Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/09/2026, 17:08
General
- Target 4c138a8a88bb0db71081f8649fbbc2a9f3bdebd8f83d34b10b6e69464a7a6d11.exe
- Size 468KB
- Sample260910-vnlwfsem3t
- SHA256 4c138a8a88bb0db71081f8649fbbc2a9f3bdebd8f83d34b10b6e69464a7a6d11
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 64 IoCs
- Executes dropped EXE 45 IoCs
- Program crash 45 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 46 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 46 IoCs
- Suspicious use of WriteProcessMemory 45 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c138a8a88bb0db71081f8649fbbc2a9f3bdebd8f83d34b10b6e69464a7a6d11.exe"C:\Users\Admin\AppData\Local\Temp\4c138a8a88bb0db71081f8649fbbc2a9f3bdebd8f83d34b10b6e69464a7a6d11.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20512.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20512.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58887.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58887.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30548.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30548.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15904.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15904.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10231.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10231.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41171.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41171.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34923.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34923.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35136.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35136.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29464.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29464.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9702.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9702.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42012.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42012.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45276.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45276.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26548.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26548.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16792.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16792.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64103.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64103.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21543.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21543.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44952.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44952.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14438.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14438.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26172.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26172.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19732.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19732.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39488.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39488.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33816.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33816.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11003.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11003.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1247.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1247.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60967.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60967.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6395.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6395.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54008.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54008.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32732.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32732.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58087.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58087.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57532.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57532.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52628.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52628.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42872.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42872.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7807.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7807.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9234.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9234.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34048.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34048.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48796.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48796.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62776.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62776.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65236.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65236.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11131.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11131.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57639.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57639.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23488.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23488.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38236.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38236.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19207.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19207.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52128.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52128.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54588.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54588.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3332 -s 74446⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 74445⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 72444⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 74443⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 72442⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 71641⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 74440⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 74039⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 72438⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 72437⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 75236⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 72435⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 72434⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 75233⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 75232⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 75231⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 72430⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 74029⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 70828⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 72427⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 74426⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 74825⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 72424⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3356 -s 72423⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 74022⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 71621⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 74420⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 72419⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 74418⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 71617⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 204 -s 74416⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 596 -s 71615⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 74414⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 75213⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 74412⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 72411⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1412 -s 74410⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 7529⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 7248⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 7247⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 7246⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 7445⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 7244⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 7283⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 7442⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3156 -ip 31561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2424 -ip 24241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2260 -ip 22601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1860 -ip 18601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2908 -ip 29081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2892 -ip 28921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3804 -ip 38041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1356 -ip 13561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1412 -ip 14121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3336 -ip 33361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4840 -ip 48401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4516 -ip 45161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4308 -ip 43081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 596 -ip 5961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 204 -ip 2041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3680 -ip 36801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4084 -ip 40841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4440 -ip 44401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4792 -ip 47921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3052 -ip 30521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3028 -ip 30281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3356 -ip 33561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4664 -ip 46641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4636 -ip 46361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2316 -ip 23161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 2304 -ip 23041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2572 -ip 25721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2096 -ip 20961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4008 -ip 40081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 2676 -ip 26761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 4276 -ip 42761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 3504 -ip 35041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3944 -ip 39441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 1528 -ip 15281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2268 -ip 22681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2348 -ip 23481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 564 -ip 5641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 4264 -ip 42641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 2636 -ip 26361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 116 -ip 1161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 5056 -ip 50561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 3056 -ip 30561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 2168 -ip 21681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4536 -ip 45361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 3332 -ip 33321⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-10231.exe
Unicorn-11003.exe
Unicorn-1247.exe
Unicorn-14438.exe
Unicorn-15904.exe
Unicorn-16792.exe
Unicorn-19732.exe
Unicorn-20512.exe
Unicorn-21543.exe
Unicorn-26172.exe
Unicorn-26548.exe
Unicorn-29464.exe
Unicorn-30548.exe
Unicorn-32732.exe
Unicorn-33816.exe
Unicorn-34923.exe
Unicorn-35136.exe
Unicorn-39488.exe
Unicorn-41171.exe
Unicorn-42012.exe
Unicorn-42872.exe
Unicorn-44952.exe
Unicorn-45276.exe
Unicorn-52628.exe
Unicorn-54008.exe
Unicorn-57532.exe
Unicorn-58087.exe
Unicorn-58887.exe
Unicorn-60967.exe
Unicorn-6395.exe
Unicorn-64103.exe
Unicorn-9702.exe
memory/116-306-0x0000000000400000-0x0000000000475000-memory.dmp
memory/116-297-0x0000000000400000-0x0000000000475000-memory.dmp
memory/204-111-0x0000000000400000-0x0000000000475000-memory.dmp
memory/204-122-0x0000000000400000-0x0000000000475000-memory.dmp
memory/564-288-0x0000000000400000-0x0000000000475000-memory.dmp
memory/564-279-0x0000000000400000-0x0000000000475000-memory.dmp
memory/596-103-0x0000000000400000-0x0000000000475000-memory.dmp
memory/596-114-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1356-55-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1356-66-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1412-74-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1412-63-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1528-270-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1528-261-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1860-34-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1860-23-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2044-333-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2096-215-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2096-226-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2168-324-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2168-315-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2260-26-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2260-14-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2268-267-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2268-276-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2304-199-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2304-210-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2316-202-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2316-190-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2348-282-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2348-273-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2424-18-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2424-7-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2572-218-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2572-207-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2636-300-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2636-291-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2676-242-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2676-231-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2892-50-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2892-39-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2908-31-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2908-42-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3028-159-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3028-170-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3052-151-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3052-162-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3056-318-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3056-309-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3156-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3156-10-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3332-327-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3332-336-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3336-82-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3336-71-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3356-167-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3356-178-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3504-258-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3504-247-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3680-119-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3680-130-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3804-58-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3804-47-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3944-264-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3944-255-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4008-223-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4008-234-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4084-138-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4084-126-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4264-285-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4264-294-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4276-250-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4276-239-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4308-106-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4308-95-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4440-135-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4440-146-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4516-98-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4516-87-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4536-321-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4536-330-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4636-194-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4636-183-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4664-175-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4664-186-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4792-154-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4792-143-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4840-79-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4840-90-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5056-312-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5056-303-0x0000000000400000-0x0000000000475000-memory.dmp