kawaiiunicorn | 12eca1c4fe4898ac8dbbed7b055ffa92a7cb7846e846ac5ab4e4896774525200

Analysis

max time kernel
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 19:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
12eca1c4fe4898ac8dbbed7b055ffa92a7cb7846e846ac5ab4e4896774525200.exe
Size 468KB
Sample260916-ymmcdafj8v
SHA256 12eca1c4fe4898ac8dbbed7b055ffa92a7cb7846e846ac5ab4e4896774525200
MD5 c1b50e0871590e1857398b7b719184ae
SHA1 6e162b780d305d837d9d408da96c5adcdc001ebb
SHA512 12c9236fea7acc4fa32d2f451942ca2f50b5f402c76a5eef5aa5d5891b74f5a36eeb29341d93a3f5d000e6e942b2a3557289bc7fe17de23a6dbfcbc38e995c16
SSDEEP 3072:GEGloTHk1/3YCPYS9zgYK1T/MEri7jfSnUHDF9c8JqfBdRnQJ/Shr:GEwoyvYCh98YK12r3hJqv1QJ/
TLSH
T17EA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery kawaiiunicorn trojan

Malware Config

Signatures

Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
trojan kawaiiunicorn

Detects KawaiiUnicorn 32 IoCs

resource	yara_rule
behavioral1/files/0x0008000000021709-4.dat	family_kawaiiunicorn
behavioral1/files/0x000c00000002469f-10.dat	family_kawaiiunicorn
behavioral1/files/0x000b0000000246a5-14.dat	family_kawaiiunicorn
behavioral1/files/0x00100000000246a6-22.dat	family_kawaiiunicorn
behavioral1/files/0x00110000000246a7-28.dat	family_kawaiiunicorn
behavioral1/files/0x00130000000246a8-34.dat	family_kawaiiunicorn
behavioral1/files/0x00150000000246a9-40.dat	family_kawaiiunicorn
behavioral1/files/0x00170000000246aa-46.dat	family_kawaiiunicorn
behavioral1/files/0x00190000000246ab-52.dat	family_kawaiiunicorn
behavioral1/files/0x001b0000000246ac-58.dat	family_kawaiiunicorn
behavioral1/files/0x001b0000000246ad-64.dat	family_kawaiiunicorn
behavioral1/files/0x001b0000000246ae-70.dat	family_kawaiiunicorn
behavioral1/files/0x001b0000000246af-76.dat	family_kawaiiunicorn
behavioral1/files/0x001b0000000246b0-82.dat	family_kawaiiunicorn
behavioral1/files/0x001b0000000246b1-89.dat	family_kawaiiunicorn
behavioral1/files/0x001b0000000246b2-95.dat	family_kawaiiunicorn
behavioral1/files/0x001b0000000246b3-100.dat	family_kawaiiunicorn
behavioral1/files/0x001b0000000246b4-106.dat	family_kawaiiunicorn
behavioral1/files/0x001b0000000246b5-112.dat	family_kawaiiunicorn
behavioral1/files/0x001b0000000246b6-118.dat	family_kawaiiunicorn
behavioral1/files/0x001b0000000246b7-124.dat	family_kawaiiunicorn
behavioral1/files/0x001b0000000246b8-130.dat	family_kawaiiunicorn
behavioral1/files/0x001b0000000246b9-136.dat	family_kawaiiunicorn
behavioral1/files/0x001b0000000246ba-142.dat	family_kawaiiunicorn
behavioral1/files/0x001b0000000246bb-148.dat	family_kawaiiunicorn
behavioral1/files/0x001b0000000246bc-154.dat	family_kawaiiunicorn
behavioral1/files/0x001b0000000246bd-160.dat	family_kawaiiunicorn
behavioral1/files/0x001b0000000246be-166.dat	family_kawaiiunicorn
behavioral1/files/0x001b0000000246bf-172.dat	family_kawaiiunicorn
behavioral1/files/0x001b0000000246c0-178.dat	family_kawaiiunicorn
behavioral1/files/0x001b0000000246c1-184.dat	family_kawaiiunicorn
behavioral1/files/0x001b0000000246c2-190.dat	family_kawaiiunicorn

Executes dropped EXE 46 IoCs

pid	Process
3468	Unicorn-25174.exe
6092	Unicorn-58998.exe
4000	Unicorn-14600.exe
876	Unicorn-13614.exe
1240	Unicorn-47439.exe
1644	Unicorn-51305.exe
2972	Unicorn-15472.exe
5676	Unicorn-10402.exe
1060	Unicorn-13500.exe
3176	Unicorn-44009.exe
3272	Unicorn-55275.exe
5080	Unicorn-11274.exe
5148	Unicorn-45099.exe
1748	Unicorn-10070.exe
1572	Unicorn-43895.exe
1084	Unicorn-8098.exe
992	Unicorn-33719.exe
3492	Unicorn-37585.exe
1708	Unicorn-32515.exe
2456	Unicorn-35613.exe
5584	Unicorn-34627.exe
6040	Unicorn-26205.exe
892	Unicorn-55945.exe
4376	Unicorn-14118.exe
2412	Unicorn-31415.exe
4508	Unicorn-61923.exe
2004	Unicorn-52733.exe
4996	Unicorn-21021.exe
5632	Unicorn-54845.exe
4088	Unicorn-23901.exe
840	Unicorn-37305.exe
4812	Unicorn-52619.exe
896	Unicorn-20907.exe
4896	Unicorn-3283.exe
1736	Unicorn-19703.exe
5596	Unicorn-45359.exe
4780	Unicorn-26055.exe
4608	Unicorn-55795.exe
3684	Unicorn-49355.exe
2200	Unicorn-13558.exe
2392	Unicorn-12572.exe
1312	Unicorn-62793.exe
804	Unicorn-55777.exe
2380	Unicorn-55559.exe
1880	Unicorn-54573.exe
5104	Unicorn-12554.exe

Program crash 46 IoCs

pid	pid_target	Process	procid_target
4296	4744	WerFault.exe	82
4360	3468	WerFault.exe	83
516	6092	WerFault.exe	87
1772	4000	WerFault.exe	90
5024	876	WerFault.exe	93
4820	1240	WerFault.exe	96
4876	1644	WerFault.exe	99
5100	2972	WerFault.exe	102
3988	5676	WerFault.exe	105
6104	1060	WerFault.exe	108
3672	3176	WerFault.exe	111
2372	3272	WerFault.exe	114
5168	5080	WerFault.exe	117
1116	5148	WerFault.exe	120
3956	1748	WerFault.exe	123
3004	1572	WerFault.exe	126
3856	1084	WerFault.exe	129
2000	992	WerFault.exe	132
4228	3492	WerFault.exe	135
5612	1708	WerFault.exe	138
6048	2456	WerFault.exe	141
3116	5584	WerFault.exe	144
696	6040	WerFault.exe	147
2136	892	WerFault.exe	150
4200	4376	WerFault.exe	153
3160	2412	WerFault.exe	156
5344	4508	WerFault.exe	159
5116	2004	WerFault.exe	162
2052	4996	WerFault.exe	165
4544	5632	WerFault.exe	168
5064	4088	WerFault.exe	171
1696	840	WerFault.exe	174
4528	4812	WerFault.exe	177
3800	896	WerFault.exe	180
2424	4896	WerFault.exe	183
1628	1736	WerFault.exe	186
6096	5596	WerFault.exe	189
1420	4780	WerFault.exe	192
2368	4608	WerFault.exe	195
5100	3684	WerFault.exe	198
5128	2200	WerFault.exe	201
5240	2392	WerFault.exe	204
1328	1312	WerFault.exe	207
5916	804	WerFault.exe	210
5792	2380	WerFault.exe	213
3408	1880	WerFault.exe	216

System Location Discovery: System Language Discovery 1 TTPs 47 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13558.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55559.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12554.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15472.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44009.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11274.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55945.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52733.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54845.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37305.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3283.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34627.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23901.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45359.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49355.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12572.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25174.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47439.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10070.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32515.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61923.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52619.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14600.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45099.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43895.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31415.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	12eca1c4fe4898ac8dbbed7b055ffa92a7cb7846e846ac5ab4e4896774525200.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37585.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20907.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55777.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13614.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51305.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13500.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8098.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33719.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62793.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58998.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55275.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26205.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26055.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54573.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10402.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35613.exe

Suspicious use of SetWindowsHookEx 47 IoCs

pid	Process
4744	12eca1c4fe4898ac8dbbed7b055ffa92a7cb7846e846ac5ab4e4896774525200.exe
3468	Unicorn-25174.exe
6092	Unicorn-58998.exe
4000	Unicorn-14600.exe
876	Unicorn-13614.exe
1240	Unicorn-47439.exe
1644	Unicorn-51305.exe
2972	Unicorn-15472.exe
5676	Unicorn-10402.exe
1060	Unicorn-13500.exe
3176	Unicorn-44009.exe
3272	Unicorn-55275.exe
5080	Unicorn-11274.exe
5148	Unicorn-45099.exe
1748	Unicorn-10070.exe
1572	Unicorn-43895.exe
1084	Unicorn-8098.exe
992	Unicorn-33719.exe
3492	Unicorn-37585.exe
1708	Unicorn-32515.exe
2456	Unicorn-35613.exe
5584	Unicorn-34627.exe
6040	Unicorn-26205.exe
892	Unicorn-55945.exe
4376	Unicorn-14118.exe
2412	Unicorn-31415.exe
4508	Unicorn-61923.exe
2004	Unicorn-52733.exe
4996	Unicorn-21021.exe
5632	Unicorn-54845.exe
4088	Unicorn-23901.exe
840	Unicorn-37305.exe
4812	Unicorn-52619.exe
896	Unicorn-20907.exe
4896	Unicorn-3283.exe
1736	Unicorn-19703.exe
5596	Unicorn-45359.exe
4780	Unicorn-26055.exe
4608	Unicorn-55795.exe
3684	Unicorn-49355.exe
2200	Unicorn-13558.exe
2392	Unicorn-12572.exe
1312	Unicorn-62793.exe
804	Unicorn-55777.exe
2380	Unicorn-55559.exe
1880	Unicorn-54573.exe
5104	Unicorn-12554.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 3468	4744	12eca1c4fe4898ac8dbbed7b055ffa92a7cb7846e846ac5ab4e4896774525200.exe	83
PID 3468 wrote to memory of 6092	3468	Unicorn-25174.exe	87
PID 6092 wrote to memory of 4000	6092	Unicorn-58998.exe	90
PID 4000 wrote to memory of 876	4000	Unicorn-14600.exe	93
PID 876 wrote to memory of 1240	876	Unicorn-13614.exe	96
PID 1240 wrote to memory of 1644	1240	Unicorn-47439.exe	99
PID 1644 wrote to memory of 2972	1644	Unicorn-51305.exe	102
PID 2972 wrote to memory of 5676	2972	Unicorn-15472.exe	105
PID 5676 wrote to memory of 1060	5676	Unicorn-10402.exe	108
PID 1060 wrote to memory of 3176	1060	Unicorn-13500.exe	111
PID 3176 wrote to memory of 3272	3176	Unicorn-44009.exe	114
PID 3272 wrote to memory of 5080	3272	Unicorn-55275.exe	117
PID 5080 wrote to memory of 5148	5080	Unicorn-11274.exe	120
PID 5148 wrote to memory of 1748	5148	Unicorn-45099.exe	123
PID 1748 wrote to memory of 1572	1748	Unicorn-10070.exe	126
PID 1572 wrote to memory of 1084	1572	Unicorn-43895.exe	129
PID 1084 wrote to memory of 992	1084	Unicorn-8098.exe	132
PID 992 wrote to memory of 3492	992	Unicorn-33719.exe	135
PID 3492 wrote to memory of 1708	3492	Unicorn-37585.exe	138
PID 1708 wrote to memory of 2456	1708	Unicorn-32515.exe	141
PID 2456 wrote to memory of 5584	2456	Unicorn-35613.exe	144
PID 5584 wrote to memory of 6040	5584	Unicorn-34627.exe	147
PID 6040 wrote to memory of 892	6040	Unicorn-26205.exe	150
PID 892 wrote to memory of 4376	892	Unicorn-55945.exe	153
PID 4376 wrote to memory of 2412	4376	Unicorn-14118.exe	156
PID 2412 wrote to memory of 4508	2412	Unicorn-31415.exe	159
PID 4508 wrote to memory of 2004	4508	Unicorn-61923.exe	162
PID 2004 wrote to memory of 4996	2004	Unicorn-52733.exe	165
PID 4996 wrote to memory of 5632	4996	Unicorn-21021.exe	168
PID 5632 wrote to memory of 4088	5632	Unicorn-54845.exe	171
PID 4088 wrote to memory of 840	4088	Unicorn-23901.exe	174
PID 840 wrote to memory of 4812	840	Unicorn-37305.exe	177
PID 4812 wrote to memory of 896	4812	Unicorn-52619.exe	180
PID 896 wrote to memory of 4896	896	Unicorn-20907.exe	183
PID 4896 wrote to memory of 1736	4896	Unicorn-3283.exe	186
PID 1736 wrote to memory of 5596	1736	Unicorn-19703.exe	189
PID 5596 wrote to memory of 4780	5596	Unicorn-45359.exe	192
PID 4780 wrote to memory of 4608	4780	Unicorn-26055.exe	195
PID 4608 wrote to memory of 3684	4608	Unicorn-55795.exe	198
PID 3684 wrote to memory of 2200	3684	Unicorn-49355.exe	201
PID 2200 wrote to memory of 2392	2200	Unicorn-13558.exe	204
PID 2392 wrote to memory of 1312	2392	Unicorn-12572.exe	207
PID 1312 wrote to memory of 804	1312	Unicorn-62793.exe	210
PID 804 wrote to memory of 2380	804	Unicorn-55777.exe	213
PID 2380 wrote to memory of 1880	2380	Unicorn-55559.exe	216
PID 1880 wrote to memory of 5104	1880	Unicorn-54573.exe	219

C:\Users\Admin\AppData\Local\Temp\12eca1c4fe4898ac8dbbed7b055ffa92a7cb7846e846ac5ab4e4896774525200.exe
"C:\Users\Admin\AppData\Local\Temp\12eca1c4fe4898ac8dbbed7b055ffa92a7cb7846e846ac5ab4e4896774525200.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25174.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25174.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58998.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58998.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:6092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14600.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13614.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47439.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51305.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15472.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10402.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13500.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44009.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55275.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11274.exe
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45099.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10070.exe
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43895.exe
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8098.exe
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33719.exe
        18⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37585.exe
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32515.exe
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35613.exe
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34627.exe
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26205.exe
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55945.exe
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14118.exe
        25⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31415.exe
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61923.exe
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52733.exe
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21021.exe
        29⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23901.exe
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37305.exe
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52619.exe
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20907.exe
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3283.exe
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19703.exe
        36⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45359.exe
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26055.exe
        38⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55795.exe
        39⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49355.exe
        40⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13558.exe
        41⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12572.exe
        42⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62793.exe
        43⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55777.exe
        44⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55559.exe
        45⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54573.exe
        46⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12554.exe
        47⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5104
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 724
        47⤵
        Program crash
        
        PID:3408
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 752
        46⤵
        Program crash
        
        PID:5792
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 740
        45⤵
        Program crash
        
        PID:5916
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1312 -s 724
        44⤵
        Program crash
        
        PID:1328
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 724
        43⤵
        Program crash
        
        PID:5240
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 752
        42⤵
        Program crash
        
        PID:5128
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3684 -s 724
        41⤵
        Program crash
        
        PID:5100
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 724
        40⤵
        Program crash
        
        PID:2368
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 744
        39⤵
        Program crash
        
        PID:1420
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5596 -s 724
        38⤵
        Program crash
        
        PID:6096
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 744
        37⤵
        Program crash
        
        PID:1628
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 716
        36⤵
        Program crash
        
        PID:2424
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 896 -s 752
        35⤵
        Program crash
        
        PID:3800
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 744
        34⤵
        Program crash
        
        PID:4528
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 752
        33⤵
        Program crash
        
        PID:1696
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 724
        32⤵
        Program crash
        
        PID:5064
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5632 -s 752
        31⤵
        Program crash
        
        PID:4544
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 724
        30⤵
        Program crash
        
        PID:2052
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 752
        29⤵
        Program crash
        
        PID:5116
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 752
        28⤵
        Program crash
        
        PID:5344
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 716
        27⤵
        Program crash
        
        PID:3160
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 752
        26⤵
        Program crash
        
        PID:4200
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 892 -s 724
        25⤵
        Program crash
        
        PID:2136
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6040 -s 724
        24⤵
        Program crash
        
        PID:696
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5584 -s 752
        23⤵
        Program crash
        
        PID:3116
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 752
        22⤵
        Program crash
        
        PID:6048
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 724
        21⤵
        Program crash
        
        PID:5612
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 744
        20⤵
        Program crash
        
        PID:4228
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 744
        19⤵
        Program crash
        
        PID:2000
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1084 -s 740
        18⤵
        Program crash
        
        PID:3856
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 744
        17⤵
        Program crash
        
        PID:3004
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 724
        16⤵
        Program crash
        
        PID:3956
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5148 -s 744
        15⤵
        Program crash
        
        PID:1116
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 724
        14⤵
        Program crash
        
        PID:5168
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 724
        13⤵
        Program crash
        
        PID:2372
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3176 -s 740
        12⤵
        Program crash
        
        PID:3672
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 752
        11⤵
        Program crash
        
        PID:6104
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5676 -s 740
        10⤵
        Program crash
        
        PID:3988
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 724
        9⤵
        Program crash
        
        PID:5100
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 744
        8⤵
        Program crash
        
        PID:4876
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 724
        7⤵
        Program crash
        
        PID:4820
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 876 -s 744
        6⤵
        Program crash
        
        PID:5024
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 752
        5⤵
        Program crash
        
        PID:1772
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6092 -s 752
      4⤵
      Program crash
      PID:516
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3468 -s 744
    3⤵
    - Program crash
    PID:4360
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 716
  2⤵
  - Program crash
  PID:4296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4744 -ip 4744
1⤵
PID:5424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3468 -ip 3468
1⤵
PID:5696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 6092 -ip 6092
1⤵
PID:5936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4000 -ip 4000
1⤵
PID:4176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 876 -ip 876
1⤵
PID:2964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1240 -ip 1240
1⤵
PID:1968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1644 -ip 1644
1⤵
PID:5412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2972 -ip 2972
1⤵
PID:1016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5676 -ip 5676
1⤵
PID:1864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1060 -ip 1060
1⤵
PID:1752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3176 -ip 3176
1⤵
PID:5756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3272 -ip 3272
1⤵
PID:5984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5080 -ip 5080
1⤵
PID:2060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5148 -ip 5148
1⤵
PID:2232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1748 -ip 1748
1⤵
PID:3532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1572 -ip 1572
1⤵
PID:5220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1084 -ip 1084
1⤵
PID:3456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 992 -ip 992
1⤵
PID:3200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3492 -ip 3492
1⤵
PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1708 -ip 1708
1⤵
PID:5348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2456 -ip 2456
1⤵
PID:1464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5584 -ip 5584
1⤵
PID:3344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 6040 -ip 6040
1⤵
PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 892 -ip 892
1⤵
PID:4420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4376 -ip 4376
1⤵
PID:936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2412 -ip 2412
1⤵
PID:1804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4508 -ip 4508
1⤵
PID:5012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2004 -ip 2004
1⤵
PID:4980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4996 -ip 4996
1⤵
PID:4308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5632 -ip 5632
1⤵
PID:4576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4088 -ip 4088
1⤵
PID:4628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 840 -ip 840
1⤵
PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4812 -ip 4812
1⤵
PID:1092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 896 -ip 896
1⤵
PID:4756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4896 -ip 4896
1⤵
PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1736 -ip 1736
1⤵
PID:5144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5596 -ip 5596
1⤵
PID:5184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4780 -ip 4780
1⤵
PID:2776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4608 -ip 4608
1⤵
PID:3764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3684 -ip 3684
1⤵
PID:1796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2200 -ip 2200
1⤵
PID:4808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2392 -ip 2392
1⤵
PID:2932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1312 -ip 1312
1⤵
PID:560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 804 -ip 804
1⤵
PID:1132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2380 -ip 2380
1⤵
PID:3348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1880 -ip 1880
1⤵
PID:2320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-10070.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-10070.exe
Size 468KB
SHA256 758898f0fbe207184ac1c81e1c6fe95705b00d6f1797375269a2cb3ea6953c4b
MD5 461df6bc4c4034bd66ed3176d345b184
SHA1 a2c1adb2be79692b3feb85f37d74d74cadf45196
SHA512 75839a8ffa891d86ce170cfa89355e7313e5c052d131f45ffa7c2cedb4a0ffb858dc2e2f228c06a60f22796c4e13f4d09c4bb4f735f1266fca6feb551f76642b
SSDEEP 3072:GEGloTEkL/3YCPhkrzgYK1T/MEri7jfSnvDF9c8JqfBdnnEJoShr:GEwojvYCmr8YK12rahJqvnEJo
TLSH
T1FFA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-10402.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-10402.exe
Size 468KB
SHA256 e9870960acfba8eb220bac0451a66be65c8a3197d94f7a514464fb5187138238
MD5 4182615f10f61f8a58aa2827027e7f35
SHA1 01aeb8fb8a399a75ac38b164972a657ae40770eb
SHA512 70891a34a66b94d1e1b53d52b428e2299109fbec8d5e2ed7348ef4546f0922db8c2509537426ceb7a4be0ff3e31f97a94b73f3afedb8012423ce2a05dd922fcc
SSDEEP 3072:GEGloTYk1/3YCPYkrzgYK1T/MEri7jfSnvDF9c8JqfBdonbJoShr:GEwo5vYCvr8YK12rahJqvCbJo
TLSH
T114A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-11274.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-11274.exe
Size 468KB
SHA256 ddfe4c871b432acda78c4ecd8cbdf0e41ffa011d2518cf3b0b7e1e005a7522dc
MD5 c955445e00aab2db623ea4d9866a8a1e
SHA1 99b90982bb4e55bd366402ca6f5acc42f62b5e16
SHA512 a56f8152b81b5655461fec6a360c831f5d3d233d44541883570907a644ba502195246fb1af409a993ed6d0d4c39328856d57df61e5d41a537735a580426f511f
SSDEEP 3072:GEGloTYkL/3YCPhkrzgYK1T/MEri7jfSnvDF9c8JqfBd+nEJoShr:GEwo/vYCmr8YK12rahJqvUEJo
TLSH
T16BA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-13500.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-13500.exe
Size 468KB
SHA256 1b3b7fd790e21794b14da47d36d88455db0ce577e16ba2a5aaaa11a1ecf9c884
MD5 c7be9d624069c603f386d3cc9a47571d
SHA1 03457f09d0d6b5e6e5b7bc55f75b2707988aa152
SHA512 6ceddcb16dd97f2ee088d25dbb67b379bb03a152c3bb129b151d83296aa27bfca964949b5f1ba03f752aa874227b449aa3917ecb679365c167c4f726b6c0f423
SSDEEP 3072:GEGloTYk1/3YCPhkrzgYK1T/MEri7jfSnvDF9c8JqfBdonbJoShr:GEwo5vYCmr8YK12rahJqvCbJo
TLSH
T188A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-13614.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-13614.exe
Size 468KB
SHA256 cac12d1d94cd4c52072ecfcc210bfd5d9630742fdedcce05a33442bb23a2e1a7
MD5 7b712bdf310d56cedc51a70dc28f0cba
SHA1 c290a05e9fe29145c10a7819d843615bb1b15dcf
SHA512 b409ac04bc1c8bcc6916db0aaa169caad8e84c873dd6220e34475b4f93338005ea3f03927be40898fe76e9f3ed3dfedc193562fc0d21252d4a9f1e3c98162479
SSDEEP 3072:GEGloTHk1/3YCPYk9zgYK1T/MEri7jfSnvDF9c8JqfBdRnQJoShr:GEwoyvYCv98YK12rahJqv1QJo
TLSH
T170A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-14118.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-14118.exe
Size 468KB
SHA256 26ca5671c5a6eeb559d1e50dfd55e2e6e5dc0e78609718e86be0f501a6a5a9e3
MD5 49d563f74612e052460df5800ae77fcc
SHA1 b4f82af3a5d895567413c084754fe62e0cc4fcd4
SHA512 883b67a5c240572dd756af3bfca807ed0810f22d7e84308c7f79c2298b1854465dfa706a4aec7631c41ce7489c90c2b0ccaf26c04d5f9ce463668058218a2d18
SSDEEP 3072:GEIloTEkL/3YCPh2rzgYK1T/MEri7jfSnvDN9coSsfBdWnEZoShr:GE2ojvYCUr8YK12ra9SsvcEZo
TLSH
T1EFA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-14600.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-14600.exe
Size 468KB
SHA256 896b0e098cbc590815789a03124ee03551f0dfb2622afe3b311e8bebbd24b926
MD5 5e4aa4751c78e10d18e4af69115038f5
SHA1 5c2f48e6a9c347d6488ed27c24c1b18b38879d08
SHA512 10316c1d6943ccb9da08d55281a0e139e0718535507d095e83e3775d5f14378ba81b3f25686cc46af55e8c62c88705933ef08a51b93b0a149ddc0ae3f2f40a52
SSDEEP 3072:GEGloTHk1/3YCPYk9zgYK1T/MEri7jfSnvDF9c8JqfBdRnQJoShr:GEwoyvYCv98YK12rahJqv1QJo
TLSH
T123A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-15472.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-15472.exe
Size 468KB
SHA256 af74ffc2253c24a8d9b77be062e4a02dbe89676ebb4c24a5ec76fe042076b61b
MD5 8732b13d7e0e4de09dff5300fe5765ba
SHA1 d9043c28bd286c38153295de7b92e87b4539d0a0
SHA512 1c5752ed03532efb63866b2d08c533042a51df4530d83d42c50e0355c6e3fb9604dc41edaefd60c151df1cd8830f79a2592c3defbeddc97957fa844fe72c2624
SSDEEP 3072:GEGloTHk1/3YCPYkrzgYK1T/MEri7jfSnvDF9c8JqfBdonbJoShr:GEwoyvYCvr8YK12rahJqvCbJo
TLSH
T150A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-21021.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-21021.exe
Size 468KB
SHA256 06ea8eb92be7b9ba344d7c84396d7f0acae742136c4913e6f1f35d09320d502c
MD5 15d006a64bab4b8d15245305658e8aa0
SHA1 09d8ab29e3dca90504dfa2d5adf96d584a8af35f
SHA512 97251db609de45d5204b5bd503919f6f2334ccc8ed07316fc9afa1e7c34519db22d64593e843714af69a089354e53e82984cd2d1717524f966e12aa5aefc4de6
SSDEEP 3072:GEIloTEkL/3YCPh2rzgYK1T/MErV7jfSnvDN9cjSsfBdWn+Zojhr:GE2ojvYCUr8YK1Nra2Ssvc+Zo
TLSH
T1B8A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-23901.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-23901.exe
Size 468KB
SHA256 58db21e6246d5bda35ca7cb933c8fbb1c3ab580562cfaf90d2c3cd81283dbd40
MD5 f65dcca052e38d53b531e79c2159c365
SHA1 be8c90ba6695b8994313216a08b9df0ccf1d653e
SHA512 f4f06ef1c2c70f5eae60af3277f9726e3a5c582f31b391c975483d24e29a7283f714fc84ce98a172e41ab1039d2c296f7931cc3f7e213a53244db08a2fc9a9cc
SSDEEP 3072:GEIloTEkL/3YCPh2rzgYK1T/MErV7jf6nvDN9cjSsfBdWn2Zojhr:GE2ojvYCUr8YK1NrC2Ssvc2Zo
TLSH
T1A0A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-25174.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-25174.exe
Size 468KB
SHA256 07bb56e9ad964cd00ab834235b8d79c506e56139119166922ec718068f653eab
MD5 271e927627fb6933b6674bb966bc021c
SHA1 2a80d0d186cfc1ab7d02a229a0859e6334b9b292
SHA512 4ee8b192aa51ec9d3a0fb6100bad8ec514063a901de991dc8689dc9c04d0f9e472face42b2c277ab9065535e59712af324077c369bee972eed171793ba7f9015
SSDEEP 3072:GEGloTHk1/3YCPYS9zgYK1T/MEri7jfSnvDF9c8JqfBdRnQJ/Shr:GEwoyvYCh98YK12rahJqv1QJ/
TLSH
T1B0A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-26205.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-26205.exe
Size 468KB
SHA256 38a7ad0e450b4e5a92785029582d0e71ae127a05caf6823636cdad5122094bc2
MD5 38defd0be9ddb990063a9cb733fb0d41
SHA1 16a51b79ae22f9a440575aa01c15d82671836de3
SHA512 a05ea0d28354a1f097a0523aabb6248c9ddbca1db7331a606afa1d9d30fdb242a71be22da02f8f7f8017bb42a1def3ef968283cc64744b5a2408d9b3b15defc6
SSDEEP 3072:GEIloTEkL/3YCPhkrzgYK1T/MEri7jfSnvDN9coSsfBdWnEJoShr:GE2ojvYCmr8YK12ra9SsvcEJo
TLSH
T1ACA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-31415.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-31415.exe
Size 468KB
SHA256 3cce97744657c9d99ce6f2ce128735b085aaaf25d74c07b5f54431132cddc04a
MD5 d76152c52735bac9ce423c5d4fcf9e55
SHA1 1c09f162db3e6319800a16c358bb0d2d212fdcd1
SHA512 ceac95c270857332181f2782b9887611a2082f71e9a7c5656f0876382d6067c274fbf737b09c50140bb8ce0d360a949c2c2fdceec609af814fb77c88de6c7b23
SSDEEP 3072:GEIloTEkL/3YCPh2rzgYK1T/MEri7jfSnvDN9cjSsfBdWnEZoShr:GE2ojvYCUr8YK12ra2SsvcEZo
TLSH
T123A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-32515.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-32515.exe
Size 468KB
SHA256 a48b2f361eec7848950065c53e5f9ce9ff117d1230ef373ca96923d9be3159ee
MD5 e71e06b83f4f7265d9fd62c832ecebba
SHA1 1663a2c78cc8010ca17a9380fbf1a8943181981f
SHA512 1a320ad39fb3fbe9f4070559a5ddc131558485bed718732582de5d2182611cf83949d6d6e12abea9b3d7cb7f96b0377644f3030e1e79647b05b0b8290779119d
SSDEEP 3072:GEIloTEkL/3YCPhkrzgYK1T/MEri7jfSnvDF9coHsfBdWnEJoShr:GE2ojvYCmr8YK12raVHsvcEJo
TLSH
T12EA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-33719.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-33719.exe
Size 468KB
SHA256 96c0f3d035a4e9b616c9642b56903aa990fad9ec7c8cc6df3a9143b815a47739
MD5 9208a7b660e97c153a1993023676175f
SHA1 58b4be2ec8e5687ba2753b37210b3ec0d1169630
SHA512 8a9873923af3d62871286b5df6309569aa84fa778b8dd6daa0b12a9ea47c32a9ea605999d935591ee6e0bec99804bf9ef7dbba8d9ec195d8c02867b21c0f582b
SSDEEP 3072:GEIloTEkL/3YCPhkrzgYK1T/MEri7jfSnvDF9c8HqfBdWnEJoShr:GE2ojvYCmr8YK12rahHqvcEJo
TLSH
T1E8A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-34627.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-34627.exe
Size 468KB
SHA256 767cd6e46e5589894080b0eeffb6b4737477cb65c31209950f787c94e55af3ac
MD5 56950dec72e9d401f75669b1379e9517
SHA1 f8d215f751e3cb589c95cc31fe9318a34c5ec9f5
SHA512 f603b2f161e17f0f56369b100f4a3a7e618845a9ce82edd75b8dce8878cf75fa8cdc18913f6eacc45a0f4ac4bc19fd3e24aca35813147c448a9601de51ec3ba0
SSDEEP 3072:GEIloTEkL/3YCPhkrzgYK1T/MEri7jfSnvDF9coSsfBdWnEJoShr:GE2ojvYCmr8YK12raVSsvcEJo
TLSH
T117A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-35613.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-35613.exe
Size 468KB
SHA256 8c12df0faddac398a45e781d17664ff6a9cc61442ea94f5a280839be529927f1
MD5 dba4c0b10be69cdb52e7800bb9707645
SHA1 c30edf7733c3ecab6d5ce1629677530c87c49579
SHA512 96f26f675f2d64af4c9fa3eef0a33f7f00fc97bd5af91909722760bf86f433a8482712a37660e156b7bafa2dd440268b3a21c9f431f2c3f270d39fbde243b352
SSDEEP 3072:GEIloTEkL/3YCPhkrzgYK1T/MEri7jfSnvDF9copsfBdWnEJoShr:GE2ojvYCmr8YK12raVpsvcEJo
TLSH
T192A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-37305.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-37305.exe
Size 468KB
SHA256 aa125eff2eb1cd6607a90787551ba64bae36a381d6d7c0cc998033f37f19173f
MD5 bd444b834543197280fffd935f68a14a
SHA1 c6b986a6219c497924856c976220186e7a94632c
SHA512 8419c12ee0624f8708a63a4a5ac1cfca2f66c7d729038b8aef89fdc59bf896b988804e9e92815401924f685087cf07a908899b025def5247f09c2c863b925e83
SSDEEP 3072:GEIloTEkL/3YCPh2rzgYK1T/MErV7jf6nvDN9cjSGfBdWn2Zojhr:GE2ojvYCUr8YK1NrC2SGvc2Zo
TLSH
T1CAA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-37585.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-37585.exe
Size 468KB
SHA256 e8fd0d9995112668f02915255f4169d5976192e13b36e207e874d3e47ed920ae
MD5 9de603e02f50bd28106c402129aa1ae1
SHA1 4c615b9f002c6ee59fb738cd26d907e0fefc0213
SHA512 a0b096329029aa4bebf067e42f4a3a6f3d4dfb5c064378a92baeb766be8e6b435559d58d31bc3d403f43922c58dd395040674fc93d71e98b615381d1dcc02f13
SSDEEP 3072:GEIloTEkL/3YCPhkrzgYK1T/MEri7jfSnvDF9c8HsfBdWnEJoShr:GE2ojvYCmr8YK12rahHsvcEJo
TLSH
T13EA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-43895.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-43895.exe
Size 468KB
SHA256 dea195534579bb77e04f50697e244b0914b43b026d04c4d76452158fb19f9ba4
MD5 73aa0058a9a06761909a84b6c7c1a3ab
SHA1 908a9f27ba6c0e6460215aa79d19ba407603421d
SHA512 de7bbd0c212c91026df2dd461f163d8664863bccc80c4f2f455c70b7b6c89e1f3c4df26e22e8ad589b0c473959727316f62640346f17c0599ff452965e13cc68
SSDEEP 3072:GEGloTEkL/3YCPhkrzgYK1T/MEri7jfSnvDF9c8JqfBdWnEJoShr:GEwojvYCmr8YK12rahJqvcEJo
TLSH
T15EA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-44009.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-44009.exe
Size 468KB
SHA256 4e0e5ff8e3ad5b9ada689b897b717f797e5b0bf889f90836ba17b6c343af886d
MD5 e22a1d6044a86b7322402a3370e28876
SHA1 159afb1533832ef30530078b381451d2041dc513
SHA512 28d2a79d180f74d7a0bb44c27b47a887d307fa58135d5ee9e0e262ee1b0dc6459be1e897941d5f3e8867f0b88887c610f06b72bacda98e83baa90c1098cce69e
SSDEEP 3072:GEGloTYk1/3YCPhkrzgYK1T/MEri7jfSnvDF9c8JqfBd+nbJoShr:GEwo5vYCmr8YK12rahJqvUbJo
TLSH
T1E7A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-45099.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-45099.exe
Size 468KB
SHA256 4a462af5abbd3880d16d79414ed141b4a6eb2a96c46d3f4b5583d6dfabe4a23b
MD5 5f763a0b782fb17eb96aa95855292f63
SHA1 6e3cbd1395e1fff1226a329a4c12b31ad7851aab
SHA512 67a7feaa49ce1b4bbe89e71eb8ad4092ca6997032a4d1d63f610b13ef015f10634a544593df4b6317908fdc4df6572c9b842f0a735290446556bda77b4bbc8ab
SSDEEP 3072:GEGloTYkL/3YCPhkrzgYK1T/MEri7jfSnvDF9c8JqfBdnnEJoShr:GEwo/vYCmr8YK12rahJqvnEJo
TLSH
T15CA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-47439.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-47439.exe
Size 468KB
SHA256 eb6eb3e55a9ac0bccf4f22c14d50bc2a712c6e26c384439a08411e20fec9b30f
MD5 b110dd78df60be041be023085686ec17
SHA1 e75e038ecef67bd60ee6733c431893a42df5bea8
SHA512 e000c15280c45864d726ebdd240d64daa71aff114feea5bd838be2df4d472857898aaec919bd8e4d96700df592442ce4f0e13d384c6729363f8ae7225ac8dafa
SSDEEP 3072:GEGloTHk1/3YCPYk9zgYK1T/MEri7jfSnvDF9c8JqfBdonQJoShr:GEwoyvYCv98YK12rahJqvCQJo
TLSH
T1A5A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-51305.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-51305.exe
Size 468KB
SHA256 1841790e8dd20f1e0375510ae6c12fd78aad5b24e6054482e5c63b5e69f0635c
MD5 9afd86156113c439100b4300652e83b9
SHA1 0434f2b82d7b815ddc41164ecfa5daf34ac79197
SHA512 143b57112438b8546374da1742179d798dffc0cd082a3f31a4949028794f23937d0e7d857b2d9c5c2e9622eeba4969e3c0b8618b3f196cd59a85818041fbac80
SSDEEP 3072:GEGloTHk1/3YCPYk9zgYK1T/MEri7jfSnvDF9c8JqfBdonbJoShr:GEwoyvYCv98YK12rahJqvCbJo
TLSH
T1BEA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-52619.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-52619.exe
Size 468KB
SHA256 3332955fd300a0277cf0662926b26fa009a2abc9881269f868e083ff5c68be54
MD5 7dd5f2dd38e03cdfd38afd1dde3faf0f
SHA1 57b8b8078822e2b37ce7d5779b50cd58385df680
SHA512 5e03ec87f6bf3e3d65e413afe9103f4ad2b9ebfc03396030b33243da505789f9eeb5cbcc88082214049acd7703875a6f9889524d121a4da17e4aa9ecac7e796d
SSDEEP 3072:GEIloTEkL/3YCPh2rzgYK1T/MErV7jf6nvDN9cjSGfBdWnxZojhr:GE2ojvYCUr8YK1NrC2SGvcxZo
TLSH
T1E6A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-52733.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-52733.exe
Size 468KB
SHA256 11bfdd82253e6bb73c7a92287b38425439119329f8c43eee46af6e6123693720
MD5 f1788f2f03fe56d529fbdca65c8a26e2
SHA1 02cbbe27b6b6e777e80eb286b38a13ab1e5c773a
SHA512 1e73cd28803221f05d4d1f1334ad0a7f2840b1c0ad1b965a212a295bab3be7e45f4b782dca2b0883e7db7299e146a04acc0365fd55f9395a21303d13ff9946bb
SSDEEP 3072:GEIloTEkL/3YCPh2rzgYK1T/MEri7jfSnvDN9cjSsfBdWn+Zojhr:GE2ojvYCUr8YK12ra2Ssvc+Zo
TLSH
T1DBA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-54845.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
Size 468KB
SHA256 6a71b486b6d1f0320f1489fee5e7602fae6406f6dff4faa3d28baa39c3f350ad
MD5 1c234bdb3f5ec4b54cd152fb941d43f3
SHA1 1152808469de2312b5f0567045248cca6bec8726
SHA512 a8f748d1717a9dc1d8bb827efa1bf931317736ef3e1fc7f92d9d7a5777623066487f5eecd19a87a4b6bb97dd0dae31e7b595810e10e1108008f0602db88799e7
SSDEEP 3072:GEIloTEkL/3YCPh2rzgYK1T/MErV7jfSnvDN9cjSsfBdWn2Zojhr:GE2ojvYCUr8YK1Nra2Ssvc2Zo
TLSH
T17FA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-55275.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-55275.exe
Size 468KB
SHA256 17e9110e85eb8d11161c2e1e92ede370415d2391776bd696432c9f0bb8b1137f
MD5 520b5c78f400f4c86e33ce30cb7e48df
SHA1 cdbe6ccb08be7998d0fdc60025c3379f5a98503b
SHA512 1c5583b5f19085732d5d7e23dbf57d10a4b0d936b9ea54e42b6e15947d1d62627dbacf9752b5631a78b7ea8f67b514f8499a14acf6a1d57d8eb905c39ca79d8c
SSDEEP 3072:GEGloTYk1/3YCPhkrzgYK1T/MEri7jfSnvDF9c8JqfBd+nEJoShr:GEwo5vYCmr8YK12rahJqvUEJo
TLSH
T18EA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-55945.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-55945.exe
Size 468KB
SHA256 f35bc1437f9405edf4ff12d8309d84b6a093c9fe124443f9f40c6231c4531910
MD5 98fce01d48a6357a3f905c3ff81d97c2
SHA1 443ce95e28c8fc064dc4689d5a5934bcddb84801
SHA512 66e510d0c75ae04f6d84675cbe0145eb533e98a185d11feaa3d31ccccc220535cc1b7861e90468aae23689d822fcd859b3c078860f8718459288657198cb8b2e
SSDEEP 3072:GEIloTEkL/3YCPhkrzgYK1T/MEri7jfSnvDN9coSsfBdWnEZoShr:GE2ojvYCmr8YK12ra9SsvcEZo
TLSH
T157A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-58998.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-58998.exe
Size 468KB
SHA256 8598cb0bb8925da2263de09aa81eb1d7474af19fb64e2ad4363087ef8318cbe6
MD5 21d85515a49be3a6a7d2de63a9b8555e
SHA1 c7409418359f0618f1ca5d65d61f83760d72f0f5
SHA512 c5d3e152bb87566bd30354e6093f03aaf9a3be48d78a71acfeb3d50712f2001fc5de9cdb6d37bdb42b9ea575c473faa25e64a29cae3e732a714274853afd0fed
SSDEEP 3072:GEGloTHk1/3YCPYS9zgYK1T/MEri7jfSnvDF9c8JqfBdRnQJoShr:GEwoyvYCh98YK12rahJqv1QJo
TLSH
T1A4A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-61923.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-61923.exe
Size 468KB
SHA256 ddafbf9b9ab1f5e8169a82cf38e192f3171a01342e6e8205c160c1d6c581acd8
MD5 6319bd0d229846245189d8a64b35d2e7
SHA1 10dfd8562a68413c4ffeba262048fae26bec9a12
SHA512 d4077b6ac236dc1e6ec757f8bc6d9545e88c371244132d3c064f7b23a9ce5f55b3b726aa1878e53cd289ce9395372e0e16479b5958f5679877bc341032bb30cc
SSDEEP 3072:GEIloTEkL/3YCPh2rzgYK1T/MEri7jfSnvDN9cjSsfBdWnEZojhr:GE2ojvYCUr8YK12ra2SsvcEZo
TLSH
T115A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-8098.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-8098.exe
Size 468KB
SHA256 27dc372a525c59898c8bffda710390ed76fa06cd7124f07021c863361feca54d
MD5 e6c686ff6ffc88e9bc1d3f7b7ebb9175
SHA1 0e8872bc2c09a210ff0c6624d7186ee150ac356b
SHA512 db9924f32599c55b56697a9ba96f5cc38d8280e16e1bf90c89beb692cd8701c2de1721c70cbf7b0bd527752c4640ebd8c84ffa14184bdb41035caf7f4e0cf1e5
SSDEEP 3072:GEIloTEkL/3YCPhkrzgYK1T/MEri7jfSnvDF9c8JqfBdWnEJoShr:GE2ojvYCmr8YK12rahJqvcEJo
TLSH
T192A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads