Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
27/08/2026, 07:23
General
- Target e564f549bcd6f54d46c4cae7fcc58194facb3474edf7f5f9068e984b8aaaed33.exe
- Size 468KB
- Sample260827-h77aaaem2w
- SHA256 e564f549bcd6f54d46c4cae7fcc58194facb3474edf7f5f9068e984b8aaaed33
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 64 IoCs
- Executes dropped EXE 44 IoCs
- Program crash 45 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 46 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 45 IoCs
- Suspicious use of WriteProcessMemory 44 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e564f549bcd6f54d46c4cae7fcc58194facb3474edf7f5f9068e984b8aaaed33.exe"C:\Users\Admin\AppData\Local\Temp\e564f549bcd6f54d46c4cae7fcc58194facb3474edf7f5f9068e984b8aaaed33.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53475.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53475.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39739.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39739.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32635.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32635.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23899.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23899.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51003.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51003.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6794.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6794.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6322.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6322.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40059.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40059.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1626.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1626.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41995.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41995.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14314.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14314.exe12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49587.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49587.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17787.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17787.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58059.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58059.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60659.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60659.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28859.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28859.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24147.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24147.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33187.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33187.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52123.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52123.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61163.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61163.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28211.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28211.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63483.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63483.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34267.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34267.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51571.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51571.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46003.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46003.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6034.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6034.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13538.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13538.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29019.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29019.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31427.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31427.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40659.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40659.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49328.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49328.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54320.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54320.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48752.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48752.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24264.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24264.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-631.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-631.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60408.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60408.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24368.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24368.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23704.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23704.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57248.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57248.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27080.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27080.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3447.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3447.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31408.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31408.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 72446⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 74045⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 74444⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 71243⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 72442⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 74441⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 75240⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 72439⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 74438⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 72437⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 72436⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 74435⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 72434⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 74433⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3216 -s 74032⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3692 -s 70831⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4160 -s 74430⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 74429⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 74428⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 74427⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 72426⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4392 -s 74025⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 74424⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 74423⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 72422⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 71621⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 74420⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 74019⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3864 -s 72418⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 72817⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 75216⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 74415⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 74014⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 74413⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 72812⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 75211⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 70810⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3900 -s 7449⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 7528⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 7247⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 7446⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3752 -s 7085⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 7444⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 7443⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 7242⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3704 -ip 37041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3780 -ip 37801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1332 -ip 13321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3752 -ip 37521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3240 -ip 32401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5028 -ip 50281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 2896 -ip 28961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 3900 -ip 39001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2724 -ip 27241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 2760 -ip 27601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 1956 -ip 19561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 1644 -ip 16441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 5024 -ip 50241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 2180 -ip 21801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 4708 -ip 47081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 2148 -ip 21481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 3864 -ip 38641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 1940 -ip 19401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 4860 -ip 48601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 3520 -ip 35201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4516 -ip 45161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 5020 -ip 50201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5080 -ip 50801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4392 -ip 43921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3424 -ip 34241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3480 -ip 34801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 1812 -ip 18121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 1804 -ip 18041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4160 -ip 41601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 3692 -ip 36921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3216 -ip 32161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1056 -ip 10561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3016 -ip 30161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2504 -ip 25041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5016 -ip 50161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4468 -ip 44681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3276 -ip 32761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4068 -ip 40681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3012 -ip 30121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4264 -ip 42641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4956 -ip 49561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2428 -ip 24281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4604 -ip 46041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4084 -ip 40841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1968 -ip 19681⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-13538.exe
Unicorn-16139.exe
Unicorn-1626.exe
Unicorn-17787.exe
Unicorn-23899.exe
Unicorn-24147.exe
Unicorn-28147.exe
Unicorn-28211.exe
Unicorn-28859.exe
Unicorn-29019.exe
Unicorn-31427.exe
Unicorn-32635.exe
Unicorn-33187.exe
Unicorn-34267.exe
Unicorn-39739.exe
Unicorn-40059.exe
Unicorn-40659.exe
Unicorn-41995.exe
Unicorn-46003.exe
Unicorn-49328.exe
Unicorn-49587.exe
Unicorn-51003.exe
Unicorn-51571.exe
Unicorn-52123.exe
Unicorn-53475.exe
Unicorn-54320.exe
Unicorn-58059.exe
Unicorn-6034.exe
Unicorn-60659.exe
Unicorn-61163.exe
Unicorn-6322.exe
Unicorn-63483.exe
Unicorn-6794.exe
memory/748-328-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1056-250-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1056-239-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1332-26-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1332-15-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1644-91-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1644-80-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1804-206-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1804-218-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1812-199-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1812-210-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1940-138-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1940-128-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1956-78-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1956-83-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1968-322-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1968-331-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2148-112-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2148-123-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2180-107-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2180-96-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2428-313-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2428-304-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2504-255-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2504-265-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2724-63-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2724-74-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2760-79-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2760-71-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2896-58-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2896-47-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3012-286-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3012-295-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3016-258-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3016-247-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3216-242-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3216-231-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3240-30-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3240-42-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3276-274-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3276-283-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3424-194-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3424-182-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3480-191-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3480-202-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3520-154-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3520-143-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3692-222-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3692-234-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3704-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3704-10-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3752-23-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3752-34-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3780-18-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3780-7-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3864-131-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3864-120-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3900-66-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3900-55-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4068-280-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4068-289-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4084-325-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4084-316-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4160-226-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4160-215-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4264-301-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4264-292-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4392-186-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4392-175-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4468-277-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4468-268-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4516-162-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4516-151-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4604-319-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4604-310-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4708-115-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4708-104-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4860-146-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4956-298-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4956-307-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5016-271-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5016-262-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5020-159-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5020-170-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5024-99-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5024-88-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5028-50-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5028-39-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5080-178-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5080-167-0x0000000000400000-0x0000000000475000-memory.dmp