Analysis
- max time kernel
149s - max time network
132s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/09/2026, 09:20
General
- Target 21ede04bef51da8739427d100abd8dd605c6ad29e8cb60fb9531a43e984266fc.exe
- Size 468KB
- Sample260910-lazeys1cqb
- SHA256 21ede04bef51da8739427d100abd8dd605c6ad29e8cb60fb9531a43e984266fc
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 64 IoCs
- Executes dropped EXE 44 IoCs
- Program crash 45 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 46 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 45 IoCs
- Suspicious use of WriteProcessMemory 44 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\21ede04bef51da8739427d100abd8dd605c6ad29e8cb60fb9531a43e984266fc.exe"C:\Users\Admin\AppData\Local\Temp\21ede04bef51da8739427d100abd8dd605c6ad29e8cb60fb9531a43e984266fc.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7153.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7153.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33770.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33770.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16770.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16770.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63998.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63998.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-573.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-573.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24702.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24702.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55402.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55402.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45226.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45226.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51422.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51422.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55070.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55070.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61038.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61038.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63150.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63150.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46342.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46342.exe14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3529.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3529.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33161.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33161.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48558.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48558.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64458.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64458.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54282.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54282.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56394.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56394.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51838.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51838.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17002.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17002.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27282.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27282.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55398.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55398.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61594.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61594.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55406.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55406.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53434.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53434.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61166.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61166.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50990.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50990.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24322.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24322.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15682.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15682.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21878.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21878.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28074.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28074.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26066.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26066.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-933.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-933.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48126.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48126.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1037.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1037.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23762.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23762.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6953.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6953.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4981.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4981.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60342.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60342.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21422.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21422.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34162.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34162.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15662.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15662.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9605.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9605.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-594.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-594.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 74446⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 74045⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 74044⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 72043⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 71642⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 72441⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 74040⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 74439⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 72438⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3500 -s 75237⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1496 -s 72436⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 74435⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 72434⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 74033⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 74032⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 72431⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 74030⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 72429⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 75228⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 75227⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 74426⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 75225⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 72424⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 72423⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 32 -s 71622⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 74421⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 72420⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 72419⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 72418⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 72417⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 72416⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 72415⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 74014⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 72413⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5116 -s 72412⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 72411⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 72410⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 7409⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 7408⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 7527⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 7246⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3892 -s 7525⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3304 -s 7284⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 7243⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 7442⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4540 -ip 45401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4800 -ip 48001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3304 -ip 33041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3892 -ip 38921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4232 -ip 42321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3952 -ip 39521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3888 -ip 38881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3536 -ip 35361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1300 -ip 13001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1636 -ip 16361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5116 -ip 51161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3272 -ip 32721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4760 -ip 47601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4008 -ip 40081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2264 -ip 22641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3488 -ip 34881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1612 -ip 16121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1288 -ip 12881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4988 -ip 49881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2156 -ip 21561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 32 -ip 321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3572 -ip 35721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3964 -ip 39641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4660 -ip 46601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1616 -ip 16161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4756 -ip 47561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4060 -ip 40601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1224 -ip 12241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1476 -ip 14761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4268 -ip 42681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4992 -ip 49921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2812 -ip 28121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4712 -ip 47121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4420 -ip 44201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1496 -ip 14961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3500 -ip 35001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3828 -ip 38281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2276 -ip 22761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4624 -ip 46241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2720 -ip 27201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2736 -ip 27361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5060 -ip 50601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4184 -ip 41841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4080 -ip 40801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1460 -ip 14601⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-15682.exe
Unicorn-16770.exe
Unicorn-17002.exe
Unicorn-21878.exe
Unicorn-24322.exe
Unicorn-24702.exe
Unicorn-26066.exe
Unicorn-27282.exe
Unicorn-28074.exe
Unicorn-33161.exe
Unicorn-33770.exe
Unicorn-3529.exe
Unicorn-45226.exe
Unicorn-48558.exe
Unicorn-50990.exe
Unicorn-51422.exe
Unicorn-51838.exe
Unicorn-53434.exe
Unicorn-54282.exe
Unicorn-55070.exe
Unicorn-55398.exe
Unicorn-55402.exe
Unicorn-55406.exe
Unicorn-56394.exe
Unicorn-573.exe
Unicorn-61038.exe
Unicorn-61166.exe
Unicorn-61594.exe
Unicorn-63150.exe
Unicorn-63998.exe
Unicorn-64458.exe
Unicorn-7153.exe
Unicorn-933.exe
memory/32-152-0x0000000000400000-0x0000000000475000-memory.dmp
memory/32-163-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1224-219-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1224-208-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1288-139-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1288-128-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1300-74-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1300-63-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1460-332-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1460-323-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1476-227-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1476-216-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1496-272-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1496-263-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1612-120-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1612-131-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1616-184-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1616-195-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1636-82-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1636-71-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2156-144-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2156-155-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2264-104-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2264-115-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2276-281-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2276-290-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2720-302-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2720-293-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2736-308-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2736-299-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2812-251-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2812-240-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3100-329-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3272-87-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3272-95-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3304-26-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3304-15-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3488-111-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3488-123-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3500-269-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3500-278-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3536-55-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3536-66-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3572-171-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3572-160-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3828-284-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3828-275-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3888-47-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3888-58-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3892-34-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3892-23-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3952-39-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3952-50-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3964-179-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3964-168-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4008-107-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4008-96-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4060-211-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4060-200-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4080-317-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4080-326-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4184-320-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4184-311-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4232-31-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4232-42-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4268-235-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4268-224-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4420-266-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4420-256-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4540-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4540-10-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4624-296-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4624-287-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4660-176-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4660-187-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4712-259-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4712-248-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4756-203-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4756-192-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4760-99-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4760-94-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4800-7-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4800-18-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4988-136-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4988-147-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4992-232-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4992-243-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5060-314-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5060-305-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5116-90-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5116-79-0x0000000000400000-0x0000000000475000-memory.dmp