Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
26/08/2026, 08:35
General
- Target 3abb80857209b8222b5ad26d838da3bcb7e2ae179622647045539e80f6a169ef.exe
- Size 468KB
- Sample260826-khdmsavgla
- SHA256 3abb80857209b8222b5ad26d838da3bcb7e2ae179622647045539e80f6a169ef
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 64 IoCs
- Executes dropped EXE 45 IoCs
- Program crash 43 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 46 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 46 IoCs
- Suspicious use of WriteProcessMemory 45 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3abb80857209b8222b5ad26d838da3bcb7e2ae179622647045539e80f6a169ef.exe"C:\Users\Admin\AppData\Local\Temp\3abb80857209b8222b5ad26d838da3bcb7e2ae179622647045539e80f6a169ef.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51292.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51292.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38220.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38220.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56668.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56668.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34611.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34611.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40807.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40807.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55135.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55135.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21835.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21835.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36163.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36163.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50527.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50527.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13142.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13142.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19303.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19303.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33475.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33475.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1207.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1207.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2250.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2250.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8446.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8446.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62136.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62136.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57087.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57087.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24856.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24856.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54451.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54451.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52479.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52479.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19179.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19179.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45855.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45855.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44760.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44760.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14630.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14630.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37163.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37163.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43359.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43359.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42887.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42887.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30547.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30547.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34195.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34195.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19935.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19935.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22047.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22047.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36411.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36411.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5814.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5814.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5378.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5378.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40319.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40319.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9566.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9566.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17299.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17299.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64491.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64491.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46183.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46183.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60607.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60607.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50467.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50467.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33695.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33695.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15350.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15350.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 75244⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 75243⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 72442⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 75241⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 74440⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 71639⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 75238⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 74437⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 75236⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 74035⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 75234⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 74433⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3900 -s 75232⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 74031⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 75230⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 72429⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 74428⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3884 -s 72427⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 74426⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3832 -s 75225⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 74024⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 75223⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 75222⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 74421⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3824 -s 54820⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 74019⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 75218⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 75217⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 75216⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 72415⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 74414⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 72413⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 74412⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 72411⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 75210⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3288 -s 7249⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 7248⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 7527⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 7526⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4692 -s 7245⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 7404⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5116 -s 7443⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 7402⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2564 -ip 25641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5116 -ip 51161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3904 -ip 39041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4692 -ip 46921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 924 -ip 9241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4844 -ip 48441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2776 -ip 27761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3288 -ip 32881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1964 -ip 19641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4756 -ip 47561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3116 -ip 31161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4572 -ip 45721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 980 -ip 9801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2064 -ip 20641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2900 -ip 29001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4016 -ip 40161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3812 -ip 38121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3824 -ip 38241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4916 -ip 49161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2816 -ip 28161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1708 -ip 17081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1544 -ip 15441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3832 -ip 38321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3940 -ip 39401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3884 -ip 38841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1012 -ip 10121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4648 -ip 46481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1344 -ip 13441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3588 -ip 35881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3900 -ip 39001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3192 -ip 31921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4444 -ip 44441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3948 -ip 39481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4800 -ip 48001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1664 -ip 16641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 940 -ip 9401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4812 -ip 48121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4652 -ip 46521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2020 -ip 20201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2492 -ip 24921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3144 -ip 31441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2528 -ip 25281⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-1207.exe
Unicorn-13142.exe
Unicorn-14630.exe
Unicorn-19179.exe
Unicorn-19303.exe
Unicorn-19935.exe
Unicorn-21835.exe
Unicorn-2250.exe
Unicorn-24856.exe
Unicorn-30547.exe
Unicorn-33475.exe
Unicorn-34195.exe
Unicorn-34611.exe
Unicorn-36163.exe
Unicorn-37163.exe
Unicorn-38220.exe
Unicorn-40319.exe
Unicorn-40807.exe
Unicorn-42887.exe
Unicorn-43359.exe
Unicorn-44760.exe
Unicorn-45855.exe
Unicorn-50527.exe
Unicorn-51292.exe
Unicorn-52479.exe
Unicorn-54451.exe
Unicorn-55011.exe
Unicorn-55135.exe
Unicorn-56668.exe
Unicorn-57087.exe
Unicorn-62136.exe
Unicorn-65419.exe
Unicorn-8446.exe
memory/924-30-0x0000000000400000-0x0000000000475000-memory.dmp
memory/924-49-0x0000000000400000-0x0000000000475000-memory.dmp
memory/940-277-0x0000000000400000-0x0000000000475000-memory.dmp
memory/940-292-0x0000000000400000-0x0000000000475000-memory.dmp
memory/980-102-0x0000000000400000-0x0000000000475000-memory.dmp
memory/980-121-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1012-225-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1012-206-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1344-240-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1344-222-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1544-193-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1544-174-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1664-271-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1664-286-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1708-166-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1708-185-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1964-81-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1964-62-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2020-310-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2020-295-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2064-129-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2064-109-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2284-86-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2284-105-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2492-316-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2492-301-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2528-328-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2528-313-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2564-17-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2564-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2636-331-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2776-46-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2776-65-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2816-158-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2816-177-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2900-137-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2900-118-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3116-78-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3116-97-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3144-322-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3144-307-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3192-262-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3192-245-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3288-54-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3288-73-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3588-248-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3588-230-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3812-153-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3812-134-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3824-161-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3824-142-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3832-182-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3832-201-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3884-198-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3884-217-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3900-256-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3904-33-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3904-14-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3912-325-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3940-209-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3940-190-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3948-274-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3948-259-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4016-145-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4016-126-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4444-253-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4444-268-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4572-93-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4572-113-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4648-214-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4648-233-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4652-289-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4652-304-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4692-41-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4692-22-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4756-89-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4756-70-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4800-280-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4800-265-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4812-283-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4812-298-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4844-57-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4844-38-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4916-169-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4916-150-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5040-319-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5116-7-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5116-25-0x0000000000400000-0x0000000000475000-memory.dmp