kawaiiunicorn | 6cfd99de82e84918bfad9ceffb5a1a8ce044dd2cea4da728d64d3cda3e0ba71a

Analysis

max time kernel
149s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 07:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6cfd99de82e84918bfad9ceffb5a1a8ce044dd2cea4da728d64d3cda3e0ba71a.exe
Size 468KB
Sample260826-jc8ejaak21
SHA256 6cfd99de82e84918bfad9ceffb5a1a8ce044dd2cea4da728d64d3cda3e0ba71a
MD5 f308f5dbe0fa43e7cda9c93cc0ca6d3a
SHA1 31b5bcf630da286572ddca0d1671fc8f36d59117
SHA512 669ee1611a6c1dee85f1256b4cf671b20330d2e9f0122a3c7f848c3e74c56c1e5330905b8fc63133d3820e395d9471ddde6e9b65c6164a1315ebb00351b80501
SSDEEP 3072:xKA2q/uquaRM7CbE1gBs04Kjo3/YbSW3NQ/HtFMRJeU0FhuFQUCzoE:xKAn/pi7CegO04KILk4asU0DyQUC
TLSH
T11EA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery kawaiiunicorn trojan

Malware Config

Signatures

Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
trojan kawaiiunicorn

Detects KawaiiUnicorn 56 IoCs

resource	yara_rule
behavioral1/memory/1624-0-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x000800000002447e-5.dat	family_kawaiiunicorn
behavioral1/memory/4844-6-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/1624-10-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x000b000000024483-13.dat	family_kawaiiunicorn
behavioral1/memory/2676-14-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/4844-18-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x000e000000024484-19.dat	family_kawaiiunicorn
behavioral1/memory/3476-22-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/2676-26-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x0010000000024485-29.dat	family_kawaiiunicorn
behavioral1/memory/1848-30-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/3476-34-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x0011000000024486-37.dat	family_kawaiiunicorn
behavioral1/memory/3852-38-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/1848-42-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x000300000001db14-45.dat	family_kawaiiunicorn
behavioral1/memory/3868-46-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/3852-50-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x0014000000024489-53.dat	family_kawaiiunicorn
behavioral1/memory/2012-54-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/3868-58-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/3336-62-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x001500000002448b-61.dat	family_kawaiiunicorn
behavioral1/memory/2012-66-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x000700000002449b-69.dat	family_kawaiiunicorn
behavioral1/memory/4896-70-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/3336-74-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00090000000244a3-77.dat	family_kawaiiunicorn
behavioral1/memory/4140-78-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/4896-82-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x000a0000000244a5-85.dat	family_kawaiiunicorn
behavioral1/memory/2108-86-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/4140-90-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x000d0000000244a6-93.dat	family_kawaiiunicorn
behavioral1/memory/4232-94-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/2108-98-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00120000000244a7-101.dat	family_kawaiiunicorn
behavioral1/memory/2416-102-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/4232-106-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00150000000244a8-109.dat	family_kawaiiunicorn
behavioral1/memory/2208-110-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/2416-114-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00140000000244a9-117.dat	family_kawaiiunicorn
behavioral1/memory/2380-118-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/2208-122-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00150000000244ac-125.dat	family_kawaiiunicorn
behavioral1/memory/3956-126-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/2380-130-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00170000000244ad-133.dat	family_kawaiiunicorn
behavioral1/memory/4996-134-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/3956-138-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00190000000244ae-141.dat	family_kawaiiunicorn
behavioral1/memory/2652-142-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/2652-144-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/4996-145-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn

Executes dropped EXE 18 IoCs

pid	Process
4844	Unicorn-25129.exe
2676	Unicorn-9664.exe
3476	Unicorn-4096.exe
1848	Unicorn-15913.exe
3852	Unicorn-448.exe
3868	Unicorn-19385.exe
2012	Unicorn-10744.exe
3336	Unicorn-60817.exe
4896	Unicorn-30649.exe
4140	Unicorn-11136.exe
2108	Unicorn-18833.exe
4232	Unicorn-45937.exe
2416	Unicorn-63337.exe
2208	Unicorn-62673.exe
2380	Unicorn-33478.exe
3956	Unicorn-4728.exe
4996	Unicorn-53265.exe
2652	Unicorn-29633.exe

Program crash 18 IoCs

pid	pid_target	Process	procid_target
4208	1624	WerFault.exe	86
3784	4844	WerFault.exe	87
3788	2676	WerFault.exe	91
568	3476	WerFault.exe	94
1672	1848	WerFault.exe	97
2360	3852	WerFault.exe	100
3688	3868	WerFault.exe	105
1864	2012	WerFault.exe	110
3328	3336	WerFault.exe	114
944	4896	WerFault.exe	120
4480	4140	WerFault.exe	123
5104	2108	WerFault.exe	127
1568	4232	WerFault.exe	130
3784	2416	WerFault.exe	133
3184	2208	WerFault.exe	136
2124	2380	WerFault.exe	139
2664	3956	WerFault.exe	142
2200	4996	WerFault.exe	145

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6cfd99de82e84918bfad9ceffb5a1a8ce044dd2cea4da728d64d3cda3e0ba71a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15913.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-448.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19385.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10744.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45937.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53265.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29633.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4096.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60817.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30649.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11136.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18833.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9664.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33478.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4728.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25129.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62673.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
1624	6cfd99de82e84918bfad9ceffb5a1a8ce044dd2cea4da728d64d3cda3e0ba71a.exe
4844	Unicorn-25129.exe
2676	Unicorn-9664.exe
3476	Unicorn-4096.exe
1848	Unicorn-15913.exe
3852	Unicorn-448.exe
3868	Unicorn-19385.exe
2012	Unicorn-10744.exe
3336	Unicorn-60817.exe
4896	Unicorn-30649.exe
4140	Unicorn-11136.exe
2108	Unicorn-18833.exe
4232	Unicorn-45937.exe
2416	Unicorn-63337.exe
2208	Unicorn-62673.exe
2380	Unicorn-33478.exe
3956	Unicorn-4728.exe
4996	Unicorn-53265.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 4844	1624	6cfd99de82e84918bfad9ceffb5a1a8ce044dd2cea4da728d64d3cda3e0ba71a.exe	87
PID 4844 wrote to memory of 2676	4844	Unicorn-25129.exe	91
PID 2676 wrote to memory of 3476	2676	Unicorn-9664.exe	94
PID 3476 wrote to memory of 1848	3476	Unicorn-4096.exe	97
PID 1848 wrote to memory of 3852	1848	Unicorn-15913.exe	100
PID 3852 wrote to memory of 3868	3852	Unicorn-448.exe	105
PID 3868 wrote to memory of 2012	3868	Unicorn-19385.exe	110
PID 2012 wrote to memory of 3336	2012	Unicorn-10744.exe	114
PID 3336 wrote to memory of 4896	3336	Unicorn-60817.exe	120
PID 4896 wrote to memory of 4140	4896	Unicorn-30649.exe	123
PID 4140 wrote to memory of 2108	4140	Unicorn-11136.exe	127
PID 2108 wrote to memory of 4232	2108	Unicorn-18833.exe	130
PID 4232 wrote to memory of 2416	4232	Unicorn-45937.exe	133
PID 2416 wrote to memory of 2208	2416	Unicorn-63337.exe	136
PID 2208 wrote to memory of 2380	2208	Unicorn-62673.exe	139
PID 2380 wrote to memory of 3956	2380	Unicorn-33478.exe	142
PID 3956 wrote to memory of 4996	3956	Unicorn-4728.exe	145
PID 4996 wrote to memory of 2652	4996	Unicorn-53265.exe	148

C:\Users\Admin\AppData\Local\Temp\6cfd99de82e84918bfad9ceffb5a1a8ce044dd2cea4da728d64d3cda3e0ba71a.exe
"C:\Users\Admin\AppData\Local\Temp\6cfd99de82e84918bfad9ceffb5a1a8ce044dd2cea4da728d64d3cda3e0ba71a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25129.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25129.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9664.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9664.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4096.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15913.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-448.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19385.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10744.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60817.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30649.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11136.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18833.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45937.exe
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62673.exe
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33478.exe
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4728.exe
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53265.exe
        18⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29633.exe
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2652
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 724
        19⤵
        Program crash
        
        PID:2200
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 724
        18⤵
        Program crash
        
