kawaiiunicorn | c4542d98d14404bedce06b652233360361434e9032caec4afc6b546ddbf204f6

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 07:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c4542d98d14404bedce06b652233360361434e9032caec4afc6b546ddbf204f6.exe
Size 468KB
Sample260828-jdkd4acb73
SHA256 c4542d98d14404bedce06b652233360361434e9032caec4afc6b546ddbf204f6
MD5 bde0a2f556312f729311696e08ff3dba
SHA1 4f7d926832e0794fd111a3e636da6b706b5ab4dc
SHA512 1a4b90a64bbb6bbde59d2051805f37878791dbe8fa5afae80eb0de16839283050151408d3b3230bdbb444b045bc65d34d05bf377af60ee30f2faa1d73da22416
SSDEEP 3072:3GnWoao5nJXo6ZpGWBVP6N3kxQosVFze7sNHdu/t8rkXplNTwlAhGd0W:3GWoNJo6iWvP6NfKgvrkXpjwAhG
TLSH
T168A4A5929C64AF45FE16453427956EBA004E7D2FA6E4422C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery kawaiiunicorn trojan

Malware Config

Signatures

Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
trojan kawaiiunicorn

Detects KawaiiUnicorn 64 IoCs

resource	yara_rule
behavioral1/memory/1840-0-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x001b0000000242e8-5.dat	family_kawaiiunicorn
behavioral1/memory/4012-7-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00090000000244b1-13.dat	family_kawaiiunicorn
behavioral1/memory/4968-14-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00070000000244b6-17.dat	family_kawaiiunicorn
behavioral1/memory/2528-21-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00070000000244b7-26.dat	family_kawaiiunicorn
behavioral1/memory/3492-28-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00070000000244b8-33.dat	family_kawaiiunicorn
behavioral1/memory/2372-34-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00070000000244b9-40.dat	family_kawaiiunicorn
behavioral1/memory/4684-42-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00070000000244ba-47.dat	family_kawaiiunicorn
behavioral1/memory/1084-49-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00070000000244bb-54.dat	family_kawaiiunicorn
behavioral1/memory/1436-56-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00070000000244bd-61.dat	family_kawaiiunicorn
behavioral1/memory/3284-63-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00070000000244c1-68.dat	family_kawaiiunicorn
behavioral1/memory/4908-70-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00070000000244c2-75.dat	family_kawaiiunicorn
behavioral1/memory/1264-77-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00070000000244c3-82.dat	family_kawaiiunicorn
behavioral1/memory/4384-84-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00070000000244c4-89.dat	family_kawaiiunicorn
behavioral1/memory/392-91-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00070000000244c5-96.dat	family_kawaiiunicorn
behavioral1/memory/1752-98-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00070000000244c6-103.dat	family_kawaiiunicorn
behavioral1/memory/3888-105-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00070000000244c7-110.dat	family_kawaiiunicorn
behavioral1/memory/4652-112-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00070000000244c8-117.dat	family_kawaiiunicorn
behavioral1/memory/5108-119-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00070000000244c9-124.dat	family_kawaiiunicorn
behavioral1/memory/3308-126-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00070000000244ca-131.dat	family_kawaiiunicorn
behavioral1/memory/1188-133-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00070000000244cb-138.dat	family_kawaiiunicorn
behavioral1/memory/1840-140-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/1536-141-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00070000000244cc-146.dat	family_kawaiiunicorn
behavioral1/memory/2496-149-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/4012-148-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00070000000244cd-154.dat	family_kawaiiunicorn
behavioral1/memory/4016-157-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/4968-156-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00070000000244ce-162.dat	family_kawaiiunicorn
behavioral1/memory/3656-165-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/2528-164-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/1568-173-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/3492-172-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00070000000244d4-171.dat	family_kawaiiunicorn
behavioral1/files/0x00070000000244d6-178.dat	family_kawaiiunicorn
