Overview

overview

10

Static

static

10

2026-07-09...ar.exe

windows10-2004-x64

10

2026-07-09...ar.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    114s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/07/2026, 17:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-09_4b0274bfaaf5dad123370b446b14c825_akira_cobalt-strike_coinminer_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
  • Size 11.1MB
  • Sample260709-v474mafv6s
  • SHA256 80e6fc800a324149bc877f21f685c496b3dc0dd2e1873359b447e9eba2d1a59e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoverykawaiiunicornlinkpdftrojan

Malware Config

Signatures

  • Family: KawaiiUnicorn

    KawaiiUnicorn is a trojan written in Visual Basic.

    trojankawaiiunicorn
  • Detects KawaiiUnicorn 34 IoCs
  • Detects executables Discord URL observed in first stage droppers 32 IoCs
  • UPX dump on OEP (original entry point) 33 IoCs
  • Executes dropped EXE 32 IoCs
  • HTTP links in PDF interactive object 33 IoCs

    Detects HTTP links in interactive objects within PDF files.

    pdflink
  • Program crash 31 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 33 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 32 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-09_4b0274bfaaf5dad123370b446b14c825_akira_cobalt-strike_coinminer_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-09_4b0274bfaaf5dad123370b446b14c825_akira_cobalt-strike_coinminer_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4760
    • C:\Users\Admin\AppData\Local\Temp\Unicorn-37634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37634.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:6136
      • C:\Users\Admin\AppData\Local\Temp\Unicorn-7950.exe
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7950.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1840
        • C:\Users\Admin\AppData\Local\Temp\Unicorn-40405.exe
          C:\Users\Admin\AppData\Local\Temp\Unicorn-40405.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4664
          • C:\Users\Admin\AppData\Local\Temp\Unicorn-63970.exe
            C:\Users\Admin\AppData\Local\Temp\Unicorn-63970.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3208
            • C:\Users\Admin\AppData\Local\Temp\Unicorn-59860.exe
              C:\Users\Admin\AppData\Local\Temp\Unicorn-59860.exe
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2520
              • C:\Users\Admin\AppData\Local\Temp\Unicorn-33493.exe
                C:\Users\Admin\AppData\Local\Temp\Unicorn-33493.exe
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:2584
                • C:\Users\Admin\AppData\Local\Temp\Unicorn-60109.exe
                  C:\Users\Admin\AppData\Local\Temp\Unicorn-60109.exe
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:1452
                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-18138.exe
                    C:\Users\Admin\AppData\Local\Temp\Unicorn-18138.exe
                    9⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:4228
                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-36887.exe
                      C:\Users\Admin\AppData\Local\Temp\Unicorn-36887.exe
                      10⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:4912
                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-51251.exe
                        C:\Users\Admin\AppData\Local\Temp\Unicorn-51251.exe
                        11⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:4708
                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-47406.exe
                          C:\Users\Admin\AppData\Local\Temp\Unicorn-47406.exe
                          12⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:1528
                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-43296.exe
                            C:\Users\Admin\AppData\Local\Temp\Unicorn-43296.exe
                            13⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of SetWindowsHookEx
                            • Suspicious use of WriteProcessMemory
                            PID:2960
                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-50177.exe
                              C:\Users\Admin\AppData\Local\Temp\Unicorn-50177.exe
                              14⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of SetWindowsHookEx
                              • Suspicious use of WriteProcessMemory
                              PID:3272
                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-10488.exe
                                C:\Users\Admin\AppData\Local\Temp\Unicorn-10488.exe
                                15⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of SetWindowsHookEx
                                • Suspicious use of WriteProcessMemory
                                PID:1548
                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-13441.exe
                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-13441.exe
                                  16⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  • Suspicious use of WriteProcessMemory
                                  PID:3396
                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-30821.exe
                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-30821.exe
                                    17⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of SetWindowsHookEx
                                    • Suspicious use of WriteProcessMemory
                                    PID:2840
                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-22627.exe
                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-22627.exe
                                      18⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of SetWindowsHookEx
                                      • Suspicious use of WriteProcessMemory
                                      PID:4320
                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-26950.exe
                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-26950.exe
                                        19⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of SetWindowsHookEx
                                        • Suspicious use of WriteProcessMemory
                                        PID:5572
                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-26924.exe
                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-26924.exe
                                          20⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of SetWindowsHookEx
                                          • Suspicious use of WriteProcessMemory
                                          PID:4500
                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-43234.exe
                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-43234.exe
                                            21⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of SetWindowsHookEx
                                            • Suspicious use of WriteProcessMemory
                                            PID:2352
                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-17599.exe
                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-17599.exe
                                              22⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of SetWindowsHookEx
                                              • Suspicious use of WriteProcessMemory
                                              PID:2672
                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-29825.exe
                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-29825.exe
                                                23⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of SetWindowsHookEx
                                                • Suspicious use of WriteProcessMemory
                                                PID:4536
                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-7541.exe
                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-7541.exe
                                                  24⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of SetWindowsHookEx
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:3132
                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-3431.exe
                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-3431.exe
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of SetWindowsHookEx
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3120
                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-41291.exe
                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-41291.exe
                                                      26⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of SetWindowsHookEx
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2068
                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-9770.exe
                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-9770.exe
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of SetWindowsHookEx
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1132
                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-31234.exe
                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-31234.exe
                                                          28⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of SetWindowsHookEx
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4296
                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-45562.exe
                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-45562.exe
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of SetWindowsHookEx
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:3148
                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-41452.exe
                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-41452.exe
                                                              30⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of SetWindowsHookEx
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:3576
                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-41727.exe
                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-41727.exe
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of SetWindowsHookEx
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:2260
                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-20212.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-20212.exe
                                                                  32⤵
                                                                  • Executes dropped EXE
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4636
                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-47861.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-47861.exe
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:476
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 708
                                                                  32⤵
                                                                  • Program crash
                                                                  PID:4384
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3576 -s 708
                                                                31⤵
                                                                • Program crash
                                                                PID:2400
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3148 -s 708
                                                              30⤵
                                                              • Program crash
                                                              PID:1900
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4296 -s 708
                                                            29⤵
                                                            • Program crash
                                                            PID:3468
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 1132 -s 708
                                                          28⤵
                                                          • Program crash
                                                          PID:3692
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 708
                                                        27⤵
                                                        • Program crash
                                                        PID:2268
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 708
                                                      26⤵
                                                      • Program crash
                                                      PID:1996
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 708
                                                    25⤵
                                                    • Program crash
                                                    PID:5236
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 708
                                                  24⤵
                                                  • Program crash
                                                  PID:3352
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 708
                                                23⤵
                                                • Program crash
                                                PID:1708
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 708
                                              22⤵
                                              • Program crash
                                              PID:4444
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4500 -s 708
                                            21⤵
                                            • Program crash
                                            PID:3332
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5572 -s 708
                                          20⤵
                                          • Program crash
                                          PID:4676
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 708
                                        19⤵
                                        • Program crash
                                        PID:2984
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 708
                                      18⤵
                                      • Program crash
                                      PID:4288
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 708
                                    17⤵
                                    • Program crash
                                    PID:2304
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 708
                                  16⤵
                                  • Program crash
                                  PID:4960
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 708
                                15⤵
                                • Program crash
                                PID:5652
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 708
                              14⤵
                              • Program crash
                              PID:3164
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 708
                            13⤵
                            • Program crash
                            PID:2424
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 708
                          12⤵
                          • Program crash
                          PID:4448
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 708
                        11⤵
                        • Program crash
                        PID:1480
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 708
                      10⤵
                      • Program crash
                      PID:5092
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 708
                    9⤵
                    • Program crash
                    PID:5284
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 708
                  8⤵
                  • Program crash
                  PID:3944
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 708
                7⤵
                • Program crash
                PID:4360
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3208 -s 708
              6⤵
              • Program crash
              PID:2128
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 708
            5⤵
            • Program crash
            PID:1876
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 708
          4⤵
          • Program crash
          PID:2188
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 6136 -s 708
        3⤵
        • Program crash
        PID:812
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 708
      2⤵
      • Program crash
      PID:4828
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4760 -ip 4760
    1⤵
      PID:2608
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 6136 -ip 6136
      1⤵
        PID:2396
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1840 -ip 1840
        1⤵
          PID:4140
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4664 -ip 4664
          1⤵
            PID:1352
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3208 -ip 3208
            1⤵
              PID:776
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2520 -ip 2520
              1⤵
                PID:5028
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2584 -ip 2584
                1⤵
                  PID:124
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1452 -ip 1452
                  1⤵
                    PID:5560
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4228 -ip 4228
                    1⤵
                      PID:2260
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4912 -ip 4912
                      1⤵
                        PID:2064
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4708 -ip 4708
                        1⤵
                          PID:4076
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1528 -ip 1528
                          1⤵
                            PID:5820
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 2960 -ip 2960
                            1⤵
                              PID:3292
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3272 -ip 3272
                              1⤵
                                PID:5896
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1548 -ip 1548
                                1⤵
                                  PID:880
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 3396 -ip 3396
                                  1⤵
                                    PID:5364
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 2840 -ip 2840
                                    1⤵
                                      PID:6024
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 4320 -ip 4320
                                      1⤵
                                        PID:1512
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 5572 -ip 5572
                                        1⤵
                                          PID:3104
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 4500 -ip 4500
                                          1⤵
                                            PID:3632
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 2352 -ip 2352
                                            1⤵
                                              PID:4276
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 2672 -ip 2672
                                              1⤵
                                                PID:3020
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 4536 -ip 4536
                                                1⤵
                                                  PID:812
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 3132 -ip 3132
                                                  1⤵
                                                    PID:4764
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 3120 -ip 3120
                                                    1⤵
                                                      PID:5256
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 2068 -ip 2068
                                                      1⤵
                                                        PID:5464
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 1132 -ip 1132
                                                        1⤵
                                                          PID:236
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 4296 -ip 4296
                                                          1⤵
                                                            PID:2764
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 3148 -ip 3148
                                                            1⤵
                                                              PID:296
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 3576 -ip 3576
                                                              1⤵
                                                                PID:5508
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 2260 -ip 2260
                                                                1⤵
                                                                  PID:2004

                                                                Network

                                                                      MITRE ATT&CK Enterprise v16

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      Unicorn-10488.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-10488.exe
                                                                      • Size 11.1MB
                                                                      • SHA256 61b1b7b34bd38c22e43b4e0b920e634eee39731b5d77464aa801781addd6bbef
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Unicorn-13441.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-13441.exe
                                                                      • Size 11.1MB
                                                                      • SHA256 6efdbafc3454a4c300f185f839a3057789868220aeeb98b198399796cd574847
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Unicorn-17599.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-17599.exe
                                                                      • Size 11.1MB
                                                                      • SHA256 1d11a3e82a280b04e92840ef2f8205b130df39e7b820201d45998deabb54e3c1
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Unicorn-18138.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-18138.exe
                                                                      • Size 11.1MB
                                                                      • SHA256 7dc3d1177a03de769ceba5deb28c5b4bd6770e89b836b4796c3ff6a01a297e91
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Unicorn-20212.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-20212.exe
                                                                      • Size 11.1MB
                                                                      • SHA256 654197475f51bb6a82da108f53e2fb61eb3c9837825dc1cc6b2e4aa26873e07b
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Unicorn-22627.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-22627.exe
                                                                      • Size 11.1MB
                                                                      • SHA256 510bcfd366d7e60c06c38a4d5a097ef1774f484dd1535ff9c5aaa1193e810598
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Unicorn-26924.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-26924.exe
                                                                      • Size 11.1MB
                                                                      • SHA256 909e8c48b0926dc9e9f797f4a022baedf6cf4a097e36960350fb292394ca5add
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Unicorn-26950.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-26950.exe
                                                                      • Size 11.1MB
                                                                      • SHA256 8bc9dfbaaca7a925e81854940e4941f3e415bf6586f6780d98a999f584b14e10
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Unicorn-29825.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-29825.exe
                                                                      • Size 11.1MB
                                                                      • SHA256 9fd8c1a00dcd2ed2b914cff9e5ce9467d8b903eca901754dcb71ec6e1251942b
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Unicorn-30821.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-30821.exe
                                                                      • Size 11.1MB
                                                                      • SHA256 f81af01c986cea33ae0fae1d9a6aaf3b94a040b874e1a56fc607c60edee03620
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Unicorn-31234.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-31234.exe
                                                                      • Size 11.1MB
                                                                      • SHA256 5d8c9fc25934e30a83f1cb058a488103f56510e299fa4a808530e7905db25602
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Unicorn-33493.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-33493.exe
                                                                      • Size 11.1MB
                                                                      • SHA256 5ec65689df33c1cb9af1ae914e44c2b5dded675305cee3c7b300b97e05fb88d5
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Unicorn-3431.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-3431.exe
                                                                      • Size 11.1MB
                                                                      • SHA256 be3a4231be3b55aeb8be3fcdbef15c90272158d016cc3b285fa70dd6b74c6143
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Unicorn-36887.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-36887.exe
                                                                      • Size 11.1MB
                                                                      • SHA256 8137f0e5c8587970899ae0304f34b5ef022a7afe813563063b9e919f66a965c3
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Unicorn-37634.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-37634.exe
                                                                      • Size 11.1MB
                                                                      • SHA256 3efbb49148fc6290e1bdab1960a2655b17bd5a7870fb8302f9160355fd7a9045
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Unicorn-40405.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-40405.exe
                                                                      • Size 11.1MB
                                                                      • SHA256 24c2b43df494b463738f2eaa4639cfe2b680cebbc52354ddb3543d23ce5c2c9e
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Unicorn-41291.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-41291.exe
                                                                      • Size 11.1MB
                                                                      • SHA256 9dffe59d7d15903b320133d7d3c84f46bc531f26eb3f269796461bdfd40b8578
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Unicorn-41452.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-41452.exe
                                                                      • Size 11.1MB
                                                                      • SHA256 dea82b9b87b3cfa4fa4ef66a298e8d1c55576dcc1ad4f9171bd40087b60c1544
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Unicorn-41727.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-41727.exe
                                                                      • Size 11.1MB
                                                                      • SHA256 5cc34d92027d14cef6351b2d934dee8182e5071531cefa210d3e728bbec97679
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Unicorn-43234.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-43234.exe
                                                                      • Size 11.1MB
                                                                      • SHA256 6fb5eff6b795d3e54124f2f408e8d665a6fea72f6eec265849cf16a67bdaddd6
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Unicorn-43296.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-43296.exe
                                                                      • Size 11.1MB
                                                                      • SHA256 b280d59cf656108b407272dd4348efed89d1c673e27a148e8697abf724783887
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Unicorn-45562.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-45562.exe
                                                                      • Size 11.1MB
                                                                      • SHA256 ca47b222b91fdb6c6c4fdd5b4d8c64b43c0b25561c5358f29784a720cf95bc01
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Unicorn-47406.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-47406.exe
                                                                      • Size 11.1MB
                                                                      • SHA256 a4c04f5df7af2b5e4c5a873caebfd9e20b077742fa58679dc3c48e8f5390cdd8
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Unicorn-47861.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-47861.exe
                                                                      • Size 11.1MB
                                                                      • SHA256 bb8aeeb82414a5594649f5308c6530551f3f71702e02732281e683c4cab64714
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Unicorn-47861.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-47861.exe
                                                                      • Size 9.4MB
                                                                      • SHA256 48c5d9e6834ee69b98fe8541cd7df2ac7d7cb5cffe68e3aff2d20a25a8c0d8cb
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Unicorn-50177.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-50177.exe
                                                                      • Size 11.1MB
                                                                      • SHA256 f014d6c1b9845796f79b945dfca0290ac17404c7ab27db95f6a23dc71c009e67
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Unicorn-51251.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-51251.exe
                                                                      • Size 11.1MB
                                                                      • SHA256 d0cabef65c61145d357fee3a91ed8c1e17ed27ba4af44a2780612d24a067009a
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Unicorn-59860.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-59860.exe
                                                                      • Size 11.1MB
                                                                      • SHA256 98bcf72a93651a39e964878474ff64d73427c1f9c6b69746e3bfbc500a40c936
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Unicorn-60109.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-60109.exe
                                                                      • Size 11.1MB
                                                                      • SHA256 f3a4e8942a2e8d209f2e5c52b9c3da64c4fabb5db3147ae8d4542454e0c21e05
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Unicorn-63970.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-63970.exe
                                                                      • Size 11.1MB
                                                                      • SHA256 b311b4a05f2fc6b2443180467229d9bb623b7bd80efe4a5f1901f81a82a94035
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Unicorn-7541.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-7541.exe
                                                                      • Size 11.1MB
                                                                      • SHA256 c440d0e56557af09ca83c44207d2c881d5326bcd45c9bef1cb10aaf1dc2f38b5
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Unicorn-7950.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-7950.exe
                                                                      • Size 11.1MB
                                                                      • SHA256 e9f8b4d0ce4024f810e2c5defe940cefffbf8738b2df1155bb109e94a72e05ca
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Unicorn-9770.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-9770.exe
                                                                      • Size 11.1MB
                                                                      • SHA256 1455d6d5913e303782eaafd0d9dea3a81b0cd714159977a47861c816ff424dec
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      memory/1132-220-0x0000000000400000-0x0000000000475000-memory.dmp
                                                                      Download

                                                                      memory/1452-67-0x0000000000400000-0x0000000000475000-memory.dmp
                                                                      Download

                                                                      memory/1528-99-0x0000000000400000-0x0000000000475000-memory.dmp
                                                                      Download

                                                                      memory/1548-123-0x0000000000400000-0x0000000000475000-memory.dmp
                                                                      Download

                                                                      memory/1840-15-0x0000000000400000-0x0000000000475000-memory.dmp
                                                                      Download

                                                                      memory/1840-27-0x0000000000400000-0x0000000000475000-memory.dmp
                                                                      Download

                                                                      memory/2068-212-0x0000000000400000-0x0000000000475000-memory.dmp
                                                                      Download

                                                                      memory/2260-252-0x0000000000400000-0x0000000000475000-memory.dmp
                                                                      Download

                                                                      memory/2352-171-0x0000000000400000-0x0000000000475000-memory.dmp
                                                                      Download

                                                                      memory/2520-51-0x0000000000400000-0x0000000000475000-memory.dmp
                                                                      Download

                                                                      memory/2584-59-0x0000000000400000-0x0000000000475000-memory.dmp
                                                                      Download

                                                                      memory/2672-179-0x0000000000400000-0x0000000000475000-memory.dmp
                                                                      Download

                                                                      memory/2840-139-0x0000000000400000-0x0000000000475000-memory.dmp
                                                                      Download

                                                                      memory/2960-107-0x0000000000400000-0x0000000000475000-memory.dmp
                                                                      Download

                                                                      memory/3120-204-0x0000000000400000-0x0000000000475000-memory.dmp
                                                                      Download

                                                                      memory/3132-184-0x0000000000400000-0x0000000000475000-memory.dmp
                                                                      Download

                                                                      memory/3132-196-0x0000000000400000-0x0000000000475000-memory.dmp
                                                                      Download

                                                                      memory/3148-236-0x0000000000400000-0x0000000000475000-memory.dmp
                                                                      Download

                                                                      memory/3208-43-0x0000000000400000-0x0000000000475000-memory.dmp
                                                                      Download

                                                                      memory/3272-115-0x0000000000400000-0x0000000000475000-memory.dmp
                                                                      Download

                                                                      memory/3396-131-0x0000000000400000-0x0000000000475000-memory.dmp
                                                                      Download

                                                                      memory/3576-244-0x0000000000400000-0x0000000000475000-memory.dmp
                                                                      Download

                                                                      memory/4228-75-0x0000000000400000-0x0000000000475000-memory.dmp
                                                                      Download

                                                                      memory/4296-228-0x0000000000400000-0x0000000000475000-memory.dmp
                                                                      Download

                                                                      memory/4320-147-0x0000000000400000-0x0000000000475000-memory.dmp
                                                                      Download

                                                                      memory/4500-163-0x0000000000400000-0x0000000000475000-memory.dmp
                                                                      Download

                                                                      memory/4536-188-0x0000000000400000-0x0000000000475000-memory.dmp
                                                                      Download

                                                                      memory/4664-35-0x0000000000400000-0x0000000000475000-memory.dmp
                                                                      Download

                                                                      memory/4708-91-0x0000000000400000-0x0000000000475000-memory.dmp
                                                                      Download

                                                                      memory/4760-0-0x0000000000400000-0x0000000000475000-memory.dmp
                                                                      Download

                                                                      memory/4760-10-0x0000000000400000-0x0000000000475000-memory.dmp
                                                                      Download

                                                                      memory/4912-83-0x0000000000400000-0x0000000000475000-memory.dmp
                                                                      Download

                                                                      memory/5572-155-0x0000000000400000-0x0000000000475000-memory.dmp
                                                                      Download

                                                                      memory/6136-19-0x0000000000400000-0x0000000000475000-memory.dmp
                                                                      Download