        PID:2664
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 724
        17⤵
        Program crash
        
        PID:2124
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 724
        16⤵
        Program crash
        
        PID:3184
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 724
        15⤵
        Program crash
        
        PID:3784
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 724
        14⤵
        Program crash
        
        PID:1568
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 724
        13⤵
        Program crash
        
        PID:5104
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 724
        12⤵
        Program crash
        
        PID:4480
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 724
        11⤵
        Program crash
        
        PID:944
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 724
        10⤵
        Program crash
        
        PID:3328
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 724
        9⤵
        Program crash
        
        PID:1864
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 724
        8⤵
        Program crash
        
        PID:3688
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 724
        7⤵
        Program crash
        
        PID:2360
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 724
        6⤵
        Program crash
        
        PID:1672
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 724
        5⤵
        Program crash
        
        PID:568
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 724
      4⤵
      Program crash
      PID:3788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 724
    3⤵
    - Program crash
    PID:3784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 724
  2⤵
  - Program crash
  PID:4208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 1624 -ip 1624
1⤵
PID:2596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4844 -ip 4844
1⤵
PID:3696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2676 -ip 2676
1⤵
PID:1960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3476 -ip 3476
1⤵
PID:5052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1848 -ip 1848
1⤵
PID:1964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3852 -ip 3852
1⤵
PID:1676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3868 -ip 3868
1⤵
PID:4832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2012 -ip 2012
1⤵
PID:3380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3336 -ip 3336
1⤵
PID:1760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4896 -ip 4896
1⤵
PID:1904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4140 -ip 4140
1⤵
PID:5100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 2108 -ip 2108
1⤵
PID:4356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4232 -ip 4232
1⤵
PID:4208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 2416 -ip 2416
1⤵
PID:436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 2208 -ip 2208
1⤵
PID:4804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2380 -ip 2380
1⤵
PID:2776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3956 -ip 3956
1⤵
PID:4228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4996 -ip 4996
1⤵
PID:5008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-10744.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-10744.exe
Size 468KB
SHA256 51d4e752671088f8ba6e94c604491a320cf257f563ac81bc74e04ac571ecf879
MD5 99673b8eee082f60be2e8ba848fe9bcb
SHA1 1c5b2f1e11808e988355cd8db49559ba84bc5cae
SHA512 abf7ca46278dac722fe6c4b7f18322dc973435bba7533b6cfcc1f91a8f964d4e30c31cfab5c84fccdfd05f0e0fa71b4d75a8c5556244ac5393a8c9969fe5bfc9
SSDEEP 3072:xKA2q/IqSaRM7CbE1gbs04Kjo3hYbSW3NQlHtFMRJeU0FhuFQUCzo2:xKAn/zi7CegY04KItkmasU0DyQUC
TLSH
T1D2A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-11136.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-11136.exe
Size 468KB
SHA256 be00f2b101f7eacc1fedf956be340a56c3f428296c3dbc634e0f74ee9509ef05
MD5 9324f49569c4b405d561660000d924a3
SHA1 9290802735c045f8b3aa01dfab6fbe002bc72b12
SHA512 f6bd149eabe3289af20ac27b99b6270518ab93272d07ac1eef9bb9b7d9570b4e58602f9a0736d4d3a1a7ca0642cfefc5cece0e95b6ae1aaf57b8f29811947699
SSDEEP 3072:xKA2q/IqSVRM7CbE1gbs04Kjo3hYbSW3NQlHtFMRJuU0FhuFQUCjo2:xKAn/si7CegY04KItkma8U0DyQUC
TLSH
T1EFA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-15913.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-15913.exe
Size 468KB
SHA256 7f689ce17a3eb643a45bb1523006f8f46ed183ca237f267b20fcd177e4d008f5
MD5 a3a0e40dece180f852ddc74044af4f5e
SHA1 34064e79f67cb74ec6732d77ff94c9fb06b21b5d
SHA512 2960cbbf3d142ada3e3c7900b0725f7d66e2e0b5cdc497b959adb33c64036dce0bcd623aebe255319da0eee600961a9a2bf5ee12a396feb470d71e268f527928
SSDEEP 3072:xKA2q/IquaRM7CbE1gbs04Kjo3/YbSW3NQlHtFMRJeU0FhuFQUCzoP:xKAn/Hi7CegY04KILkmasU0DyQUC
TLSH
T1EEA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-18833.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-18833.exe
Size 468KB
SHA256 87c8a85d0542410d4b775eb38449b59844db1fd25b6727ee936d0f196bd45896
MD5 b95e4ccd0e20cb399eaad96004750139
SHA1 00e6ed050b14be7391fe3dbd81e11a666d20c4c9
SHA512 a374e8f16d7196d2021ca0c5f0422593af109e021088577277c9aff14fa1ec41f48ddec9e917cf3ab020fb31e6e290bb9c9cdd7b59436556b3b80a65e590a5fb
SSDEEP 3072:xKA2q/IqSVRM7CbE1gbs04KjD3hYbSW3NQlHtFMRJuU0FhuFQUCjo2:xKAn/si7CegY04Kftkma8U0DyQUC
TLSH
T162A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-19385.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-19385.exe
Size 468KB
SHA256 3704e80367fd589c6ce11d9736c776d5cb4c364b4d4119cd062e6ed462eeccab
MD5 205cb87c503a844aaafdb76d556c2bcc
SHA1 f73c4ae00d83e7bdb213b828b67c45ac034eb56a
SHA512 e1a9f3e20e4a04c6818dd56c385fb169304c4197081c7cc10009ed6a81ac750b12598e3989958726debbc2d70b1400ba2eeb42164bbd69ad3dfc7089fcd1fb74
SSDEEP 3072:xKA2q/IquaRM7CbE1gbs04Kjo3hYbSW3NQlHtFMRJeU0FhuFQUCzo2:xKAn/Hi7CegY04KItkmasU0DyQUC
TLSH
T14EA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-25129.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-25129.exe
Size 468KB
SHA256 c3beac79fe9d9a9a5921cd786837bf2dc61f1d23f76d8632fad39b20f2c5bdbc
MD5 0bb9b787cb92152ab0e7a36b7d9a9042
SHA1 cbd15370192b56e4110adb17d0f570af740d7065
SHA512 54b04d3a70d2f6b487f5d548dbb35dc368a67cff37a078dbadc2510ff974e28350c32f918461a9d6fb28d1469e8e3f8fdc2fcfced41b57af149ba3ef312e7fad
SSDEEP 3072:xKA2q/uquaRM7CbE1gBs04Kjo3/YbSW3NQlHtFMRJeU0FhuFQUCzoE:xKAn/pi7CegO04KILkmasU0DyQUC
TLSH
T147A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-29633.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-29633.exe
Size 468KB
SHA256 a5913774f97581fef54a8d73b93f80840da086f28eb7db2007f7f8a14ce74909
MD5 a5072be55556de79577e5f712365c296
SHA1 4d4e4db8f6ca1286d58879d89a7b35dc4bffb605
SHA512 212dc52acb1a92c3e438c8e21c7eeec6d229f7a1aae88c58a226a4dbb35bbf24a31ed28f72bf315ccdeafff45c78681dbf79dc46812ecbe2f818efebfae0d1ae
SSDEEP 3072:xKA2q/IqSVRM7CbE1gbs04KjD3hYbSW3NQlHtFMRJA50Fh6FGUCto5:xKAn/si7CegY04Kftkmay50DGGUC
TLSH
T178A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-30649.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-30649.exe
Size 468KB
SHA256 974fd7c9eff0140877eeba6debb0416fb873a72ec81b7e4c815ea496d429e37c
MD5 2dd1273782d743b686e2ac45f7675858
SHA1 9dfbe6013a2d0b522155c847515247a212be3e0d
SHA512 f31a6c971264838ca0d73eba089f066ea81981a576f6105d93636c99a4dc72c3829a9d1ee0cd7b3841af4a4cfe8e16cd49cb65094c7c5eb3a4aedf47aeaff919
SSDEEP 3072:xKA2q/IqSaRM7CbE1gbs04Kjo3hYbSW3NQlHtFMRJuU0FhuFQUCjo2:xKAn/zi7CegY04KItkma8U0DyQUC
TLSH
T14CA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-33478.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-33478.exe
Size 468KB
SHA256 5bb410d1428b72516a0382e4cde813432b6e7ba9e901641ed9110254d8a8fef5
MD5 78b835915ddf98cd8ea9ced1e15f0f7a
SHA1 5ab1472649e00292c791c934541b8dc7c44aed07
SHA512 083ab361417ec172d7fa932eacd010728a67107afb8ad0559c4260b34209b7eed5d8e071484ab5447435971d9958c668cafbac650139a7356f30478473d7e576
SSDEEP 3072:xKA2q/IqSVRM7CbE1gbs04KjD3hYbSW3NQlHtFMRJu50Fh6FQUCtoe:xKAn/si7CegY04Kftkma850DGQUC
TLSH
T1A1A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-4096.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-4096.exe
Size 468KB
SHA256 07d8dd29fee89e0cb742fbe527df7b51352714fd50ddf30c001547b3ab63361f
MD5 4271ca8e07d921abcecebfa7e5578a7b
SHA1 a22a1b3b098f801934e6695e44740f9cac27527a
SHA512 0ebd8df5cd055d2f6daa5de174c5523082d150d98933fb7c8598145dda706f1cd49ce6cbeb6e58adb9537e440b00cabbc233df1fc4d09fbe08f85f7c8b55a4ba
SSDEEP 3072:xKA2q/IquaRM7CbE1gBs04Kjo3/YbSW3NQlHtFMRJeU0FhuFQUCzoP:xKAn/Hi7CegO04KILkmasU0DyQUC
TLSH
T1C4A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-448.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-448.exe
Size 468KB
SHA256 0da37c4332c8f05ecee075071be1ba9da9a332fcd91cedb0a1e1926710522bbc
MD5 a01b35a7220c623148ce5200e797ebba
SHA1 4f0eb087b3cc4ef130d93aab4b81481a49e69efa
SHA512 c94d03611b93af585ee39478e7a794df2e97dab0c8be65c669292dafa024186bb17e3ff5f0f374981ea81867ddcdae3b21c72a7cb395f757c59ec4574e9bdddc
SSDEEP 3072:xKA2q/IquaRM7CbE1gbs04Kjo3/YbSW3NQlHtFMRJeU0FhuFQUCzo2:xKAn/Hi7CegY04KILkmasU0DyQUC
TLSH
T149A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-45937.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-45937.exe
Size 468KB
SHA256 9e9b54a92fe22c5c76babbbd8a9de721943a46f22ab4a66083462b12f81a3b64
MD5 233741904514df9e0df96481de1e1a4c
SHA1 21771fc2e8d4db8e9c6bca12a1d02c99ade61c76
SHA512 dbe7a53b3173df3d84f6a7a83f5bc9b33c3351cd3045c85aad32450d04e64f9f53f1121c3ec4d52767e6280efbc5ae57182d5903e1195112a25cb09f0bf53751
SSDEEP 3072:xKA2q/IqSVRM7CbE1gbs04KjD3hYbSW3NQlHtFMRJuU0Fh6FQUCjo2:xKAn/si7CegY04Kftkma8U0DGQUC
TLSH
T1C8A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-4728.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-4728.exe
Size 468KB
SHA256 b33d897cebac660cb12d42a272f100517ed3c5d1d89546603632b54e90e2aa7f
MD5 423647ffb8574449b5bcc27788a349c7
SHA1 eb2ba51ee09c69cea88de0c4a183518a8d75d71f
SHA512 a8c463d3654a56ae1038b5d461c82613623d37b553014ed6861748e6426306b86b0535838fd10ddd88edf9f8be8b7ea9586a6d9a33ff486816efcf19eedaf933
SSDEEP 3072:xKA2q/IqSVRM7CbE1gbs04KjD3hYbSW3NQlHtFMRJu50Fh6FQUCto5:xKAn/si7CegY04Kftkma850DGQUC
TLSH
T1A3A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-53265.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-53265.exe
Size 468KB
SHA256 ff79192c8b785a111e61e2f9e35dbc0cfa27a92987a751d20c9430074d7492c3
MD5 d78fff0a0e099130f444e18f25ec5d63
SHA1 42f69ca83927e6bf0322e96b2bf55a5b384a65e3
SHA512 b4d99870ff5eff9da70cac5369e21510e5786fb61232a6aff061b5754d98fe57810ef98212021cfa0a1ec2e6b628556218080dbd7363082fa2e5dd449533ffe1
SSDEEP 3072:xKA2q/IqSVRM7CbE1gbs04KjD3hYbSW3NQlHtFMRJu50Fh6FGUCto5:xKAn/si7CegY04Kftkma850DGGUC
TLSH
T1C9A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-60817.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-60817.exe
Size 468KB
SHA256 26e3d0d63cee7b2be04ac2f8a2ad72894d1f75eb5d8a1e3396917dc963a2d31a
MD5 f77a1c2f01d918b9f7ea9fe5b0ceed93
SHA1 4f028d93e37c1773538b49693640d29f3cf49569
SHA512 e98f2ae9a6a875575bb73780a804df5d0bcae935efef24d39ae14c9cb4a09dbb2fb83d631d3166548811147212fb05932d70594439cd42e6755a4932e9e1fe3f
SSDEEP 3072:xKA2q/IqSaRM7CbE1gbs04Kjo3hYbSW3NQlHtFMRJeU0FhuFQUCjo2:xKAn/zi7CegY04KItkmasU0DyQUC
TLSH
T189A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-62673.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-62673.exe
Size 468KB
SHA256 2142caff7467649b9ffce342c7668f68584669ec91595a03dd7cf9fdee6637c6
MD5 5740917a7f639b829775936f9f67f5d0
SHA1 a8a0a9c4b67e9f7cbf0c4ddec58b2dd8886dfc76
SHA512 786d08aadec619b8e4315f749854d4eae9982d5e18b02befb574c29d84caf166ca0e66a36445aa664138964aab9204bb32979b68902f335f6afb495f5b75b275
SSDEEP 3072:xKA2q/IqSVRM7CbE1gbs04KjD3hYbSW3NQlHtFMRJuU0Fh6FQUCtoe:xKAn/si7CegY04Kftkma8U0DGQUC
TLSH
T1F8A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-63337.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
Size 468KB
SHA256 2c9507a42f9a9d9c4fd1cc3d45d145cc55077e558fbdb85d800d08261864680a
MD5 757d34c24554bd88d0cf093528056c14
SHA1 5a5c146d58bc69cf98bdd87a4ea96c32e4ee4f21
SHA512 46af1568fe2909802f6fb6c70cb90b15cb6328855336f51455c1e30be81b2e58f01153970361a89bf6b9c0f7d8e5948655fb333befae971ce06489dcfe9864fe
SSDEEP 3072:xKA2q/IqSVRM7CbE1gbs04KjD3hYbSW3NQlHtFMRJuU0Fh6FQUCjoe:xKAn/si7CegY04Kftkma8U0DGQUC
TLSH
T185A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-9664.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-9664.exe
Size 468KB
SHA256 c8fd5bc312707fd7b181c749edcc958f512afd60c867def16985436f6c4e1e47
MD5 507b2cc2746b0139016bc66093a4c301
SHA1 e86cbb4001f70597b81c05a0d0f390867e0b3a9a
SHA512 f6b12435bdbefec6ec76360e84e9f4dd9868b8cfb1407c3ec93e64ae2027d84c06cdd5ea1baced64c58a612359c6aa64b9b172532613a4c5bfce91360eb70df2
SSDEEP 3072:xKA2q/IquaRM7CbE1gBs04Kjo3/YbSW3NQlHtFMRJeU0FhuFQUCzoE:xKAn/Hi7CegO04KILkmasU0DyQUC
TLSH
T186A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1624-0-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1624-10-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1848-30-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1848-42-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2012-54-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2012-66-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2108-98-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2108-86-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2208-110-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2208-122-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2380-130-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2380-118-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2416-102-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2416-114-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2652-144-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2652-142-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2676-26-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2676-14-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3336-74-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3336-62-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3476-34-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3476-22-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3852-50-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3852-38-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3868-58-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3868-46-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3956-126-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3956-138-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4140-90-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4140-78-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4232-106-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4232-94-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4844-18-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4844-6-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4896-82-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4896-70-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4996-134-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4996-145-0x0000000000400000-0x0000000000475000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads