fd9ec2541c708db8f8da69c565cc4ec97eb19d3ed9da1f49d7a3478952db99d6af328fde8bbf
-
Filesize
272KB
MD531cf9c1c7d328b163e2bb4dc93af82d0
SHA16d8169778c83ccf7678980ae11cc019e8125735a
SHA256f27a932f213338fb8885e7c29bbd1a57d753b0a916a835355c29fae0d5a50791
SHA512b95428c55f053046a116c8dd623b53d3df22ff0fb89bf3328761fd9ec2541c708db8f8da69c565cc4ec97eb19d3ed9da1f49d7a3478952db99d6af328fde8bbf
-
Filesize
272KB
MD531cf9c1c7d328b163e2bb4dc93af82d0
SHA16d8169778c83ccf7678980ae11cc019e8125735a
SHA256f27a932f213338fb8885e7c29bbd1a57d753b0a916a835355c29fae0d5a50791
SHA512b95428c55f053046a116c8dd623b53d3df22ff0fb89bf3328761fd9ec2541c708db8f8da69c565cc4ec97eb19d3ed9da1f49d7a3478952db99d6af328fde8bbf
-
Filesize
272KB
MD531cf9c1c7d328b163e2bb4dc93af82d0
SHA16d8169778c83ccf7678980ae11cc019e8125735a
SHA256f27a932f213338fb8885e7c29bbd1a57d753b0a916a835355c29fae0d5a50791
SHA512b95428c55f053046a116c8dd623b53d3df22ff0fb89bf3328761fd9ec2541c708db8f8da69c565cc4ec97eb19d3ed9da1f49d7a3478952db99d6af328fde8bbf
-
Filesize
272KB
MD531cf9c1c7d328b163e2bb4dc93af82d0
SHA16d8169778c83ccf7678980ae11cc019e8125735a
SHA256f27a932f213338fb8885e7c29bbd1a57d753b0a916a835355c29fae0d5a50791
SHA512b95428c55f053046a116c8dd623b53d3df22ff0fb89bf3328761fd9ec2541c708db8f8da69c565cc4ec97eb19d3ed9da1f49d7a3478952db99d6af328fde8bbf