Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/09/2026, 18:32
General
- Target 5425189188441ecb7b1bcd26e47e92c0c6485fcb803cc344fa3ef8b2b3abd766.exe
- Size 468KB
- Sample260910-w62v3athmc
- SHA256 5425189188441ecb7b1bcd26e47e92c0c6485fcb803cc344fa3ef8b2b3abd766
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 64 IoCs
- Executes dropped EXE 45 IoCs
- Program crash 45 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 46 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 46 IoCs
- Suspicious use of WriteProcessMemory 45 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5425189188441ecb7b1bcd26e47e92c0c6485fcb803cc344fa3ef8b2b3abd766.exe"C:\Users\Admin\AppData\Local\Temp\5425189188441ecb7b1bcd26e47e92c0c6485fcb803cc344fa3ef8b2b3abd766.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55944.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55944.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16064.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16064.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25960.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25960.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4517.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4517.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42426.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42426.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11481.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11481.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26832.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26832.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29930.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29930.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5075.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5075.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53290.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53290.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62418.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62418.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31474.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31474.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53046.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53046.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9045.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9045.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12143.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12143.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16010.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16010.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21054.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21054.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24152.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24152.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15730.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15730.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49554.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49554.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64904.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64904.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20940.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20940.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12517.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12517.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50426.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50426.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24744.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24744.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59336.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59336.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15371.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15371.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6181.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6181.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57110.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57110.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25398.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25398.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59222.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59222.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31594.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31594.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53898.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53898.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18102.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18102.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45704.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45704.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24298.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24298.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54806.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54806.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53784.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53784.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52798.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52798.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-665.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-665.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61132.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61132.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42440.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42440.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8745.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8745.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54822.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54822.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-551.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-551.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 71646⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 74045⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 72444⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 72043⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 74442⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 516 -s 71641⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 74440⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 75239⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 72438⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 74437⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 72436⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 71235⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 74434⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 75233⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 74032⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 72431⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 74430⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 452 -s 74429⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 72028⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 72427⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 72426⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 72425⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 71624⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 72423⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 72422⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 72421⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 74020⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 75219⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3820 -s 74418⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 72417⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 71616⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 72415⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3832 -s 74414⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 74413⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 72412⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 72411⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 71610⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3176 -s 7409⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 772 -s 7448⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 7407⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 7446⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 7245⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4220 -s 7244⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 7443⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 7442⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 408 -ip 4081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 632 -ip 6321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4220 -ip 42201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3272 -ip 32721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2720 -ip 27201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2468 -ip 24681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 772 -ip 7721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3176 -ip 31761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3152 -ip 31521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2204 -ip 22041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 448 -ip 4481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 3904 -ip 39041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3832 -ip 38321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 640 -ip 6401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1092 -ip 10921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1804 -ip 18041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3820 -ip 38201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2852 -ip 28521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3008 -ip 30081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4780 -ip 47801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1796 -ip 17961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4892 -ip 48921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 992 -ip 9921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4108 -ip 41081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4928 -ip 49281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4476 -ip 44761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3448 -ip 34481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 452 -ip 4521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4876 -ip 48761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2296 -ip 22961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3028 -ip 30281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1972 -ip 19721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3572 -ip 35721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4416 -ip 44161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3756 -ip 37561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1788 -ip 17881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 1752 -ip 17521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1028 -ip 10281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4408 -ip 44081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 516 -ip 5161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 976 -ip 9761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4616 -ip 46161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4368 -ip 43681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4040 -ip 40401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4872 -ip 48721⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-11481.exe
Unicorn-12143.exe
Unicorn-12517.exe
Unicorn-15371.exe
Unicorn-15730.exe
Unicorn-16010.exe
Unicorn-16064.exe
Unicorn-20940.exe
Unicorn-21054.exe
Unicorn-24152.exe
Unicorn-24744.exe
Unicorn-25398.exe
Unicorn-25960.exe
Unicorn-26832.exe
Unicorn-29930.exe
Unicorn-31474.exe
Unicorn-31594.exe
Unicorn-42426.exe
Unicorn-4517.exe
Unicorn-49554.exe
Unicorn-50426.exe
Unicorn-5075.exe
Unicorn-53046.exe
Unicorn-53290.exe
Unicorn-55944.exe
Unicorn-57110.exe
Unicorn-59222.exe
Unicorn-59336.exe
Unicorn-6181.exe
Unicorn-62418.exe
Unicorn-64904.exe
Unicorn-9045.exe
memory/408-10-0x0000000000400000-0x0000000000475000-memory.dmp
memory/408-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/448-79-0x0000000000400000-0x0000000000475000-memory.dmp
memory/448-90-0x0000000000400000-0x0000000000475000-memory.dmp
memory/452-215-0x0000000000400000-0x0000000000475000-memory.dmp
memory/452-226-0x0000000000400000-0x0000000000475000-memory.dmp
memory/516-306-0x0000000000400000-0x0000000000475000-memory.dmp
memory/516-297-0x0000000000400000-0x0000000000475000-memory.dmp
memory/632-18-0x0000000000400000-0x0000000000475000-memory.dmp
memory/632-7-0x0000000000400000-0x0000000000475000-memory.dmp
memory/640-114-0x0000000000400000-0x0000000000475000-memory.dmp
memory/640-103-0x0000000000400000-0x0000000000475000-memory.dmp
memory/772-58-0x0000000000400000-0x0000000000475000-memory.dmp
memory/772-47-0x0000000000400000-0x0000000000475000-memory.dmp
memory/976-312-0x0000000000400000-0x0000000000475000-memory.dmp
memory/976-303-0x0000000000400000-0x0000000000475000-memory.dmp
memory/992-186-0x0000000000400000-0x0000000000475000-memory.dmp
memory/992-174-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1028-285-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1028-294-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1092-111-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1092-122-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1752-288-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1752-279-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1788-282-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1788-273-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1796-170-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1796-159-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1804-119-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1804-130-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1972-247-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1972-258-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2204-82-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2204-71-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2296-242-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2296-231-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2468-39-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2468-50-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2720-42-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2720-31-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2852-135-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2852-146-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3008-154-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3008-143-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3028-250-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3028-238-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3152-63-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3152-74-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3176-66-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3176-55-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3272-34-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3272-23-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3448-207-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3448-218-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3572-255-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3572-264-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3756-276-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3756-267-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3820-127-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3820-138-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3832-106-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3832-95-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3904-87-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3904-98-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4040-330-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4040-321-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4108-183-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4108-194-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4148-333-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4220-15-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4220-26-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4368-324-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4368-315-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4408-291-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4408-300-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4416-270-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4416-261-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4476-210-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4476-199-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4616-318-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4616-309-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4780-162-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4780-151-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4872-327-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4872-336-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4876-223-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4876-234-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4892-178-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4892-167-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4928-202-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4928-191-0x0000000000400000-0x0000000000475000-memory.dmp