Analysis
- max time kernel
149s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/09/2026, 16:27
General
- Target 485e6f738b77ae73fae5a55b070d92f6edb9670d63755af0430f0a74913a3d06.exe
- Size 468KB
- Sample260910-tx31nadg46
- SHA256 485e6f738b77ae73fae5a55b070d92f6edb9670d63755af0430f0a74913a3d06
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 64 IoCs
- Executes dropped EXE 45 IoCs
- Program crash 45 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 46 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 46 IoCs
- Suspicious use of WriteProcessMemory 45 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\485e6f738b77ae73fae5a55b070d92f6edb9670d63755af0430f0a74913a3d06.exe"C:\Users\Admin\AppData\Local\Temp\485e6f738b77ae73fae5a55b070d92f6edb9670d63755af0430f0a74913a3d06.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46904.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46904.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17460.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17460.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-604.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-604.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54548.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54548.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45825.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45825.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15347.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15347.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4883.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4883.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60664.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60664.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31220.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31220.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32948.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32948.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65293.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65293.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64437.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64437.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41661.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41661.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18548.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18548.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21812.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21812.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24308.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24308.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46612.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46612.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49108.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49108.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57489.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57489.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39565.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39565.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64920.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64920.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7764.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7764.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6176.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6176.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40733.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40733.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30977.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30977.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34301.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34301.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31945.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31945.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25204.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25204.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62365.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62365.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64861.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64861.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50217.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50217.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43476.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43476.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64145.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64145.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50269.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50269.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26424.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26424.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28884.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28884.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45469.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45469.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6932.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6932.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59252.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59252.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17665.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17665.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7607.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7607.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22356.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22356.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16949.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16949.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14291.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14291.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 75246⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 74045⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 72444⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 74043⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 72442⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 70841⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 75240⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5116 -s 72439⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 74038⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 71237⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 75236⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1132 -s 74035⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 71234⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 74433⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 74432⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 72431⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 74030⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 74029⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 72428⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 72427⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 72426⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 72425⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 72424⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 74423⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 72422⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 72421⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 75220⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 72419⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 74418⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 74017⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 71616⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 72415⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 72414⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 74413⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 72412⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 72411⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 72410⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 7449⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 7528⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 7247⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3900 -s 7526⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4492 -s 7245⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 7524⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 7443⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4100 -s 7242⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4100 -ip 41001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4316 -ip 43161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1652 -ip 16521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4492 -ip 44921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3900 -ip 39001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4608 -ip 46081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3400 -ip 34001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2396 -ip 23961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1656 -ip 16561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4260 -ip 42601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2984 -ip 29841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2684 -ip 26841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4136 -ip 41361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2660 -ip 26601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1800 -ip 18001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 932 -ip 9321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1528 -ip 15281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4008 -ip 40081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4652 -ip 46521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2520 -ip 25201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2340 -ip 23401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1664 -ip 16641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2572 -ip 25721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4020 -ip 40201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3028 -ip 30281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3948 -ip 39481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1724 -ip 17241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3432 -ip 34321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2304 -ip 23041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 4920 -ip 49201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 940 -ip 9401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 828 -ip 8281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1220 -ip 12201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1132 -ip 11321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4864 -ip 48641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2992 -ip 29921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4440 -ip 44401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5116 -ip 51161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2324 -ip 23241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4684 -ip 46841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1584 -ip 15841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1404 -ip 14041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3132 -ip 31321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2568 -ip 25681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2784 -ip 27841⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-15347.exe
Unicorn-17460.exe
Unicorn-18548.exe
Unicorn-21812.exe
Unicorn-24308.exe
Unicorn-25204.exe
Unicorn-30977.exe
Unicorn-31220.exe
Unicorn-31945.exe
Unicorn-32948.exe
Unicorn-34301.exe
Unicorn-39565.exe
Unicorn-40733.exe
Unicorn-41661.exe
Unicorn-43476.exe
Unicorn-45825.exe
Unicorn-46612.exe
Unicorn-46904.exe
Unicorn-4883.exe
Unicorn-49108.exe
Unicorn-50217.exe
Unicorn-54548.exe
Unicorn-57489.exe
Unicorn-604.exe
Unicorn-60664.exe
Unicorn-6176.exe
Unicorn-62365.exe
Unicorn-64437.exe
Unicorn-64861.exe
Unicorn-64920.exe
Unicorn-65293.exe
Unicorn-7764.exe
memory/704-333-0x0000000000400000-0x0000000000475000-memory.dmp
memory/828-246-0x0000000000400000-0x0000000000475000-memory.dmp
memory/828-258-0x0000000000400000-0x0000000000475000-memory.dmp
memory/932-119-0x0000000000400000-0x0000000000475000-memory.dmp
memory/932-130-0x0000000000400000-0x0000000000475000-memory.dmp
memory/940-250-0x0000000000400000-0x0000000000475000-memory.dmp
memory/940-239-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1132-261-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1132-270-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1220-264-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1220-255-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1404-309-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1404-318-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1528-127-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1528-138-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1584-303-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1584-312-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1652-15-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1652-26-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1656-62-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1656-74-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1664-167-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1664-178-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1724-218-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1724-207-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1800-122-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1800-111-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2304-234-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2304-223-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2324-300-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2324-291-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2340-159-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2340-170-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2396-55-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2396-66-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2520-151-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2520-162-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2568-330-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2568-321-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2572-186-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2572-175-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2660-103-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2660-114-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2684-87-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2684-98-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2784-336-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2784-327-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2984-90-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2984-79-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2992-282-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2992-273-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3028-202-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3028-191-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3132-324-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3132-315-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3400-58-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3400-47-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3432-215-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3432-226-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3900-42-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3900-31-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3948-210-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3948-198-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4008-146-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4008-135-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4020-183-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4020-194-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4100-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4100-10-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4136-95-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4136-106-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4260-82-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4260-71-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4316-7-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4316-18-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4440-288-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4440-279-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4492-34-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4492-23-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4608-50-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4608-39-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4652-154-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4652-143-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4684-306-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4684-297-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4864-267-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4864-276-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4920-242-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4920-231-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5116-294-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5116-285-0x0000000000400000-0x0000000000475000-memory.dmp