e9ac4d8115f15c131367a4b690c8fa517292e9520212e4707f678bb4abfe22b3

Analysis

max time kernel
102s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/04/2024, 15:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d78e5a53bad1262ecfcf26a52bf383e5_JaffaCakes118.exe
Size

192KB
MD5

d78e5a53bad1262ecfcf26a52bf383e5
SHA1

a2de3755c2f8ecadf85b94d01537c9bb0b268855
SHA256

e9ac4d8115f15c131367a4b690c8fa517292e9520212e4707f678bb4abfe22b3
SHA512

97e0ec87ad2d2f946f3363815603c66782e3a582fc967d10d0edf56fcc59c8391f520fb67bc0a9b1833accb8a48028e0ddc44ceea372a288b41ee7d23fb980fb
SSDEEP

3072:JRW1oGoZmtOqL3fbdOjX7JZwM51MIu6XrLxOjTbH9lTvpFH:JR4oUQqLDdYX7Jr5c79lTvpF

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2300	Unicorn-17411.exe
2012	Unicorn-7955.exe
3052	Unicorn-57711.exe
2528	Unicorn-56409.exe
2616	Unicorn-28183.exe
2444	Unicorn-52133.exe
2832	Unicorn-56575.exe
2884	Unicorn-32817.exe
1612	Unicorn-15735.exe
1916	Unicorn-57322.exe
1436	Unicorn-27276.exe
2676	Unicorn-3326.exe
2224	Unicorn-28236.exe
2848	Unicorn-61292.exe
684	Unicorn-53124.exe
1092	Unicorn-25090.exe
2060	Unicorn-2984.exe
2256	Unicorn-28043.exe
2248	Unicorn-39741.exe
1992	Unicorn-8329.exe
360	Unicorn-20067.exe
1532	Unicorn-6684.exe
2384	Unicorn-23575.exe
2728	Unicorn-20198.exe
2136	Unicorn-31189.exe
2892	Unicorn-41172.exe
2944	Unicorn-60519.exe
2976	Unicorn-24509.exe
2504	Unicorn-64795.exe
2408	Unicorn-23379.exe
2736	Unicorn-52522.exe
2644	Unicorn-7042.exe
2472	Unicorn-29361.exe
2100	Unicorn-20639.exe
304	Unicorn-53311.exe
1892	Unicorn-41613.exe
1920	Unicorn-11702.exe
2168	Unicorn-20255.exe
1620	Unicorn-41037.exe
1548	Unicorn-49803.exe
2724	Unicorn-9517.exe
776	Unicorn-39544.exe
944	Unicorn-60519.exe
912	Unicorn-34884.exe
2296	Unicorn-10187.exe
1752	Unicorn-19294.exe
2712	Unicorn-59580.exe
2788	Unicorn-15423.exe
888	Unicorn-32698.exe
1964	Unicorn-51988.exe
2688	Unicorn-32122.exe
2936	Unicorn-3342.exe
2312	Unicorn-20385.exe
2324	Unicorn-58848.exe
2572	Unicorn-5200.exe
2888	Unicorn-29705.exe
1604	Unicorn-9263.exe
2376	Unicorn-29129.exe
1588	Unicorn-34151.exe
2700	Unicorn-21153.exe
2096	Unicorn-21153.exe
2820	Unicorn-35111.exe
488	Unicorn-63337.exe
1668	Unicorn-10607.exe

Loads dropped DLL 64 IoCs

pid	Process
1636	d78e5a53bad1262ecfcf26a52bf383e5_JaffaCakes118.exe
1636	d78e5a53bad1262ecfcf26a52bf383e5_JaffaCakes118.exe
2300	Unicorn-17411.exe
2300	Unicorn-17411.exe
1636	d78e5a53bad1262ecfcf26a52bf383e5_JaffaCakes118.exe
1636	d78e5a53bad1262ecfcf26a52bf383e5_JaffaCakes118.exe
2012	Unicorn-7955.exe
2012	Unicorn-7955.exe
2300	Unicorn-17411.exe
2300	Unicorn-17411.exe
3052	Unicorn-57711.exe
3052	Unicorn-57711.exe
2528	Unicorn-56409.exe
2528	Unicorn-56409.exe
2012	Unicorn-7955.exe
2012	Unicorn-7955.exe
2444	Unicorn-52133.exe
2444	Unicorn-52133.exe
3052	Unicorn-57711.exe
3052	Unicorn-57711.exe
2360	WerFault.exe
2360	WerFault.exe
2360	WerFault.exe
2360	WerFault.exe
2360	WerFault.exe
2360	WerFault.exe
2360	WerFault.exe
552	WerFault.exe
552	WerFault.exe
552	WerFault.exe
552	WerFault.exe
552	WerFault.exe
552	WerFault.exe
552	WerFault.exe
2832	Unicorn-56575.exe
2832	Unicorn-56575.exe
2528	Unicorn-56409.exe
2528	Unicorn-56409.exe
2884	Unicorn-32817.exe
2884	Unicorn-32817.exe
1916	Unicorn-57322.exe
1916	Unicorn-57322.exe
1612	Unicorn-15735.exe
1612	Unicorn-15735.exe
2444	Unicorn-52133.exe
2444	Unicorn-52133.exe
1708	WerFault.exe
1708	WerFault.exe
1708	WerFault.exe
1708	WerFault.exe
1708	WerFault.exe
1708	WerFault.exe
1708	WerFault.exe
1568	WerFault.exe
1568	WerFault.exe
1568	WerFault.exe
1568	WerFault.exe
1568	WerFault.exe
1568	WerFault.exe
1568	WerFault.exe
1436	Unicorn-27276.exe
1436	Unicorn-27276.exe
2832	Unicorn-56575.exe
2832	Unicorn-56575.exe

Program crash 50 IoCs

pid	pid_target	Process	procid_target
2636	1636	WerFault.exe	27
2360	2012	WerFault.exe	29
552	3052	WerFault.exe	30
1708	2528	WerFault.exe	32
1568	2444	WerFault.exe	34
2032	2300	WerFault.exe	28
1256	2832	WerFault.exe	35
1640	2884	WerFault.exe	36
2028	1916	WerFault.exe	38
2544	1612	WerFault.exe	37
2980	1436	WerFault.exe	41
2876	2676	WerFault.exe	42
560	2224	WerFault.exe	43
1488	2848	WerFault.exe	44
1536	1092	WerFault.exe	46
840	684	WerFault.exe	45
2968	2644	WerFault.exe	69
300	2060	WerFault.exe	49
1580	2256	WerFault.exe	50
1476	2248	WerFault.exe	51
2388	360	WerFault.exe	53
3092	2504	WerFault.exe	65
3088	2472	WerFault.exe	70
3136	2100	WerFault.exe	71
3128	304	WerFault.exe	73
3120	2168	WerFault.exe	75
3244	1532	WerFault.exe	54
3236	2136	WerFault.exe	56
3228	1992	WerFault.exe	52
3220	1892	WerFault.exe	72
3260	776	WerFault.exe	81
3504	2936	WerFault.exe	96
3496	2976	WerFault.exe	63
3588	2944	WerFault.exe	62
3580	2892	WerFault.exe	58
3572	912	WerFault.exe	84
3564	2712	WerFault.exe	90
3556	1620	WerFault.exe	76
3548	944	WerFault.exe	82
3540	1752	WerFault.exe	88
3632	2736	WerFault.exe	68
3724	2384	WerFault.exe	55
3804	2724	WerFault.exe	78
3824	888	WerFault.exe	92
3840	1920	WerFault.exe	74
3848	2728	WerFault.exe	57
3856	2408	WerFault.exe	67
3864	1548	WerFault.exe	77
4004	1964	WerFault.exe	94
4404	2688	WerFault.exe	95

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1636	d78e5a53bad1262ecfcf26a52bf383e5_JaffaCakes118.exe
2300	Unicorn-17411.exe
2012	Unicorn-7955.exe
3052	Unicorn-57711.exe
2528	Unicorn-56409.exe
2444	Unicorn-52133.exe
2832	Unicorn-56575.exe
2884	Unicorn-32817.exe
1612	Unicorn-15735.exe
1916	Unicorn-57322.exe
1436	Unicorn-27276.exe
2676	Unicorn-3326.exe
2224	Unicorn-28236.exe
2848	Unicorn-61292.exe
684	Unicorn-53124.exe
1092	Unicorn-25090.exe
2060	Unicorn-2984.exe
2248	Unicorn-39741.exe
2256	Unicorn-28043.exe
1992	Unicorn-8329.exe
360	Unicorn-20067.exe
1532	Unicorn-6684.exe
2384	Unicorn-23575.exe
2136	Unicorn-31189.exe
2728	Unicorn-20198.exe
2892	Unicorn-41172.exe
2944	Unicorn-60519.exe
2976	Unicorn-24509.exe
2504	Unicorn-64795.exe
2408	Unicorn-23379.exe
2736	Unicorn-52522.exe
2644	Unicorn-7042.exe
2472	Unicorn-29361.exe
2100	Unicorn-20639.exe
304	Unicorn-53311.exe
1920	Unicorn-11702.exe
1892	Unicorn-41613.exe
2168	Unicorn-20255.exe
2724	Unicorn-9517.exe
1548	Unicorn-49803.exe
1620	Unicorn-41037.exe
776	Unicorn-39544.exe
944	Unicorn-60519.exe
2296	Unicorn-10187.exe
912	Unicorn-34884.exe
1752	Unicorn-19294.exe
2712	Unicorn-59580.exe
888	Unicorn-32698.exe
2788	Unicorn-15423.exe
1964	Unicorn-51988.exe
2688	Unicorn-32122.exe
2936	Unicorn-3342.exe
2312	Unicorn-20385.exe
2324	Unicorn-58848.exe
2888	Unicorn-29705.exe
2572	Unicorn-5200.exe
1604	Unicorn-9263.exe
2376	Unicorn-29129.exe
2700	Unicorn-21153.exe
1588	Unicorn-34151.exe
2096	Unicorn-21153.exe
2820	Unicorn-35111.exe
1668	Unicorn-10607.exe
488	Unicorn-63337.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 2300	1636	d78e5a53bad1262ecfcf26a52bf383e5_JaffaCakes118.exe	28
PID 1636 wrote to memory of 2300	1636	d78e5a53bad1262ecfcf26a52bf383e5_JaffaCakes118.exe	28
PID 1636 wrote to memory of 2300	1636	d78e5a53bad1262ecfcf26a52bf383e5_JaffaCakes118.exe	28
PID 1636 wrote to memory of 2300	1636	d78e5a53bad1262ecfcf26a52bf383e5_JaffaCakes118.exe	28
PID 2300 wrote to memory of 2012	2300	Unicorn-17411.exe	29
PID 2300 wrote to memory of 2012	2300	Unicorn-17411.exe	29
PID 2300 wrote to memory of 2012	2300	Unicorn-17411.exe	29
PID 2300 wrote to memory of 2012	2300	Unicorn-17411.exe	29
PID 1636 wrote to memory of 3052	1636	d78e5a53bad1262ecfcf26a52bf383e5_JaffaCakes118.exe	30
PID 1636 wrote to memory of 3052	1636	d78e5a53bad1262ecfcf26a52bf383e5_JaffaCakes118.exe	30
PID 1636 wrote to memory of 3052	1636	d78e5a53bad1262ecfcf26a52bf383e5_JaffaCakes118.exe	30
PID 1636 wrote to memory of 3052	1636	d78e5a53bad1262ecfcf26a52bf383e5_JaffaCakes118.exe	30
PID 1636 wrote to memory of 2636	1636	d78e5a53bad1262ecfcf26a52bf383e5_JaffaCakes118.exe	31
PID 1636 wrote to memory of 2636	1636	d78e5a53bad1262ecfcf26a52bf383e5_JaffaCakes118.exe	31
PID 1636 wrote to memory of 2636	1636	d78e5a53bad1262ecfcf26a52bf383e5_JaffaCakes118.exe	31
PID 1636 wrote to memory of 2636	1636	d78e5a53bad1262ecfcf26a52bf383e5_JaffaCakes118.exe	31
PID 2012 wrote to memory of 2528	2012	Unicorn-7955.exe	32
PID 2012 wrote to memory of 2528	2012	Unicorn-7955.exe	32
PID 2012 wrote to memory of 2528	2012	Unicorn-7955.exe	32
PID 2012 wrote to memory of 2528	2012	Unicorn-7955.exe	32
PID 2300 wrote to memory of 2616	2300	Unicorn-17411.exe	33
PID 2300 wrote to memory of 2616	2300	Unicorn-17411.exe	33
PID 2300 wrote to memory of 2616	2300	Unicorn-17411.exe	33
PID 2300 wrote to memory of 2616	2300	Unicorn-17411.exe	33
PID 3052 wrote to memory of 2444	3052	Unicorn-57711.exe	34
PID 3052 wrote to memory of 2444	3052	Unicorn-57711.exe	34
PID 3052 wrote to memory of 2444	3052	Unicorn-57711.exe	34
PID 3052 wrote to memory of 2444	3052	Unicorn-57711.exe	34
PID 2528 wrote to memory of 2832	2528	Unicorn-56409.exe	35
PID 2528 wrote to memory of 2832	2528	Unicorn-56409.exe	35
PID 2528 wrote to memory of 2832	2528	Unicorn-56409.exe	35
PID 2528 wrote to memory of 2832	2528	Unicorn-56409.exe	35
PID 2012 wrote to memory of 2884	2012	Unicorn-7955.exe	36
PID 2012 wrote to memory of 2884	2012	Unicorn-7955.exe	36
PID 2012 wrote to memory of 2884	2012	Unicorn-7955.exe	36
PID 2012 wrote to memory of 2884	2012	Unicorn-7955.exe	36
PID 2444 wrote to memory of 1612	2444	Unicorn-52133.exe	37
PID 2444 wrote to memory of 1612	2444	Unicorn-52133.exe	37
PID 2444 wrote to memory of 1612	2444	Unicorn-52133.exe	37
PID 2444 wrote to memory of 1612	2444	Unicorn-52133.exe	37
PID 3052 wrote to memory of 1916	3052	Unicorn-57711.exe	38
PID 3052 wrote to memory of 1916	3052	Unicorn-57711.exe	38
PID 3052 wrote to memory of 1916	3052	Unicorn-57711.exe	38
PID 3052 wrote to memory of 1916	3052	Unicorn-57711.exe	38
PID 2012 wrote to memory of 2360	2012	Unicorn-7955.exe	39
PID 2012 wrote to memory of 2360	2012	Unicorn-7955.exe	39
PID 2012 wrote to memory of 2360	2012	Unicorn-7955.exe	39
PID 2012 wrote to memory of 2360	2012	Unicorn-7955.exe	39
PID 3052 wrote to memory of 552	3052	Unicorn-57711.exe	40
PID 3052 wrote to memory of 552	3052	Unicorn-57711.exe	40
PID 3052 wrote to memory of 552	3052	Unicorn-57711.exe	40
PID 3052 wrote to memory of 552	3052	Unicorn-57711.exe	40
PID 2832 wrote to memory of 1436	2832	Unicorn-56575.exe	41
PID 2832 wrote to memory of 1436	2832	Unicorn-56575.exe	41
PID 2832 wrote to memory of 1436	2832	Unicorn-56575.exe	41
PID 2832 wrote to memory of 1436	2832	Unicorn-56575.exe	41
PID 2528 wrote to memory of 2676	2528	Unicorn-56409.exe	42
PID 2528 wrote to memory of 2676	2528	Unicorn-56409.exe	42
PID 2528 wrote to memory of 2676	2528	Unicorn-56409.exe	42
PID 2528 wrote to memory of 2676	2528	Unicorn-56409.exe	42
PID 2884 wrote to memory of 2224	2884	Unicorn-32817.exe	43
PID 2884 wrote to memory of 2224	2884	Unicorn-32817.exe	43
PID 2884 wrote to memory of 2224	2884	Unicorn-32817.exe	43
PID 2884 wrote to memory of 2224	2884	Unicorn-32817.exe	43

C:\Users\Admin\AppData\Local\Temp\d78e5a53bad1262ecfcf26a52bf383e5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d78e5a53bad1262ecfcf26a52bf383e5_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17411.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17411.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7955.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7955.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56409.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56575.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27276.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2984.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60519.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39544.exe
        9⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18221.exe
        10⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 776 -s 384
        10⤵
        Program crash
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63316.exe
        9⤵
        
        PID:1432
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 380
        9⤵
        Program crash
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60519.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25294.exe
        9⤵
        
        PID:1888
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 944 -s 384
        9⤵
        Program crash
        
        PID:3548
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 376
        8⤵
        Program crash
        
        PID:300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24509.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34884.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36778.exe
        9⤵
        
        PID:2984
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 912 -s 372
        9⤵
        Program crash
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17872.exe
        8⤵
        
        PID:2720
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 380
        8⤵
        Program crash
        
        PID:3496
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 368
        7⤵
        Program crash
        
        PID:2980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28043.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64795.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10187.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2296
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 372
        8⤵
        Program crash
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19294.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25294.exe
        8⤵
        
        PID:1840
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 380
        8⤵
        Program crash
        
        PID:3540
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 376
        7⤵
        Program crash
        
        PID:1580
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 376
        6⤵
        Program crash
        
        PID:1256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3326.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39741.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23379.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15423.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2788
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 380
        8⤵
        Program crash
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32698.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25294.exe
        8⤵
        
        PID:348
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 888 -s 384
        8⤵
        Program crash
        
        PID:3824
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 376
        7⤵
        Program crash
        
        PID:1476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52522.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59580.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25294.exe
        8⤵
        
        PID:2972
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 372
        8⤵
        Program crash
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5428.exe
        7⤵
        
        PID:2416
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 372
        7⤵
        Program crash
        
        PID:3632
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 376
        6⤵
        Program crash
        
        PID:2876
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 376
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:1708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32817.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28236.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8329.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20639.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20385.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2312
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 372
        8⤵
        Program crash
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58848.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2324
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 380
        7⤵
        Program crash
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41613.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:488
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 380
        7⤵
        Program crash
        
        PID:3220
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 368
        6⤵
        Program crash
        
        PID:560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20067.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3342.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25294.exe
        7⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 380
        7⤵
        Program crash
        
        PID:3504
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 360 -s 372
        6⤵
        Program crash
        
        PID:2388
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 368
        5⤵
        Program crash
        
        PID:1640
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 376
      4⤵
      Loads dropped DLL
      Program crash
      PID:2360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28183.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28183.exe
    3⤵
    - Executes dropped EXE
    PID:2616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 368
    3⤵
    - Program crash
    PID:2032
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57711.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57711.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52133.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52133.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15735.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53124.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20198.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11702.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29129.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2376
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1920 -s 380
        8⤵
        Program crash
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34151.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1588
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 372
        7⤵
        Program crash
        
        PID:3848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41037.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5428.exe
        7⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 372
        7⤵
        Program crash
        
        PID:3556
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 684 -s 368
        6⤵
        Program crash
        
        PID:840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41172.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20255.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21153.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2700
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 380
        7⤵
        Program crash
        
        PID:3120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35111.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2820
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 380
        6⤵
        Program crash
        
        PID:3580
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 376
        5⤵
        Program crash
        
        PID:2544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25090.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31189.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49803.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21153.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2096
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 380
        7⤵
        Program crash
        
        PID:3864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10607.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1668
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 380
        6⤵
        Program crash
        
        PID:3236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9517.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29705.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2888
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 372
        6⤵
        Program crash
        
        PID:3804
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 368
        5⤵
        Program crash
        
        PID:1536
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 380
      4⤵
      Loads dropped DLL
      Program crash
      PID:1568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57322.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57322.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61292.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6684.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7042.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2644
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 240
        7⤵
        Program crash
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32122.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2688
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 376
        7⤵
        Program crash
        
        PID:4404
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 372
        6⤵
        Program crash
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29361.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51988.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38631.exe
        7⤵
        
        PID:952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-475.exe
        8⤵
        
        PID:4536
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 380
        7⤵
        Program crash
        
        PID:4004
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 372
        6⤵
        Program crash
        
        PID:3088
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 368
        5⤵
        Program crash
        
        PID:1488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23575.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53311.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5200.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2572
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 304 -s 372
        6⤵
        Program crash
        
        PID:3128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9263.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1604
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 384
        5⤵
        Program crash
        
        PID:3724
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 376
      4⤵
      Program crash
      PID:2028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 360
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 372
  2⤵
  - Program crash
  PID:2636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-27276.exe

Filesize
192KB

MD5
1a0b8bf14454410a8070ed91db27e150

SHA1
26db0e46d020a9619ad063f82e0502753dd07e55

SHA256
09c7ea8505e637f4c74ff9bbdf5634d382d2a32c5a1f7a06f9e3b7465ad60cf0

SHA512
58c712085cb2d5ab305c8b04d75fbba5b1f106c38023ae989ee3b85798822011d11aa9e9bb9613c3c8eae43dc28464f33a75714c2a8ec3e48c8c8203792a92db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28183.exe

Filesize
192KB

MD5
c06b7daffd613c9263feedb5c09eb05f

SHA1
3d322c8ccd89fe70e5c6ae6591170b5c64b6d6a2

SHA256
b45e822c167d3915f614c175e712098856d9561a959b762f5f0d186d07309b76

SHA512
78530ab7cd69ffd098051e1c5445b488498c06ef83b4bf170504651aa81dedefa7d37ed4b2cb25bc67b9adb52c148cafa4a6179f337a7e09fae157525013645b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56575.exe

Filesize
192KB

MD5
dee0f05b0b4e84347fa4a3441c6bf92a

SHA1
084109b10a2760c33c0d9c402f67eaad4919aab8

SHA256
f4e2d2b8c68693ebaada89eb1658d7fd37897852ab475d5570ba62445ac6a456

SHA512
c1f1bf1bd6c83baf98b74c64d60053bf590392512089027f0b5122ec987e2d45de3483d8c98286857cdd1a3297e051d22b9cf66a048ca89567251b1c0e0b2e9a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15735.exe

Filesize
192KB

MD5
54ce624f6bfd8c07f77c6892ee4dad54

SHA1
0ed5a0fbe292253be995daf93f74e82691e762af

SHA256
e338ffcb173a7fcbd9ff66a9f48b26fbb4dd7aab2744b91e92063a74babf17a8

SHA512
5610471e6540267db623c4558a2746777b741f576a4e50abf4d3f27d32eaaf6e16c28cf4745711f9e631359a732d83cc810d34a3859a289d59d0ef0c222ab613

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17411.exe

Filesize
192KB

MD5
ecfa563a7e6c266be4edc18749360f65

SHA1
b18a770738f4d08d8d795c783d280524669c4eff

SHA256
b810cdb976acaadc4fccb362155649cac06fe0c7b3f65ac0d8346116d73f8bec

SHA512
4571a8ab933aa70dab091834bdd7c6f0ea9419dd817d4e9da499d458c0a03df33bf1aec0fe56225f1c10080809b663d1b1388113cea734247763db15d9d370bb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28236.exe

Filesize
192KB

MD5
e9ee97678c713bcddd6f8e295cfcf94c

SHA1
5e5608f4e59acd3a081cd587d4dae4747cc7da36

SHA256
edaf3375850db15ca559a4b256d33650f8e869a182190bb09f0c52cc137d51bd

SHA512
1d5a3e197f278c1d5c65d9db4d7079b95435196256d793676aa80741f2ff2c809a46af349c2d22083f685e198d130b45fc0d152dac763255f485bbb0a10455d3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32817.exe

Filesize
192KB

MD5
e917a08af65b0505cbc1ce441cea9580

SHA1
eb66083aa8b52f706b5021bb2f078c915151d78c

SHA256
6281aaa8b9a9f47929f989c15cd75afe828f2812db2241fbf510b6aefdd648f8

SHA512
faa39d4a9d4a9683c10267660a97d7acc58eadcd23aac70d36e54008a83d2be27559c7344f687b470e02537363124a6ebe6f30014f9834d78b0ff6f5b70a317a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3326.exe

Filesize
192KB

MD5
95368a20366b3513f57ec2ad697d1714

SHA1
3aa09e5acccf571df4458fbcdb0258dfa87719d0

SHA256
508d7af41a8263b5917c5a5520f0c0f60faaf1aa124ae948c7cd7cba38329d3d

SHA512
9ceb39f2f0da4c91d8ecbe2ee43c4c77d481550dd8bcd51b2d13aba2ace289f8c75445d0bec5d9ddd1a7ffb989068cfbdcb53d2b7c577f98ad6a00b30c70893f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52133.exe

Filesize
192KB

MD5
db0140700d2433070156f08fa291b694

SHA1
b3d5cac1da17120cb63fd27d0dbaa253c33c810a

SHA256
d49a1e81d2b6c0696436f9366fbc64b16a0dade6705e28c17b3277d243d3a72a

SHA512
13e8951f632ebb613ac7ab76442b6110951d52fc1ad86268341a95fd245e9460508fb8d8ced28d0dd2ef0fc439be8ad1f7b0c45d8048a0f375a18ccb0cd4e820

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56409.exe

Filesize
192KB

MD5
fa81ede02607d2de44499df3a5807905

SHA1
013b2b7d0a9d5488f0a961b1691190ff3417d122

SHA256
6c5149cab8b3e47c82123def4a1456b6dc95e3f5dc61c704e13e4272a80db4c7

SHA512
8dc2bf6e8c0744771e7b52c32773d548a9013652823de595f4b35af12a3f0b05cac651d815a5d767a7cffe4c7e99dea673638df5aa4b2d025514be8f97576b61

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57322.exe

Filesize
192KB

MD5
ce21f8f87d65fed0b463ebd6b5ad36a8

SHA1
fb515ee736c7dbbe9eab4ba1833494b635fa210d

SHA256
2642e91dbb79c6b1cb16e6570fd41215d7adf347fc580d4bb989b6fa80f7ebe6

SHA512
819aae53a40f9127e7bae0d9a5228a31f6c7076f36f6cd021640e3d93f4ce6efbd24986bbbd90b5d803ec5a646f408a64f963bbcdfbba5b222243e51919e3ca4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57711.exe

Filesize
192KB

MD5
344bbba156ebdf6f0a3499694ea85d71

SHA1
59d4982d9c48135596c011719756db58fd5af02e

SHA256
c43406a78d48842ec05e7eededfcbbd07027be3f3e62eaa26d98cb0df5a103fd

SHA512
a96a7e3a7a880c78304437f101cfceba044f6da5c6cadeabf58466d0e81467c251c6872102dc11cb54008cdcf3d5cca8a13250fbf0d584061fdae746c9e2fba1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61292.exe

Filesize
192KB

MD5
9fe15160d68b77ac54e7e7809dcdf866

SHA1
ff7c93e0eb94831282d1b5d31a80c8509fd8d3b6

SHA256
5753d30888976850b3abcfa2517030cd2bd95e62dcecae412d24b068c5c16fd7

SHA512
31a4f4f997f8a79260dfa7d6f126684f7e63cb502cdd318ea56a5fb02f3037e7ad292bc7bf40d532bdaa02cf8b589f837ad5d75c4ee1a01a952050b0b01e1138

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-7955.exe

Filesize
192KB

MD5
074725ee372aa5a61850dc940d6bf433

SHA1
06da3ce862a7415d8e3111e8e1c78eaf3e90563a

SHA256
749abc29e404fc4b5579d24f5915f90275c721945a48b681502c36cfdd674eb3

SHA512
916b0b6490c067d7063a813f64764df2e8904d8b8bec21a937db24ec295d202235aecc390cd736abbaca89d43452eb95481fb769993ec37ea37debc3f7fd89d7

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads