Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
16/09/2026, 22:55
General
- Target 28da6f873d3c8f0860494532f6a07aef129fa1d6799a20ded8070e9d1def2e37.exe
- Size 468KB
- Sample260916-2v37msfc56
- SHA256 28da6f873d3c8f0860494532f6a07aef129fa1d6799a20ded8070e9d1def2e37
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 64 IoCs
- Executes dropped EXE 45 IoCs
- Program crash 45 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 46 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 46 IoCs
- Suspicious use of WriteProcessMemory 45 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\28da6f873d3c8f0860494532f6a07aef129fa1d6799a20ded8070e9d1def2e37.exe"C:\Users\Admin\AppData\Local\Temp\28da6f873d3c8f0860494532f6a07aef129fa1d6799a20ded8070e9d1def2e37.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1918.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1918.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23647.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23647.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55909.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55909.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36449.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36449.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9012.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9012.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61887.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61887.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34415.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34415.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6594.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6594.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9884.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9884.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44285.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44285.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32993.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32993.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21953.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21953.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60437.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60437.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51475.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51475.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54381.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54381.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8470.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8470.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65393.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65393.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56431.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56431.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28611.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28611.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62627.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62627.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48019.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48019.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3826.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3826.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7116.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7116.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61937.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61937.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52975.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52975.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21071.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21071.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42799.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42799.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46473.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46473.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19037.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19037.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52669.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52669.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21149.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21149.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29063.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29063.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31969.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31969.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45373.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45373.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13852.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13852.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1538.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1538.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31471.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31471.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42545.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42545.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11024.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11024.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25005.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25005.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11922.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11922.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41471.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41471.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3728.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3728.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17709.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17709.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47641.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47641.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 74446⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 71645⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 74444⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 72443⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6004 -s 74442⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 71241⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 72440⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 71639⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 74438⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6040 -s 75237⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 72436⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 75235⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5208 -s 71234⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 72433⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 72432⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5588 -s 74031⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 74430⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 72429⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 72828⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 74027⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 72426⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 72425⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 72424⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5316 -s 75223⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 72422⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 72421⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 71620⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 74019⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3648 -s 72418⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 772 -s 71617⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 74816⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 75215⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5140 -s 72414⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 74013⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5360 -s 72412⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5876 -s 74011⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5852 -s 72410⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 7529⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 7248⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 7407⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 7446⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 7445⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 7244⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6080 -s 7523⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4500 -s 7402⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4500 -ip 45001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 6080 -ip 60801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4148 -ip 41481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4884 -ip 48841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4916 -ip 49161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2164 -ip 21641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1716 -ip 17161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1440 -ip 14401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5852 -ip 58521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5876 -ip 58761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5360 -ip 53601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2752 -ip 27521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5140 -ip 51401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4824 -ip 48241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1776 -ip 17761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 772 -ip 7721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3648 -ip 36481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1748 -ip 17481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3908 -ip 39081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4764 -ip 47641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2588 -ip 25881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5316 -ip 53161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2532 -ip 25321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 980 -ip 9801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1712 -ip 17121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 620 -ip 6201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3116 -ip 31161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3592 -ip 35921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3548 -ip 35481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5588 -ip 55881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4004 -ip 40041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2820 -ip 28201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5208 -ip 52081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 940 -ip 9401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2188 -ip 21881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 6040 -ip 60401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2848 -ip 28481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3220 -ip 32201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2648 -ip 26481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4676 -ip 46761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 6004 -ip 60041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1340 -ip 13401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3040 -ip 30401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 760 -ip 7601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4084 -ip 40841⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-19037.exe
Unicorn-1918.exe
Unicorn-21071.exe
Unicorn-21149.exe
Unicorn-21953.exe
Unicorn-23647.exe
Unicorn-28611.exe
Unicorn-29063.exe
Unicorn-32993.exe
Unicorn-34415.exe
Unicorn-36449.exe
Unicorn-3826.exe
Unicorn-42799.exe
Unicorn-44285.exe
Unicorn-46473.exe
Unicorn-48019.exe
Unicorn-51475.exe
Unicorn-52669.exe
Unicorn-52975.exe
Unicorn-54381.exe
Unicorn-55909.exe
Unicorn-56431.exe
Unicorn-60437.exe
Unicorn-61887.exe
Unicorn-61937.exe
Unicorn-62627.exe
Unicorn-65393.exe
Unicorn-6594.exe
Unicorn-7116.exe
Unicorn-8470.exe
Unicorn-9012.exe
Unicorn-9884.exe
memory/620-199-0x0000000000400000-0x0000000000475000-memory.dmp
memory/620-210-0x0000000000400000-0x0000000000475000-memory.dmp
memory/760-321-0x0000000000400000-0x0000000000475000-memory.dmp
memory/760-330-0x0000000000400000-0x0000000000475000-memory.dmp
memory/772-130-0x0000000000400000-0x0000000000475000-memory.dmp
memory/772-119-0x0000000000400000-0x0000000000475000-memory.dmp
memory/940-261-0x0000000000400000-0x0000000000475000-memory.dmp
memory/940-270-0x0000000000400000-0x0000000000475000-memory.dmp
memory/980-183-0x0000000000400000-0x0000000000475000-memory.dmp
memory/980-194-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1340-309-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1340-318-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1440-66-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1440-55-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1712-191-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1712-202-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1716-47-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1716-58-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1748-135-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1748-146-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1776-122-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1776-111-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2164-50-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2164-39-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2188-267-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2188-276-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2532-186-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2532-175-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2576-333-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2588-158-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2588-170-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2648-300-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2648-291-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2752-87-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2752-98-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2820-247-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2820-258-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2848-288-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2848-279-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3040-324-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3040-315-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3116-218-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3116-207-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3220-294-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3220-285-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3548-234-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3548-223-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3592-226-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3592-214-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3648-138-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3648-127-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3908-143-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3908-154-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4004-239-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4004-250-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4084-336-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4084-327-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4148-26-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4148-15-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4500-10-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4500-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4676-297-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4676-306-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4764-162-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4764-150-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4824-114-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4824-102-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4884-23-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4884-34-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4916-31-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4916-42-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5140-95-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5140-106-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5208-255-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5208-264-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5316-178-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5316-167-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5360-90-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5360-79-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5588-231-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5588-242-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5852-74-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5852-63-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5876-82-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5876-71-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6004-312-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6004-303-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6040-273-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6040-282-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6080-18-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6080-7-0x0000000000400000-0x0000000000475000-memory.dmp