Analysis
- max time kernel
149s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
16/09/2026, 12:46
General
- Target 803b63dc5a692560d5f6f3a9e77ce4d236f3444f06d6b53c9435cbc78c0dae4f.exe
- Size 468KB
- Sample260916-pzxt7sbn21
- SHA256 803b63dc5a692560d5f6f3a9e77ce4d236f3444f06d6b53c9435cbc78c0dae4f
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 64 IoCs
- Executes dropped EXE 45 IoCs
- Program crash 45 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 46 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 46 IoCs
- Suspicious use of WriteProcessMemory 45 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\803b63dc5a692560d5f6f3a9e77ce4d236f3444f06d6b53c9435cbc78c0dae4f.exe"C:\Users\Admin\AppData\Local\Temp\803b63dc5a692560d5f6f3a9e77ce4d236f3444f06d6b53c9435cbc78c0dae4f.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54036.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54036.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7331.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7331.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35448.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35448.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41260.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41260.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47840.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47840.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34732.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34732.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1971.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1971.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24452.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24452.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62900.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62900.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3943.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3943.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3471.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3471.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17452.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17452.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19948.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19948.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15007.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15007.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50176.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50176.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52252.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52252.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2231.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2231.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54865.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54865.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23729.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23729.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47797.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47797.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46173.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46173.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51985.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51985.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1160.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1160.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12592.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12592.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31041.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31041.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33501.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33501.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7984.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7984.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10060.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10060.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24809.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24809.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23953.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23953.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38701.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38701.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36345.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36345.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46153.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46153.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36361.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36361.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25837.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25837.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44669.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44669.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60245.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60245.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54573.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54573.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39929.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39929.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62845.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62845.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62025.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62025.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39981.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39981.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4224 -s 74446⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 72445⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 75244⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4168 -s 72443⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 74442⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 74441⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 72440⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 74439⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 75238⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 72437⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 74436⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 72435⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 72434⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 72433⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 74032⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 74031⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 74430⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 74429⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 75228⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 74027⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 72426⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 72425⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 74024⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 74023⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 74422⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 71621⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 72420⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 75219⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 75218⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 74417⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 71216⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 72415⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 72414⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 74413⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 74012⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 74011⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1148 -s 72410⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 7249⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 7408⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 7247⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 7166⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 7525⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 7244⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 7443⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 7242⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3532 -ip 35321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1480 -ip 14801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2748 -ip 27481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3940 -ip 39401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1804 -ip 18041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3392 -ip 33921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3488 -ip 34881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1612 -ip 16121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1148 -ip 11481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1732 -ip 17321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2368 -ip 23681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2272 -ip 22721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4336 -ip 43361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 408 -ip 4081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2584 -ip 25841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2772 -ip 27721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 448 -ip 4481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4956 -ip 49561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2816 -ip 28161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3992 -ip 39921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1724 -ip 17241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1384 -ip 13841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3836 -ip 38361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3292 -ip 32921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1988 -ip 19881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4864 -ip 48641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2136 -ip 21361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4368 -ip 43681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3520 -ip 35201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3664 -ip 36641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3760 -ip 37601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3172 -ip 31721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3316 -ip 33161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4272 -ip 42721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1896 -ip 18961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1884 -ip 18841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 736 -ip 7361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 860 -ip 8601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3676 -ip 36761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2300 -ip 23001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3872 -ip 38721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4168 -ip 41681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1996 -ip 19961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2028 -ip 20281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4224 -ip 42241⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-10060.exe
Unicorn-1160.exe
Unicorn-12592.exe
Unicorn-15007.exe
Unicorn-17452.exe
Unicorn-1971.exe
Unicorn-19948.exe
Unicorn-2231.exe
Unicorn-23729.exe
Unicorn-23953.exe
Unicorn-24452.exe
Unicorn-24809.exe
Unicorn-31041.exe
Unicorn-33501.exe
Unicorn-3471.exe
Unicorn-34732.exe
Unicorn-35448.exe
Unicorn-3943.exe
Unicorn-41260.exe
Unicorn-4467.exe
Unicorn-46173.exe
Unicorn-47797.exe
Unicorn-47840.exe
Unicorn-50176.exe
Unicorn-51985.exe
Unicorn-52252.exe
Unicorn-54036.exe
Unicorn-54865.exe
Unicorn-62900.exe
Unicorn-7331.exe
Unicorn-7984.exe
Unicorn-8447.exe
memory/408-102-0x0000000000400000-0x0000000000475000-memory.dmp
memory/408-114-0x0000000000400000-0x0000000000475000-memory.dmp
memory/448-127-0x0000000000400000-0x0000000000475000-memory.dmp
memory/448-138-0x0000000000400000-0x0000000000475000-memory.dmp
memory/736-288-0x0000000000400000-0x0000000000475000-memory.dmp
memory/736-279-0x0000000000400000-0x0000000000475000-memory.dmp
memory/860-294-0x0000000000400000-0x0000000000475000-memory.dmp
memory/860-285-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1148-63-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1148-74-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1384-167-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1384-178-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1480-7-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1480-18-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1612-66-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1612-55-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1724-158-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1724-170-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1732-82-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1732-71-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1804-31-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1804-42-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1884-282-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1884-273-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1896-276-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1896-267-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1988-202-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1988-191-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1996-324-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1996-315-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2028-321-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2028-330-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2136-218-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2136-207-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2272-98-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2272-87-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2300-297-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2300-306-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2368-79-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2368-90-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2584-122-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2584-111-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2748-26-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2748-15-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2772-119-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2772-130-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2816-143-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2816-154-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3172-247-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3172-258-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3292-194-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3292-183-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3316-264-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3316-255-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3392-50-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3392-39-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3488-47-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3488-58-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3520-234-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3520-223-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3532-10-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3532-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3664-231-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3664-242-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3676-291-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3676-300-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3760-250-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3760-239-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3836-186-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3836-175-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3872-303-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3872-312-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3940-23-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3940-34-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3992-162-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3992-151-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4168-318-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4168-309-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4224-327-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4224-336-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4272-270-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4272-261-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4336-106-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4336-95-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4368-215-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4368-226-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4864-199-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4864-210-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4892-333-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4956-135-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4956-146-0x0000000000400000-0x0000000000475000-memory.dmp