Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
16/09/2026, 19:15
General
- Target 0e2d460d1e02ae8e973d4a1bc93eef08166316b6f983abec77e289695e958988.exe
- Size 468KB
- Sample260916-xx84fseq6v
- SHA256 0e2d460d1e02ae8e973d4a1bc93eef08166316b6f983abec77e289695e958988
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 64 IoCs
- Executes dropped EXE 45 IoCs
- Program crash 45 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 46 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 46 IoCs
- Suspicious use of WriteProcessMemory 45 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e2d460d1e02ae8e973d4a1bc93eef08166316b6f983abec77e289695e958988.exe"C:\Users\Admin\AppData\Local\Temp\0e2d460d1e02ae8e973d4a1bc93eef08166316b6f983abec77e289695e958988.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26868.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26868.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42218.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42218.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23490.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23490.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18420.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18420.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13349.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13349.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6909.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6909.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36650.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36650.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54102.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54102.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42810.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42810.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42592.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42592.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35384.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35384.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65124.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65124.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50576.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50576.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43368.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43368.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34214.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34214.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62584.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62584.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45226.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45226.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9429.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9429.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23410.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23410.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18340.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18340.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48080.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48080.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34806.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34806.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55008.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55008.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17074.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17074.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12003.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12003.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11785.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11785.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49658.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49658.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48672.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48672.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42616.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42616.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33462.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33462.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61064.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61064.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12979.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12979.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51656.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51656.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54754.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54754.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25180.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25180.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44614.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44614.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5465.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5465.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4479.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4479.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7577.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7577.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37318.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37318.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59622.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59622.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27910.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27910.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61734.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61734.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 72446⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 948 -s 72445⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 72444⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 72443⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 72442⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 72441⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3820 -s 72440⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1772 -s 72439⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4500 -s 72438⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3512 -s 72437⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 72436⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 72435⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 72434⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 72433⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 72432⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4528 -s 72431⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 72430⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 72429⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 72428⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 72427⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 72426⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 72425⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3864 -s 72424⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 72423⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 72422⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 180 -s 72421⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 72420⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 72419⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 72418⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 72417⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 72416⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 72415⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 72414⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 72413⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 72412⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 72411⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 72410⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 7249⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1144 -s 7248⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 7247⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 7246⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 7245⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 7244⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 7243⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 7242⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4860 -ip 48601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1644 -ip 16441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2548 -ip 25481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1032 -ip 10321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2912 -ip 29121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 3132 -ip 31321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1144 -ip 11441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5088 -ip 50881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4948 -ip 49481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3976 -ip 39761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2404 -ip 24041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 740 -ip 7401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 4212 -ip 42121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4464 -ip 44641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2724 -ip 27241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 2028 -ip 20281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 860 -ip 8601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 5012 -ip 50121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 2740 -ip 27401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 180 -ip 1801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 1936 -ip 19361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 4800 -ip 48001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 3864 -ip 38641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 1760 -ip 17601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 2228 -ip 22281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 4400 -ip 44001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 2648 -ip 26481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 952 -ip 9521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 4420 -ip 44201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 4528 -ip 45281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 2760 -ip 27601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 1600 -ip 16001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 1512 -ip 15121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 1708 -ip 17081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 4564 -ip 45641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 3512 -ip 35121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 4500 -ip 45001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 1772 -ip 17721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 3820 -ip 38201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 3836 -ip 38361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 4604 -ip 46041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 864 -ip 8641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 2416 -ip 24161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 948 -ip 9481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 4932 -ip 49321⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-11785.exe
Unicorn-12003.exe
Unicorn-13349.exe
Unicorn-17074.exe
Unicorn-18340.exe
Unicorn-18420.exe
Unicorn-22042.exe
Unicorn-23410.exe
Unicorn-23490.exe
Unicorn-26868.exe
Unicorn-33462.exe
Unicorn-34214.exe
Unicorn-34806.exe
Unicorn-35384.exe
Unicorn-36650.exe
Unicorn-42218.exe
Unicorn-42244.exe
Unicorn-42592.exe
Unicorn-42616.exe
Unicorn-42810.exe
Unicorn-43368.exe
Unicorn-45226.exe
Unicorn-48080.exe
Unicorn-48672.exe
Unicorn-49658.exe
Unicorn-50576.exe
Unicorn-54102.exe
Unicorn-55008.exe
Unicorn-62584.exe
Unicorn-65124.exe
Unicorn-6909.exe
Unicorn-7577.exe
Unicorn-9429.exe
memory/180-162-0x0000000000400000-0x0000000000475000-memory.dmp
memory/180-150-0x0000000000400000-0x0000000000475000-memory.dmp
memory/740-86-0x0000000000400000-0x0000000000475000-memory.dmp
memory/740-98-0x0000000000400000-0x0000000000475000-memory.dmp
memory/860-138-0x0000000000400000-0x0000000000475000-memory.dmp
memory/860-126-0x0000000000400000-0x0000000000475000-memory.dmp
memory/864-309-0x0000000000400000-0x0000000000475000-memory.dmp
memory/864-318-0x0000000000400000-0x0000000000475000-memory.dmp
memory/948-321-0x0000000000400000-0x0000000000475000-memory.dmp
memory/948-330-0x0000000000400000-0x0000000000475000-memory.dmp
memory/952-214-0x0000000000400000-0x0000000000475000-memory.dmp
memory/952-226-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1032-22-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1032-34-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1144-46-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1144-58-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1512-264-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1512-254-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1600-246-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1600-258-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1644-6-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1644-18-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1708-261-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1708-270-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1760-182-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1760-194-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1772-294-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1772-285-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1936-170-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1936-159-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2028-130-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2028-118-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2228-190-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2228-202-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2404-79-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2404-90-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2416-315-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2416-324-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2548-26-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2548-14-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2648-206-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2648-218-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2724-110-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2724-122-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2740-142-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2740-154-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2760-250-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2760-238-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2912-42-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2912-30-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3132-38-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3132-50-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3512-273-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3512-282-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3820-291-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3820-300-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3836-306-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3836-297-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3864-186-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3864-174-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3976-70-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3976-82-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4164-333-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4212-106-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4212-94-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4400-198-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4400-210-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4420-222-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4420-234-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4464-114-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4464-102-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4500-279-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4500-288-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4528-242-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4528-230-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4564-267-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4564-276-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4604-303-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4604-312-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4800-166-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4800-178-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4860-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4860-10-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4932-327-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4932-336-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4948-62-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4948-74-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5012-134-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5012-146-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5088-54-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5088-66-0x0000000000400000-0x0000000000475000-memory.dmp