Analysis
- max time kernel
149s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
16/09/2026, 17:59
General
- Target 04bfab0d9919bc4fbec0d63e48c9294be67e4a63cd567c0f71b74ae6f3f1f54d.exe
- Size 468KB
- Sample260916-wk9c1stdlc
- SHA256 04bfab0d9919bc4fbec0d63e48c9294be67e4a63cd567c0f71b74ae6f3f1f54d
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 64 IoCs
- Executes dropped EXE 45 IoCs
- Program crash 45 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 46 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 46 IoCs
- Suspicious use of WriteProcessMemory 45 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\04bfab0d9919bc4fbec0d63e48c9294be67e4a63cd567c0f71b74ae6f3f1f54d.exe"C:\Users\Admin\AppData\Local\Temp\04bfab0d9919bc4fbec0d63e48c9294be67e4a63cd567c0f71b74ae6f3f1f54d.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27567.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27567.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8106.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8106.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46783.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46783.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27323.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27323.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44775.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44775.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48641.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48641.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6622.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6622.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40447.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40447.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9466.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9466.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-312.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-312.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27915.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27915.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31013.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31013.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61521.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61521.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17521.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17521.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63597.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63597.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28569.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28569.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39835.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39835.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8122.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8122.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60385.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60385.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6882.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6882.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57043.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57043.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60141.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60141.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2554.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2554.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56859.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56859.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41483.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41483.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9770.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9770.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13636.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13636.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47461.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47461.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64913.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64913.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33201.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33201.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45235.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45235.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43263.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43263.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25905.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25905.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29771.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29771.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24701.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24701.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46273.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46273.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49371.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49371.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28697.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28697.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28095.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28095.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23025.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23025.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26123.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26123.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47695.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47695.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8546.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8546.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3476.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3476.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 972 -s 71646⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 72445⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 75244⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 72443⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 74042⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 74041⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 74440⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 74439⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 72438⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 72437⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3848 -s 72436⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 72435⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3288 -s 74434⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 74033⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 72432⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 75231⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 74430⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 72429⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 72028⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 74427⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3264 -s 74026⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 72425⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 72424⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 74023⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 72422⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 74021⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 71620⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 71219⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 72418⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 72417⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 72416⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 74015⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 908 -s 72414⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 74413⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 74012⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 74011⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 72410⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 7529⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 7448⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 7247⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 7406⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 7245⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 7244⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 7163⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3728 -s 7522⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3728 -ip 37281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3396 -ip 33961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2764 -ip 27641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4264 -ip 42641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1912 -ip 19121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3720 -ip 37201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4396 -ip 43961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3976 -ip 39761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3364 -ip 33641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1572 -ip 15721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4372 -ip 43721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4524 -ip 45241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 908 -ip 9081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1728 -ip 17281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3060 -ip 30601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5000 -ip 50001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1904 -ip 19041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4824 -ip 48241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1980 -ip 19801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1736 -ip 17361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2008 -ip 20081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3816 -ip 38161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4992 -ip 49921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3336 -ip 33361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3264 -ip 32641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 992 -ip 9921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5104 -ip 51041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3100 -ip 31001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3052 -ip 30521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 116 -ip 1161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2792 -ip 27921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2000 -ip 20001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3288 -ip 32881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1648 -ip 16481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3848 -ip 38481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1972 -ip 19721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1692 -ip 16921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4148 -ip 41481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 756 -ip 7561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2616 -ip 26161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2692 -ip 26921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4736 -ip 47361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2120 -ip 21201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4008 -ip 40081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 972 -ip 9721⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-13636.exe
Unicorn-17521.exe
Unicorn-2554.exe
Unicorn-27323.exe
Unicorn-27567.exe
Unicorn-27915.exe
Unicorn-28569.exe
Unicorn-31013.exe
Unicorn-312.exe
Unicorn-33201.exe
Unicorn-39835.exe
Unicorn-40447.exe
Unicorn-41483.exe
Unicorn-44775.exe
Unicorn-45235.exe
Unicorn-46783.exe
Unicorn-47461.exe
Unicorn-48641.exe
Unicorn-56859.exe
Unicorn-57043.exe
Unicorn-60141.exe
Unicorn-60385.exe
Unicorn-61521.exe
Unicorn-63597.exe
Unicorn-64913.exe
Unicorn-6622.exe
Unicorn-6882.exe
Unicorn-8106.exe
Unicorn-8122.exe
Unicorn-9438.exe
Unicorn-9466.exe
Unicorn-9770.exe
memory/116-240-0x0000000000400000-0x0000000000475000-memory.dmp
memory/116-229-0x0000000000400000-0x0000000000475000-memory.dmp
memory/756-298-0x0000000000400000-0x0000000000475000-memory.dmp
memory/756-289-0x0000000000400000-0x0000000000475000-memory.dmp
memory/908-105-0x0000000000400000-0x0000000000475000-memory.dmp
memory/908-94-0x0000000000400000-0x0000000000475000-memory.dmp
memory/972-325-0x0000000000400000-0x0000000000475000-memory.dmp
memory/972-334-0x0000000000400000-0x0000000000475000-memory.dmp
memory/992-197-0x0000000000400000-0x0000000000475000-memory.dmp
memory/992-208-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1572-81-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1648-268-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1648-259-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1692-286-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1692-277-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1728-113-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1728-102-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1736-161-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1736-150-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1904-126-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1904-137-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1912-42-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1912-31-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1972-280-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1972-271-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1980-153-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1980-142-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2000-245-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2000-256-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2008-158-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2008-169-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2120-313-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2120-322-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2616-295-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2616-304-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2692-301-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2692-310-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2764-15-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2764-26-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2792-237-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2792-248-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3052-232-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3052-221-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3060-110-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3060-121-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3100-213-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3100-224-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3264-189-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3264-200-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3288-253-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3288-262-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3336-192-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3364-63-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3364-73-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3396-18-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3396-7-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3720-50-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3720-39-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3728-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3728-10-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3804-331-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3816-166-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3816-177-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3848-274-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3848-265-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3976-55-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3976-66-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4008-328-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4008-319-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4148-283-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4148-292-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4264-23-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4264-34-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4372-89-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4372-78-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4396-47-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4396-58-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4524-86-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4524-97-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4736-307-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4736-316-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4824-145-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4824-134-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4992-184-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4992-174-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5000-118-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5000-129-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5104-205-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5104-216-0x0000000000400000-0x0000000000475000-memory.dmp