behavioral1/memory/3144-181-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/2372-180-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00070000000244d8-186.dat	family_kawaiiunicorn
behavioral1/memory/5012-189-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/4684-188-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00070000000244dc-194.dat	family_kawaiiunicorn
behavioral1/memory/512-197-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/1084-196-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00070000000244e5-202.dat	family_kawaiiunicorn

Executes dropped EXE 32 IoCs

pid	Process
4012	Unicorn-24282.exe
4968	Unicorn-18055.exe
2528	Unicorn-45159.exe
3492	Unicorn-7774.exe
2372	Unicorn-8646.exe
4684	Unicorn-52087.exe
1084	Unicorn-18943.exe
1436	Unicorn-52583.exe
3284	Unicorn-13081.exe
4908	Unicorn-10974.exe
1264	Unicorn-10502.exe
4384	Unicorn-53943.exe
392	Unicorn-22143.exe
1752	Unicorn-62511.exe
3888	Unicorn-59335.exe
4652	Unicorn-37239.exe
5108	Unicorn-46471.exe
3308	Unicorn-43765.exe
1188	Unicorn-179.exe
1536	Unicorn-42084.exe
2496	Unicorn-34549.exe
4016	Unicorn-15660.exe
3656	Unicorn-49396.exe
1568	Unicorn-65260.exe
3144	Unicorn-59692.exe
5012	Unicorn-27892.exe
512	Unicorn-56044.exe
3576	Unicorn-65180.exe
1600	Unicorn-34916.exe
4132	Unicorn-50780.exe
3952	Unicorn-51652.exe
4956	Unicorn-29556.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4620	4956	WerFault.exe	125

System Location Discovery: System Language Discovery 1 TTPs 33 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10502.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62511.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-179.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56044.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18055.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8646.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43765.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34916.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34549.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15660.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52087.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37239.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51652.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29556.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13081.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50780.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53943.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22143.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24282.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52583.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46471.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49396.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65260.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59692.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27892.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65180.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c4542d98d14404bedce06b652233360361434e9032caec4afc6b546ddbf204f6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7774.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45159.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18943.exe

Suspicious use of SetWindowsHookEx 32 IoCs

pid	Process
1840	c4542d98d14404bedce06b652233360361434e9032caec4afc6b546ddbf204f6.exe
4012	Unicorn-24282.exe
4968	Unicorn-18055.exe
2528	Unicorn-45159.exe
3492	Unicorn-7774.exe
2372	Unicorn-8646.exe
4684	Unicorn-52087.exe
1084	Unicorn-18943.exe
1436	Unicorn-52583.exe
3284	Unicorn-13081.exe
4908	Unicorn-10974.exe
1264	Unicorn-10502.exe
4384	Unicorn-53943.exe
392	Unicorn-22143.exe
1752	Unicorn-62511.exe
3888	Unicorn-59335.exe
4652	Unicorn-37239.exe
5108	Unicorn-46471.exe
3308	Unicorn-43765.exe
1188	Unicorn-179.exe
1536	Unicorn-42084.exe
2496	Unicorn-34549.exe
4016	Unicorn-15660.exe
3656	Unicorn-49396.exe
1568	Unicorn-65260.exe
3144	Unicorn-59692.exe
5012	Unicorn-27892.exe
512	Unicorn-56044.exe
3576	Unicorn-65180.exe
1600	Unicorn-34916.exe
4132	Unicorn-50780.exe
3952	Unicorn-51652.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 4012	1840	c4542d98d14404bedce06b652233360361434e9032caec4afc6b546ddbf204f6.exe	85
PID 4012 wrote to memory of 4968	4012	Unicorn-24282.exe	86
PID 4968 wrote to memory of 2528	4968	Unicorn-18055.exe	87
PID 2528 wrote to memory of 3492	2528	Unicorn-45159.exe	89
PID 3492 wrote to memory of 2372	3492	Unicorn-7774.exe	90
PID 2372 wrote to memory of 4684	2372	Unicorn-8646.exe	91
PID 4684 wrote to memory of 1084	4684	Unicorn-52087.exe	92
PID 1084 wrote to memory of 1436	1084	Unicorn-18943.exe	93
PID 1436 wrote to memory of 3284	1436	Unicorn-52583.exe	95
PID 3284 wrote to memory of 4908	3284	Unicorn-13081.exe	97
PID 4908 wrote to memory of 1264	4908	Unicorn-10974.exe	98
PID 1264 wrote to memory of 4384	1264	Unicorn-10502.exe	99
PID 4384 wrote to memory of 392	4384	Unicorn-53943.exe	100
PID 392 wrote to memory of 1752	392	Unicorn-22143.exe	101
PID 1752 wrote to memory of 3888	1752	Unicorn-62511.exe	102
PID 3888 wrote to memory of 4652	3888	Unicorn-59335.exe	103
PID 4652 wrote to memory of 5108	4652	Unicorn-37239.exe	104
PID 5108 wrote to memory of 3308	5108	Unicorn-46471.exe	105
PID 3308 wrote to memory of 1188	3308	Unicorn-43765.exe	106
PID 1188 wrote to memory of 1536	1188	Unicorn-179.exe	107
PID 1536 wrote to memory of 2496	1536	Unicorn-42084.exe	108
PID 2496 wrote to memory of 4016	2496	Unicorn-34549.exe	109
PID 4016 wrote to memory of 3656	4016	Unicorn-15660.exe	110
PID 3656 wrote to memory of 1568	3656	Unicorn-49396.exe	111
PID 1568 wrote to memory of 3144	1568	Unicorn-65260.exe	115
PID 3144 wrote to memory of 5012	3144	Unicorn-59692.exe	117
PID 5012 wrote to memory of 512	5012	Unicorn-27892.exe	120
PID 512 wrote to memory of 3576	512	Unicorn-56044.exe	121
PID 3576 wrote to memory of 1600	3576	Unicorn-65180.exe	122
PID 1600 wrote to memory of 4132	1600	Unicorn-34916.exe	123
PID 4132 wrote to memory of 3952	4132	Unicorn-50780.exe	124
PID 3952 wrote to memory of 4956	3952	Unicorn-51652.exe	125

C:\Users\Admin\AppData\Local\Temp\c4542d98d14404bedce06b652233360361434e9032caec4afc6b546ddbf204f6.exe
"C:\Users\Admin\AppData\Local\Temp\c4542d98d14404bedce06b652233360361434e9032caec4afc6b546ddbf204f6.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24282.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24282.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18055.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18055.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45159.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7774.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8646.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52087.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18943.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52583.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13081.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10974.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10502.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53943.exe
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22143.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62511.exe
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59335.exe
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37239.exe
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46471.exe
        18⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43765.exe
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-179.exe
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42084.exe
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34549.exe
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15660.exe
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49396.exe
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65260.exe
        25⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59692.exe
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27892.exe
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56044.exe
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65180.exe
        29⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34916.exe
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50780.exe
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51652.exe
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29556.exe
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4956
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 224
        34⤵
        Program crash
        
        PID:4620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4956 -ip 4956
1⤵
PID:1476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-10502.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-10502.exe
Size 468KB
SHA256 f67aca4081ca5972a6a9c1343829df97de6d5d9ea6ba05d0ce4b0de76b57ef2d
MD5 c0a04a146796afca8f67dc96a17468a6
SHA1 ccfa939551875967240dd2c7f2e999527f36440a
SHA512 c26e658ab64e199df6bbc785513b966b55bcae11fe5d37d931b44fcb03cab84e4c6df8b0b30f773738c93a85ae0eb1d9323a4b92bf6d733f0f72fd1fb7ee04ae
SSDEEP 3072:3G11oavmnJXo8ZpGWBVP6N3fQQosVFze7FNHdu/t8rkXplNUwlPhGd0W:3GHoZJo8iWvP6NLKRvrkXpjbPhG
TLSH
T1B3A4A5929C64AF45FE16453427956EBA004E7D2FA6E4422C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-10974.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-10974.exe
Size 468KB
SHA256 8575d002a28fe78f4530a1d42d66ab8be4d24a9de164afc045b7a63c31ef22d8
MD5 47ef1f4798dd625fec5d60d5d5c4f75e
SHA1 efbecd53ba67f9005daddd44b0320e37f5f27a0d
SHA512 7fc5ac50b82259bb3be6715beb0622ecf7b3948316bb45f87ac810a15ccc08a3635e64e74dead7d23fb6d2c9156f9c1a064bfac8ca5b05b4718d37372e190888
SSDEEP 3072:3G11oaomnJXo8ZpGWBVP6N3fQQosVFze7FNHdu/t8rkXplNUwlPhGd0W:3GHoqJo8iWvP6NLKRvrkXpjbPhG
TLSH
T1E9A4A5929C64AF45FE16453427956EBA004E7D2FA6E4422C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-13081.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-13081.exe
Size 468KB
SHA256 5cf33ec0586d56c2fad0ad0289c6c8a411afe7bd55235a0d439b6fadabdd8488
MD5 533bd2606ad30b1ff8234c22ee7e4afc
SHA1 e04451d60d819b7b68d4dc2343cd6d07677e654f
SHA512 2be7d8692419f8aac321f9db98ff7c227faf4fd078fbd7d0793529ef811efe4d1101564c120c00215af2a8f4dbd654cfb6c44eb6cbfc8b5c838e5e95b7cdb450
SSDEEP 3072:3G11oao5nJXo8ZpGWBVP6N3fQQosVFze7FNHdu/t8rkXplNUwlPhGd0W:3GHoNJo8iWvP6NLKRvrkXpjbPhG
TLSH
T1B5A4A5929C64AF45FE16453427956EBA004E7D2FA6E4422C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-15660.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-15660.exe
Size 468KB
SHA256 415f388b84b824e542e12cf10c03973cde84814e2c8cfbbed50d2f2ae8711d3e
MD5 e4593566cbb2238f9bc854b690685040
SHA1 85913de6f4a089ee693ce934d6bf0194c1c2a29d
SHA512 63b011635329dc30c6f6970fadffe8c4890b6ca324e56be1bba82051aef5d45df521c95e2dc8523429f3c82694d792f171172bd8175261c1251bd67a36a87848
SSDEEP 3072:3G11oavmnJXo8ZpGWEVP6N3fQQosV6ze7FNHdu/t8rkBA1NtXlVhGi0c:3GHoZJo8iWsP6NcKRvrkBAT7VhG
TLSH
T1F7A4A5929C64AF45FE16453427956EBA004E7D2FA6E4422C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-179.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-179.exe
Size 468KB
SHA256 c3160aad2be0d68fc7b522f7e2d6098897827884fc54ec2e5d88d626a0cca11f
MD5 99a5dad1559844d5042eca3356d721b5
SHA1 15c9752f2ae49c5dd9b4f5af4891a45ad3acf382
SHA512 f18900f348397866b6a7b97f03dc0e7043fe386a6b4186cf32712ea70ac9c9d61a7974385faac19de6fc3e8e87972fe8685be50c33dfe106cf360eb3734d3856
SSDEEP 3072:3G11oavmnJXo8ZpGWBVP6N3fQQosV6ze7FNHdu/t8rkXAlNtXlVhGi0c:3GHoZJo8iWvP6NcKRvrkXAj7VhG
TLSH
T11AA4A5929C64AF45FE16453427956EBA004E7D2FA6E4422C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-18055.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-18055.exe
Size 468KB
SHA256 c78955746c7720f063130febda74ee1c1b37cfffb77f776471393ad9a6480762
MD5 cf6cdb4ea1ec0f0beb025e5a15c96932
SHA1 74a04becf6b9e78fa8c79953f2207a9666059fc8
SHA512 0be32673897b4e771105f4451fbd63c5342c0e0ad1aa50b8e956093c6cc5ff4c6fc69c268b2167ff2df82cf87d901326041d6d5edaa07d583fc36c8bcd65bc2e
SSDEEP 3072:3GnWoao5nJXo6ZpGWBVP6N3fxQosVFze7FNHdu/t8rkXplNTwlAhGd0W:3GWoNJo6iWvP6NIKRvrkXpjwAhG
TLSH
T1C7A4A5929C64AF45FE16453427956EBA004E7D2FA6E4422C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-18943.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-18943.exe
Size 468KB
SHA256 4ac632ac59f983493fe54c5bc9f048be84a1a25a432bffd770558cb4ddb796d7
MD5 e7f42934c830cf70a033311c0f717edb
SHA1 bee077b7f1ff46a9ea15818d54486c18eb2ba319
SHA512 df6b496183f2ab63b80268d2caf25a3d07f591d5cd8501afe388be44bf7598b78a47e68bfa1db04554cc8d0f769702a68ed95bd734a405d06a2b4031166d3d58
SSDEEP 3072:3G11oao5nJXo6ZpGWBVP6N3fQQosVFze7FNHdu/t8rkXplNUwlrhGd0W:3GHoNJo6iWvP6NLKRvrkXpjbrhG
TLSH
T171A4A5929C64AF45FE16453427956EBA004E7D2FA6E4422C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-22143.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-22143.exe
Size 468KB
SHA256 3dc06345065e14aa22fc0ae084a4e2e349e3c8a41389a9c7963735de797f72c6
MD5 646124542a01bb09ec0c9c92e719f9c2
SHA1 454c4bfadd99a9a170c1dba4b5d3e19e92d44433
SHA512 24afc344496e802b2d32b455b0bbdccdce7f521b7de69811b5898d1c2c87b003022960508d57a57fbb4b72c2132778f0f12469e5e2d963a780b88fad24bbf167
SSDEEP 3072:3G11oavmnJXo8ZpGWBVP6N3fQQosV6ze7FNHdu/t8rkXplNUwlVhGd0W:3GHoZJo8iWvP6NcKRvrkXpjbVhG
TLSH
T10EA4A5929C64AF45FE16453427956EBA004E7D2FA6E4422C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-24282.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-24282.exe
Size 468KB
SHA256 8271c14ccbe92b65aa5f92eb274b614a5488243857f393b362a8b96d7a0ceb6e
MD5 c63ec70422cc7164e011670c054dde78
SHA1 6455f332dc1e76ebac94e91c2066afb8ff64c319
SHA512 e72673605ba955ecb7c6c93e7465fa2fba21f2c6a2da2ab6890d692d32d77ff0dde3d91c5546bc47f96096c24c520e2b8918eb0da557ec8a890fbdece351178f
SSDEEP 3072:3GnWoao5nJXo6ZpGWBVP6N3kxQosVFze7FNHdu/t8rkXplNTwlAhGd0W:3GWoNJo6iWvP6NfKRvrkXpjwAhG
TLSH
T1D5A4A5929C64AF45FE16453427956EBA004E7D2FA6E4422C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-27892.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-27892.exe
Size 468KB
SHA256 c0f20d2b88ea3f33228d0d9b286fa58e4b3d160a9d599dc3acd1a24e3f96f0ef
MD5 3e96cfaa3dbb5988b2857246edcfc277
SHA1 d4eeeb9eb6728e54b6baf02044024ff58f1c64ee
SHA512 60760afd4db4f59d1ab2075f4c8b22b60828967da91bfe69114bc0609cf3b0492edf630fc8843970a1e225c93ddb91a7dd53a76519dd18569dc2b7301b6aacd0
SSDEEP 3072:3G11oavmnJXo8ZpGWEVP6N3fQQosV6ze7FNHdu/t4rkBA1NtXSVhGn05:3GHoZJo8iWsP6NcKRDrkBAT0VhG
TLSH
T146A4A5929C64AF45FE16453427956EBA004E7D2FA6E4422C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-29556.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-29556.exe
Size 468KB
SHA256 5f728db1115e85e2fb415ca436ef3eede05da7b6cf44906223bec6b24845c991
MD5 3979f30d3341d12518ee9a0a0ec128c0
SHA1 c910c35e878b4988e37a08800b9deb0fcbf39a8a
SHA512 5f4e9050455980fb8e4468a249c3880921e60bfc275c9374d3a67faec32b89d30ff16b30c039b1a5336a48e3f91ac831f050fb6838385c46f32d60d08adffc22
SSDEEP 3072:3G11oavmnJXo8ZpGWEVP6N3fQQosV6ze7FNHdu/tJrkZA1NtXLlaGn0o:3GHoZJo8iWsP6NcKRWrkZATllaG
TLSH
T1ECA4A5929C64AF45FE16453427956EBA004E7D2FA6E4422C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-34549.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-34549.exe
Size 468KB
SHA256 717faa1d6c787b9932aea907bbe4875a0ad8e2710a308eff4d26302d2f48d5fa
MD5 38741024bbac292b81c3efcde7f0bca0
SHA1 fb0b8135ba17245a13f9a9333032a198144751e2
SHA512 6a65509c3e525e5e00e7131676ac48771a7fa2af61a01e6b2ada94f6ab5788aa321d49d92403cf3961117b61694a567f6733b0bbc62d1a399bd4ffb0b94b0764
SSDEEP 3072:3G11oavmnJXo8ZpGWBVP6N3fQQosV6ze7FNHdu/t8rkBA1NtXlVhGi0c:3GHoZJo8iWvP6NcKRvrkBAT7VhG
TLSH
T159A4A5929C64AF45FE16453427956EBA004E7D2FA6E4422C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-34916.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-34916.exe
Size 468KB
SHA256 ada7720f0c64c8e1aeb6266b16571918fadba701b1a3d315bacfcccccffbdfca
MD5 267be277ca9c322f8f8ef931db66cdde
SHA1 8f13c49f6d850412b87ac3906b3e1087d3a17668
SHA512 a51fef20f084792456eacd91a7ad24a3a441ebdb07b30fee01cefaca57ef2241a9283f5e813a21513284dbc7cce9c29edb1127f77d68a54912782a8cde49bc8f
SSDEEP 3072:3G11oavmnJXo8ZpGWEVP6N3fQQosV6ze7FNHdu/t4rkZA1NtXSVaGn0o:3GHoZJo8iWsP6NcKRDrkZAT0VaG
TLSH
T13EA4A5929C64AF45FE16453427956EBA004E7D2FA6E4422C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-37239.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-37239.exe
Size 468KB
SHA256 3266c6ee0019e6f42dd98cc4c2ecd4b88bf8fb2696616cfa4b7039c389557b9b
MD5 e82bdab19b61f35d3561e04890823d81
SHA1 393b28c00ffd056a487508a681bc05e7563f8821
SHA512 c07cad2527b822a4328e060feb7a24ead3637410c3a403586ad61c6fa9ee6e53647512ca159dcf20e2263b71552d7112a93fd0ed88627e2fd0bce29a3eb79102
SSDEEP 3072:3G11oavmnJXo8ZpGWBVP6N3fQQosV6ze7FNHdu/t8rkXAlNUwlVhGi0W:3GHoZJo8iWvP6NcKRvrkXAjbVhG
TLSH
T1BCA4A5929C64AF45FE16453427956EBA004E7D2FA6E4422C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-42084.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42084.exe
Size 468KB
SHA256 c62bc5ed6acbfb4e8e43e3544f02d6324e267c9acfbb6a385b82f0639936a8ce
MD5 182f8ce38a84c0e59fee27e96b115dbb
SHA1 f6f8968c9a1d8375e230c039ff438746ecd1726e
SHA512 db212c19423f89a71d25096f86df28ea34763bc23d07508e5da49d8ab50a3bcb819692db92d01850c7cc529718d731ecbf5a4c8660d443be64a435300b59d03e
SSDEEP 3072:3G11oavmnJXo8ZpGWBVP6N3fQQosV6ze7FNHdu/t8rkXA1NtXlVhGi0c:3GHoZJo8iWvP6NcKRvrkXAT7VhG
TLSH
T18CA4A5929C64AF45FE16453427956EBA004E7D2FA6E4422C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-43765.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-43765.exe
Size 468KB
SHA256 17f6943cc788f90e5d77ea87c089ccc5f08bb210958c59b03944aee256775011
MD5 9a74a8580dbb9294e663eee136c6128d
SHA1 ffacf426587238d7a9ec55f328a27a0376b69342
SHA512 bdea07fa90d700d27bf216d394835449c14bf4ae49cac881298a7840a544ed301b3eb19260048accd319642d5b9beee79fcee8765a446a5896ed73f5e7f073b0
SSDEEP 3072:3G11oavmnJXo8ZpGWBVP6N3fQQosV6ze7FNHdu/t8rkXAlNtXlVhGi0W:3GHoZJo8iWvP6NcKRvrkXAj7VhG
TLSH
T15AA4A5929C64AF45FE16453427956EBA004E7D2FA6E4422C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-45159.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-45159.exe
Size 468KB
SHA256 b2ac3c1220438265b374f41499b51a9f1a8c3d1c8473f329d6ec9d8479c04fb5
MD5 f02c5840911c87e8e5dd3292e8973dda
SHA1 4869e187c70a7c2932ca3f136dbcee982f72172a
SHA512 fdad684367e54913bc21db0fe07006e8cb8633480bac827d06297c5f6b153335765131cf8e2c103f0984c3149ff9741d80ecaf9982861b9fbca44e560af2a3f2
SSDEEP 3072:3GnWoao5nJXo6ZpGWBVP6N3fxQosVFze7FNHdu/t8rkXplNUwlAhGd0W:3GWoNJo6iWvP6NIKRvrkXpjbAhG
TLSH
T1ADA4A5929C64AF45FE16453427956EBA004E7D2FA6E4422C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-46471.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-46471.exe
Size 468KB
SHA256 34f57c1ac9b9967b57d6f2a3fbe013355a542b8f957cd0e21da89aadd2da7701
MD5 0443d3779e684b5f88da7c4e5c360171
SHA1 acb4b79abee558d6abd5b7c8d0eeecb7c4caa8b5
SHA512 b010108843284f019065a2609d91d36125f96b32163391539a878d7b64f91173d073e458b9fcbd4a14912fb1ee4ce0c3058c03a41a946bfb6ae1a2e9945b459f
SSDEEP 3072:3G11oavmnJXo8ZpGWBVP6N3fQQosV6ze7FNHdu/t8rkXAlNUXlVhGi0W:3GHoZJo8iWvP6NcKRvrkXAjaVhG
TLSH
T123A4A5929C64AF45FE16453427956EBA004E7D2FA6E4422C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-49396.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-49396.exe
Size 468KB
SHA256 be72511cbf01f5b245120c3481f1d4e24eb21bf0f69c94da0adc113ca776fd36
MD5 ee7281e172e66b5965ce27c9de298845
SHA1 cf96228c0e4f8f91db1b26e951736ced85f002e2
SHA512 8bf0878bd5713644d58c075d493724e537b05a0c419cb15e5e7db9c3146d9c0677afcdb474fb04e67599956e7cda2f3a1484b0d2a663bcd5db70a2c00607f58e
SSDEEP 3072:3G11oavmnJXo8ZpGWEVP6N3fQQosV6ze7FNHdu/t8rkBA1NtXSVhGi0c:3GHoZJo8iWsP6NcKRvrkBAT0VhG
TLSH
T1B6A4A5929C64AF45FE16453427956EBA004E7D2FA6E4422C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-50780.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-50780.exe
Size 468KB
SHA256 6e4f76c9b067b8916d5c796c1ce670312322fe2d39d32c22cd62c478fd586a27
MD5 4da3c6e74939fca5c6869cc2928dc308
SHA1 70ccdc36ef65ef18093c12e7fd5f984082bd00fa
SHA512 88113a78c821f39538d12908b2600bf064b3d7c453ce6c86d0775ad9dca1aab8047d3781210fe8c5b18934d240e1981b8e8d29a205a4a3a9a4bd442d1f256214
SSDEEP 3072:3G11oavmnJXo8ZpGWEVP6N3fQQosV6ze7FNHdu/t4rkZA1NtXLVaGn0o:3GHoZJo8iWsP6NcKRDrkZATlVaG
TLSH
T1A3A4A5929C64AF45FE16453427956EBA004E7D2FA6E4422C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-51652.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-51652.exe
Size 468KB
SHA256 5c0b3221b0088d3b19fa92783d8dcd2869e0628551fa6130563a6cce24a802c5
MD5 c7e6e238214163ca623ab8a2d82bf29b
SHA1 c5a6f15fb813d0392edd0e771e4fce718f525169
SHA512 ffc8bae8b6ec943879830e5eef85e96473dcc4a3f756015f1dbdc95770f4d6de445619d029017f292f69dacdc68104bc30438aeec92550c26478cf08357ef387
SSDEEP 3072:3G11oavmnJXo8ZpGWEVP6N3fQQosV6ze7FNHdu/t4rkZA1NtXLlaGn0o:3GHoZJo8iWsP6NcKRDrkZATllaG
TLSH
T19DA4A5929C64AF45FE16453427956EBA004E7D2FA6E4422C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-52087.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-52087.exe
Size 468KB
SHA256 27cffa2be2694a4ab59ccfb3a21732baf4c8da427fafe3f653dce9fb3b9cf728
MD5 e15afd943e74f5bb5033038d3ae205fd
SHA1 a06e12d0a8f3358c4569b61cd91ac21fe87d76d4
SHA512 48822980bc767e29ce107dbbcad381b776a7e01f2970c935089e577cd648e49f87c0bd10e23e9e6f0350813efbf086ee5e33919affc48f4bd60cdd5771d44587
SSDEEP 3072:3G11oao5nJXo6ZpGWBVP6N3fxQosVFze7FNHdu/t8rkXplNUwlrhGd0W:3GHoNJo6iWvP6NIKRvrkXpjbrhG
TLSH
T1D9A4A5929C64AF45FE16453427956EBA004E7D2FA6E4422C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-52583.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-52583.exe
Size 468KB
SHA256 f43c0f217bfa3dfba0d9c3c9c2dae50c5fdefdc6dbd860deb5400436a5e3874e
MD5 835b4d968a13b9ec7b85b75f1a75a2ae
SHA1 ec52229c28cd9286e41c78975e1ae74fefa185b8
SHA512 5a68e726134e95f718be54336f472edbed14ded393fa63990b9accfe8a73683601f1ad2ad255ad3b3a9aa7f8bdda865d80a45dd12c4b23035d9486c0f1197498
SSDEEP 3072:3G11oao5nJXo6ZpGWBVP6N3fQQosVFze7FNHdu/t8rkXplNUwlPhGd0W:3GHoNJo6iWvP6NLKRvrkXpjbPhG
TLSH
T19BA4A5929C64AF45FE16453427956EBA004E7D2FA6E4422C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-53943.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-53943.exe
Size 468KB
SHA256 057210a4bdb7f5370224117e636fb85fe9ae683b96c565399e04ace82db849a3
MD5 f802607637deb4a90aaebfa2cd8d092a
SHA1 1377998ae6cfd092c8db762c14c138da02a079e1
SHA512 4bedd8312e5dd98841677a22e473c16cb28865d8ea0c0b012765364f2649563014edc2e8f5b0f26bfa59fd17c675727da02218950bc090dacfefca8eb53df77c
SSDEEP 3072:3G11oavmnJXo8ZpGWBVP6N3fQQosVFze7FNHdu/t8rkXplNUwlVhGd0W:3GHoZJo8iWvP6NLKRvrkXpjbVhG
TLSH
T1D4A4A5929C64AF45FE16453427956EBA004E7D2FA6E4422C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-56044.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-56044.exe
Size 468KB
SHA256 38c613c0a181e15967770ca653ae7c33b38a945f48e9e575c09fba423fdba226
MD5 0fc7fd7c734e9370ee2e6cb098b56b22
SHA1 a50b9c10c1905f60f219cb9eefa13c36bdd1633e
SHA512 b536e927be9fbf18b6617f7f99859d24e47338cb3037266ab355d636a488a4d06189a15675fd3b90c87bdc0091219e34258e35fe4fd7fd93c1c57572100db734
SSDEEP 3072:3G11oavmnJXo8ZpGWEVP6N3fQQosV6ze7FNHdu/t4rkBA1NtXSVaGn05:3GHoZJo8iWsP6NcKRDrkBAT0VaG
TLSH
T1D1A4A5929C64AF45FE16453427956EBA004E7D2FA6E4422C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-59335.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-59335.exe
Size 468KB
SHA256 d98ccc91d778e03e356a7cf479f75e96bcbdcb4e7953fd06a040941d15e169dc
MD5 9bbcb1423dc4071b7e00962f823fbd4a
SHA1 fb3169c72d82a7a9b0ce0a95cb04ee534f5c1a79
SHA512 fb0005582364b7a04be0f35ff0587bfc00466b89822fb79407f796a929d89306b52ba8ddf9c47071cab59b2420b9929f1b20701e4c1d3b54100834a5d2bc5a10
SSDEEP 3072:3G11oavmnJXo8ZpGWBVP6N3fQQosV6ze7FNHdu/t8rkXplNUwlVhGi0W:3GHoZJo8iWvP6NcKRvrkXpjbVhG
TLSH
T1C1A4A5929C64AF45FE16453427956EBA004E7D2FA6E4422C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-59692.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-59692.exe
Size 468KB
SHA256 3275963a46646625bce693cb364721826c8de654eedf7f575e144bafddd5bbc9
MD5 fc2884cae6160c2452fe3558b2e895f6
SHA1 051529f01dc66151b524b919b8ad1107684e8a6b
SHA512 01dde124732f2c5169d93d3e9b3dd662e58be57fa861ed389ff750afd46e1e8e3f323e4f129f837fea22e10aca39e2db360659515ac9d5e828b837f3ee5f8146
SSDEEP 3072:3G11oavmnJXo8ZpGWEVP6N3fQQosV6ze7FNHdu/t8rkBA1NtXSVhGn05:3GHoZJo8iWsP6NcKRvrkBAT0VhG
TLSH
T169A4A5929C64AF45FE16453427956EBA004E7D2FA6E4422C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-62511.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-62511.exe
Size 468KB
SHA256 bd9fe26ea36dbddd72296100687621082dd94ed956fd351fc4dc361331c57a18
MD5 1bacd596a746beb1862268cc4f2b9b47
SHA1 f3005b36a278a1b75067e7d7cf87fa56e2158063
SHA512 4356c36a7613c994de26917b95db9343c419a54b636b9b060b4743697515dd46c1f774fde5cc733f6c5d5f062c44165259c7600402a92d5756da9a71eee4f538
SSDEEP 3072:3G11oavmnJXo8ZpGWBVP6N3fQQosV6ze7FNHdu/t8rkXplNUwlVhGn0W:3GHoZJo8iWvP6NcKRvrkXpjbVhG
TLSH
T1FCA4A5929C64AF45FE16453427956EBA004E7D2FA6E4422C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-65180.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-65180.exe
Size 468KB
SHA256 ba20f743be0104e3039c14631a31586dc5c900fda0324d05a0380c9171c48b8e
MD5 ff2574feb02a09717e8356d6da0a7b29
SHA1 9b68c21c56a0a4ef50a720f230600fe058aebbe9
SHA512 90d4590c633e522020dd49d099f228f3840e711a6730da06489a2dd6a57497f77cac4a38cc81a5a169d0b60a51e62f42e1b0d600976431be3f016ddfbdc05756
SSDEEP 3072:3G11oavmnJXo8ZpGWEVP6N3fQQosV6ze7FNHdu/t4rkBA1NtXSVaGn0o:3GHoZJo8iWsP6NcKRDrkBAT0VaG
TLSH
T13BA4A5929C64AF45FE16453427956EBA004E7D2FA6E4422C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-65260.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-65260.exe
Size 468KB
SHA256 c3715d1abf8f1a25c705cb049b9ccd6c1bb08ae0ab70498c42fe45094d5fca38
MD5 e633c2b31175df78c969a590922f5f5b
SHA1 af3f6a62b9c7d931f0904ed45a1ef82719a4212e
SHA512 78b2167b46f9ebfda22c1851fa00d25b783c0cee1eed35ce12f19192843a219a971fee33dc10203230608d8c51a7982a90a3234cfa1040b979ac99fa1db6e412
SSDEEP 3072:3G11oavmnJXo8ZpGWEVP6N3fQQosV6ze7FNHdu/t8rkBA1NtXSVhGi05:3GHoZJo8iWsP6NcKRvrkBAT0VhG
TLSH
T16EA4A5929C64AF45FE16453427956EBA004E7D2FA6E4422C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-7774.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-7774.exe
Size 468KB
SHA256 4d1950ff1c9be9fa0d8b86b208933fa3a6dcb0cee1e238211a3b94e73cde18e4
MD5 5b480745ea376d0381db18d6e92b614b
SHA1 ea153bf804f1fe2d3f3a93fa9a3a0c33d6c06091
SHA512 67dbc1392c3dcaa913d9c9838845db75004da8df3194e1bb06503a035f6b5990571a192a4e5d61a6235eb186d7009dad679e63f5f70a32dbb8a7872b28a2bb7a
SSDEEP 3072:3G1Woao5nJXo6ZpGWBVP6N3fxQosVFze7FNHdu/t8rkXplNUwlAhGd0W:3GMoNJo6iWvP6NIKRvrkXpjbAhG
TLSH
T108A4A5929C64AF45FE16453427956EBA004E7D2FA6E4422C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-8646.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-8646.exe
Size 468KB
SHA256 357ab96de3ea399102892535fc347966d0fc9d34d8ca37abd62f09842c09a44c
MD5 fb6d666c787a71ddf198ec978d27f0b8
SHA1 9482cb2ff88f6fde3776bf4ed04f5c111ff0b8d4
SHA512 dbffaf625d8b78ea6965a583af2be283ba13381e6c177e396f87acaf65d0d9ac20068cde54ee17880723b541d88a5a2aca64100714e5cec17c51e253b35d4def
SSDEEP 3072:3G11oao5nJXo6ZpGWBVP6N3fxQosVFze7FNHdu/t8rkXplNUwlAhGd0W:3GHoNJo6iWvP6NIKRvrkXpjbAhG
TLSH
T14CA4A5929C64AF45FE16453427956EBA004E7D2FA6E4422C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/392-91-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/392-239-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/512-197-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1084-196-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1084-49-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1188-133-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1188-245-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1264-77-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1264-228-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1436-204-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1436-56-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1536-246-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1536-141-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1568-173-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1600-213-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1752-98-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1752-240-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1840-0-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1840-140-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2372-180-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2372-34-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2496-247-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2496-149-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2528-164-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2528-21-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3144-181-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3284-63-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3284-211-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3308-244-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3308-126-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3492-28-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3492-172-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3576-205-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3656-165-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3888-241-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3888-105-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3952-229-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4012-7-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4012-148-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4016-248-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4016-157-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4132-221-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4384-236-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4384-84-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4652-242-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4652-112-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4684-42-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4684-188-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4908-70-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4908-220-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4956-237-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4956-238-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4968-156-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4968-14-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5012-189-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5108-243-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5108-119-0x0000000000400000-0x0000000000475000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads