kawaiiunicorn | bc536e042d11a9a35e4cc4aec5bada9d1abe82f7607f8dc0394dd4c978222404

Analysis

max time kernel
30s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_1f9b638a94706380b88c1930f6900458_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Size 20.5MB
Sample260703-e4lmmabv2z
SHA256 bc536e042d11a9a35e4cc4aec5bada9d1abe82f7607f8dc0394dd4c978222404
MD5 1f9b638a94706380b88c1930f6900458
SHA1 b8d5d7a06a914edb290377d87e5a9882885d7c81
SHA512 314d2a00c826f41ff80235d099427e24cbb8124a8c1796d67a91ebceffdd87cd58c14df8e60639e03c9091c3897237e38de49d0cfaf16f93f45202977ad9afa1
SSDEEP 393216:/+S+JEKUxqnv9bntd98v4Mn/R1Ft+1EOThs26Jk2NyEsv:m9tUxgvxj9ZM/Lb+1FH6Jk2ct
TLSH
T1C327D0B28D705691FE3A4C35CEA1AA6489357C291F60CBCF2905B18F67736F7603D289
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery kawaiiunicorn trojan

Malware Config

Signatures

Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
trojan kawaiiunicorn

Detects KawaiiUnicorn 32 IoCs

resource	yara_rule
behavioral2/memory/2652-0-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1756-137-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3900-254-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5896-252-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5228-253-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2972-416-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1244-415-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3660-454-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5316-453-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3612-452-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4696-414-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5052-555-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2112-647-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5248-646-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4992-641-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5396-657-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5884-850-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6372-849-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5620-846-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2700-820-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5800-819-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4400-821-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3408-817-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2096-818-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3480-816-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2696-815-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1748-814-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1976-813-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2864-812-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1504-782-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3340-811-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2004-781-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 29 IoCs

resource	yara_rule
behavioral2/files/0x0008000000016d03-6.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000500000001b84b-11.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000700000001b9e3-16.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x001800000001c330-33.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000e00000001c477-38.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x001200000001c476-40.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000e00000001c483-48.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c485-70.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c484-59.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c486-82.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c488-87.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c487-83.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c48e-109.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c490-118.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c48c-115.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c48d-122.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c48b-132.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c491-139.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c48f-130.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c49f-168.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c49a-160.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c493-176.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c492-192.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c499-202.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c49c-215.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c49e-226.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c498-230.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c497-235.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c495-221.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

UPX dump on OEP (original entry point) 29 IoCs

resource	yara_rule
behavioral2/files/0x0008000000016d03-6.dat	UPX
behavioral2/files/0x000500000001b84b-11.dat	UPX
behavioral2/files/0x000700000001b9e3-16.dat	UPX
behavioral2/files/0x001800000001c330-33.dat	UPX
behavioral2/files/0x000e00000001c477-38.dat	UPX
behavioral2/files/0x001200000001c476-40.dat	UPX
behavioral2/files/0x000e00000001c483-48.dat	UPX
behavioral2/files/0x000d00000001c485-70.dat	UPX
behavioral2/files/0x000d00000001c484-59.dat	UPX
behavioral2/files/0x000d00000001c486-82.dat	UPX
behavioral2/files/0x000d00000001c488-87.dat	UPX
behavioral2/files/0x000d00000001c487-83.dat	UPX
behavioral2/files/0x000d00000001c48e-109.dat	UPX
behavioral2/files/0x000d00000001c490-118.dat	UPX
behavioral2/files/0x000d00000001c48c-115.dat	UPX
behavioral2/files/0x000d00000001c48d-122.dat	UPX
behavioral2/files/0x000d00000001c48b-132.dat	UPX
behavioral2/files/0x000d00000001c491-139.dat	UPX
behavioral2/files/0x000d00000001c48f-130.dat	UPX
behavioral2/files/0x000d00000001c49f-168.dat	UPX
behavioral2/files/0x000d00000001c49a-160.dat	UPX
behavioral2/files/0x000d00000001c493-176.dat	UPX
behavioral2/files/0x000d00000001c492-192.dat	UPX
behavioral2/files/0x000d00000001c499-202.dat	UPX
behavioral2/files/0x000d00000001c49c-215.dat	UPX
behavioral2/files/0x000d00000001c49e-226.dat	UPX
behavioral2/files/0x000d00000001c498-230.dat	UPX
behavioral2/files/0x000d00000001c497-235.dat	UPX
behavioral2/files/0x000d00000001c495-221.dat	UPX

Executes dropped EXE 11 IoCs

pid	Process
6008	Unicorn-22684.exe
1652	Unicorn-31925.exe
4472	Unicorn-2782.exe
708	Unicorn-34978.exe
2428	Unicorn-42823.exe
1636	Unicorn-16595.exe
1400	Unicorn-45284.exe
4276	Unicorn-60253.exe
5676	Unicorn-33611.exe
4932	Unicorn-8592.exe
768	Unicorn-19832.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31925.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2782.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60253.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33611.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22684.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34978.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16595.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42823.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45284.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-03_1f9b638a94706380b88c1930f6900458_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2652	2026-07-03_1f9b638a94706380b88c1930f6900458_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
6008	Unicorn-22684.exe
4472	Unicorn-2782.exe
1652	Unicorn-31925.exe
708	Unicorn-34978.exe
1636	Unicorn-16595.exe
2428	Unicorn-42823.exe
1400	Unicorn-45284.exe
4276	Unicorn-60253.exe
5676	Unicorn-33611.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 6008	2652	2026-07-03_1f9b638a94706380b88c1930f6900458_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe	88
PID 6008 wrote to memory of 4472	6008	Unicorn-22684.exe	89
PID 2652 wrote to memory of 1652	2652	2026-07-03_1f9b638a94706380b88c1930f6900458_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe	90
PID 1652 wrote to memory of 708	1652	Unicorn-31925.exe	91
PID 6008 wrote to memory of 2428	6008	Unicorn-22684.exe	92
PID 2652 wrote to memory of 1636	2652	2026-07-03_1f9b638a94706380b88c1930f6900458_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe	93
PID 4472 wrote to memory of 1400	4472	Unicorn-2782.exe	94
PID 708 wrote to memory of 4276	708	Unicorn-34978.exe	95
PID 1400 wrote to memory of 5676	1400	Unicorn-45284.exe	96
PID 4472 wrote to memory of 4932	4472	Unicorn-2782.exe	97
PID 2652 wrote to memory of 768	2652	2026-07-03_1f9b638a94706380b88c1930f6900458_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe	98
PID 1652 wrote to memory of 5256	1652	Unicorn-31925.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f9b638a94706380b88c1930f6900458_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f9b638a94706380b88c1930f6900458_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22684.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22684.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2782.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2782.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45284.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33611.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18895.exe
        6⤵
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35395.exe
        7⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61586.exe
        8⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60730.exe
        9⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25114.exe
        10⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60879.exe
        9⤵
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30182.exe
        8⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42597.exe
        7⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17451.exe
        8⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6134.exe
        9⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27412.exe
        8⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52462.exe
        7⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1512.exe
        8⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42922.exe
        9⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40378.exe
        8⤵
        
        PID:7852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11610.exe
        7⤵
        
        PID:8080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38196.exe
        6⤵
        
        PID:1300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39360.exe
        7⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61885.exe
        8⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42019.exe
        7⤵
        
        PID:6856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11242.exe
        6⤵
        
        PID:1992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51252.exe
        6⤵
        
        PID:8120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64566.exe
        5⤵
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13905.exe
        6⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14746.exe
        7⤵
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        8⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1458.exe
        7⤵
        
        PID:7032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10148.exe
        6⤵
        
        PID:972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2648.exe
        7⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8092.exe
        8⤵
        
        PID:7620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1678.exe
        7⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53856.exe
        6⤵
        
        PID:7156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46670.exe
        5⤵
        
        PID:3900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21379.exe
        6⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17648.exe
        7⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44091.exe
        8⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39504.exe
        9⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35481.exe
        8⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12305.exe
        7⤵
        
        PID:7372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54658.exe
        6⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55321.exe
        7⤵
        
        PID:7740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30337.exe
        6⤵
        
        PID:7364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59515.exe
        5⤵
        
        PID:4724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11345.exe
        6⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63650.exe
        7⤵
        
        PID:1744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2425.exe
        6⤵
        
        PID:3712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6499.exe
        5⤵
        
        PID:4672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8592.exe
      4⤵
      Executes dropped EXE
      PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57953.exe
        5⤵
        
        PID:3424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62463.exe
        6⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38172.exe
        7⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42010.exe
        8⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46649.exe
        7⤵
        
        PID:6452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17512.exe
        6⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20942.exe
        7⤵
        
        PID:1232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20615.exe
        5⤵
        
        PID:4900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        6⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15575.exe
        7⤵
        
        PID:7788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53795.exe
        6⤵
        
        PID:4960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55420.exe
        5⤵
        
        PID:6128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32322.exe
        6⤵
        
        PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57796.exe
        5⤵
        
        PID:2040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58154.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58154.exe
      4⤵
      PID:1648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44072.exe
        5⤵
        
        PID:2380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7170.exe
        6⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61704.exe
        7⤵
        
        PID:3596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3385.exe
        6⤵
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7699.exe
        5⤵
        
        PID:1748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40848.exe
        6⤵
        
        PID:8072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27426.exe
        5⤵
        
        PID:7268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6282.exe
      4⤵
      PID:2624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12079.exe
        5⤵
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33578.exe
        6⤵
        
        PID:8152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41852.exe
      4⤵
      PID:6384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exe
      4⤵
      PID:5132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42823.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42823.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57789.exe
      4⤵
      PID:1164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63215.exe
        5⤵
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39303.exe
        6⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2868.exe
        7⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12192.exe
        8⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43447.exe
        7⤵
        
        PID:8096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38817.exe
        6⤵
        
        PID:6280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1840.exe
        5⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41104.exe
        6⤵
        
        PID:3548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50017.exe
        6⤵
        
        PID:7352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29711.exe
        5⤵
        
        PID:6212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38087.exe
      4⤵
      PID:5896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65400.exe
        5⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63639.exe
        6⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53586.exe
        7⤵
        
        PID:8128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18200.exe
        5⤵
        
        PID:5288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23115.exe
      4⤵
      PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54703.exe
        5⤵
        
        PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62004.exe
      4⤵
      PID:5996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39407.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39407.exe
    3⤵
    PID:428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17902.exe
      4⤵
      PID:5684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52650.exe
        5⤵
        
        PID:3196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60510.exe
        6⤵
        
        PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32559.exe
        5⤵
        
        PID:3668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26116.exe
      4⤵
      PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3193.exe
        5⤵
        
        PID:7776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62984.exe
      4⤵
      PID:8136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46225.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46225.exe
    3⤵
    PID:4152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52785.exe
      4⤵
      PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49145.exe
        5⤵
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39446.exe
        5⤵
        
        PID:7084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19077.exe
      4⤵
      PID:2308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24970.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24970.exe
    3⤵
    PID:4992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31398.exe
      4⤵
      PID:6584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53592.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53592.exe
    3⤵
    PID:7716
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31925.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31925.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34978.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34978.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60253.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45537.exe
        5⤵
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23143.exe
        6⤵
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46511.exe
        7⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29345.exe
        8⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4568.exe
        9⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2985.exe
        8⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63122.exe
        7⤵
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42078.exe
        6⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54376.exe
        7⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63655.exe
        8⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46992.exe
        7⤵
        
        PID:8144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2901.exe
        6⤵
        
        PID:7416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44419.exe
        5⤵
        
        PID:5228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21379.exe
        6⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43006.exe
        7⤵
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63344.exe
        8⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        7⤵
        
        PID:7308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35003.exe
        6⤵
        
        PID:2092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1434.exe
        5⤵
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34179.exe
        6⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39535.exe
        7⤵
        
        PID:4428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40302.exe
        6⤵
        
        PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46249.exe
        5⤵
        
        PID:6708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42007.exe
      4⤵
      PID:1756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8752.exe
        5⤵
        
        PID:1476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40543.exe
        6⤵
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64129.exe
        7⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48601.exe
        8⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11361.exe
        7⤵
        
        PID:8052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44731.exe
        6⤵
        
        PID:6424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33806.exe
        5⤵
        
        PID:4952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19402.exe
        6⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50178.exe
        7⤵
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31739.exe
        6⤵
        
        PID:7388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62280.exe
        5⤵
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3785.exe
        6⤵
        
        PID:6976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27725.exe
      4⤵
      PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34773.exe
        5⤵
        
        PID:712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60988.exe
        6⤵
        
        PID:2512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41092.exe
      4⤵
      PID:2700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38155.exe
        5⤵
        
        PID:4088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41910.exe
      4⤵
      PID:7952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14622.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14622.exe
    3⤵
    PID:5256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57953.exe
      4⤵
      PID:1500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62608.exe
        5⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15749.exe
        6⤵
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24931.exe
        7⤵
        
        PID:7728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38761.exe
        6⤵
        
        PID:3048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20335.exe
        5⤵
        
        PID:2696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21819.exe
        6⤵
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24931.exe
        7⤵
        
        PID:7320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8809.exe
      4⤵
      PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29345.exe
        5⤵
        
        PID:3400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13945.exe
        6⤵
        
        PID:6440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44298.exe
        5⤵
        
        PID:6848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63562.exe
      4⤵
      PID:5620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58154.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58154.exe
    3⤵
    PID:3540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13319.exe
      4⤵
      PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63060.exe
        5⤵
        
        PID:1808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15113.exe
        6⤵
        
        PID:6800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25787.exe
        5⤵
        
        PID:1720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42208.exe
      4⤵
      PID:6360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2937.exe
        5⤵
        
        PID:7248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14481.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14481.exe
    3⤵
    PID:3660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42539.exe
      4⤵
      PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61868.exe
        5⤵
        
        PID:7188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42052.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42052.exe
    3⤵
    PID:6348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18773.exe
      4⤵
      PID:7336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61426.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61426.exe
    3⤵
    PID:7184
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16595.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16595.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59413.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59413.exe
    3⤵
    PID:4220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32380.exe
      4⤵
      PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25655.exe
        5⤵
        
        PID:1244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54433.exe
        6⤵
        
        PID:296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57561.exe
        7⤵
        
        PID:1352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32678.exe
        5⤵
        
        PID:6580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18316.exe
      4⤵
      PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52544.exe
        5⤵
        
        PID:1844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-775.exe
        6⤵
        
        PID:7424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5414.exe
        5⤵
        
        PID:7024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19937.exe
      4⤵
      PID:6904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29264.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29264.exe
    3⤵
    PID:2104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55421.exe
      4⤵
      PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48595.exe
        5⤵
        
        PID:1884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6996.exe
      4⤵
      PID:7128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46085.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46085.exe
    3⤵
    PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31045.exe
      4⤵
      PID:1976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35275.exe
        5⤵
        
        PID:6180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45783.exe
      4⤵
      PID:7568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48212.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48212.exe
    3⤵
    PID:7340
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19832.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19832.exe
  2⤵
  - Executes dropped EXE
  PID:768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57953.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57953.exe
    3⤵
    PID:928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5924.exe
      4⤵
      PID:424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48613.exe
        5⤵
        
        PID:2112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16411.exe
        6⤵
        
        PID:7400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29217.exe
        5⤵
        
        PID:1348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38726.exe
      4⤵
      PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55812.exe
        5⤵
        
        PID:6680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18368.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18368.exe
    3⤵
    PID:3220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34908.exe
      4⤵
      PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1351.exe
        5⤵
        
        PID:1036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33571.exe
      4⤵
      PID:8108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46406.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46406.exe
    3⤵
    PID:6272
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35810.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35810.exe
  2⤵
  PID:5032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10408.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10408.exe
    3⤵
    PID:5612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43001.exe
      4⤵
      PID:6432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1261.exe
        5⤵
        
        PID:7288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12829.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12829.exe
    3⤵
    PID:6716
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37267.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37267.exe
  2⤵
  PID:464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25596.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25596.exe
    3⤵
    PID:1124
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14092.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14092.exe
  2⤵
  PID:6644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-13905.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-13905.exe
Size 20.5MB
SHA256 4c9f601c43f5503cbc7f7d27c32cae8478ae16d56028d6bd7a3a0efb50c7449a
MD5 58a3303223d9b1b31bee2380502b21ec
SHA1 a86a52c4b5939f332f5fc05aa6a96d87c2ac6cb5
SHA512 1988485735dd5610b81f2b5634c7a2149246cfff024936165f2d0872a25c350cb144cf08866b6980f6f7c56ff147a94402fdb840b23c6453a0426fd3c1d2bf43
SSDEEP 393216:/+S+JEKUxqnvmbntd9xv4Mn/R1Ft+1E4T6s26Jk2NyQsv:m9tUxgv8j9aM/Lb+1PM6Jk2cZ
TLSH
T1E327D0B28D705691FE3A4C35CEA1AA6489357C291F60CBCF2905B18F67736F7603D289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-14622.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-14622.exe
Size 20.5MB
SHA256 27bb1dee6fab07f5ed6ef9fd72a0f15c1e0e061292d47c97221dfb8932f083c6
MD5 d5b4615a18871d91489d78a65f257c3d
SHA1 abc50816767f7fe5a6bd90ed9d745ee645fec86b
SHA512 a8d7fec121b8b680275d56f286c44be6e720be4c5a96ceac72454f7345acb9de27aa6ab13ec5bd6922a704e9229c31053ae511290cd943c1f4dbe78842be915b
SSDEEP 393216:/+S+JEKUxqnv9bntd98v4Mn/R1Ft+1EOThs26Jk2NtEsv:m9tUxgvxj9ZM/Lb+1FH6Jk2jt
TLSH
T1FE27D0B28D705691FE3A4C35CEA1AA6489357C291F60CBCF2905B18F67736F7603D289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-16595.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-16595.exe
Size 20.5MB
SHA256 35c85ce19d93723cc1aa2493af2aefdd5f10af8790055f324c72c34392566057
MD5 35a2202a713981c10971a2808504b910
SHA1 c92887aa12cf0ab006106762c08fda8f0a788c3c
SHA512 2d2b1504d439519dc1614a5179025397ad8d4f5112d91d658da7be2ad30742faba27ba8c44f693f1b67ef07e56c54636f3e5a98ae750d874ccb97e5029754e50
SSDEEP 393216:/1S+JEKUxqnv9bntd98v4Mn/R1Ft+1EOThs26Jk2NyEsv:t9tUxgvxj9ZM/Lb+1FH6Jk2ct
TLSH
T1F427D0B28D705691FE3A4C35CEA1AA6489357C291F60CBCF2905B18F67736F7603D289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-18895.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-18895.exe
Size 20.5MB
SHA256 caa43ed827a0f8d9be635f6c03b6a6ffaf8e3e4ad0a2c6e6446a64164f4fbb34
MD5 50d7ebccc41862ccb658d4ecbd38bc4d
SHA1 4963c754f8606e0550af4c2df1f78ed436b252a5
SHA512 fcbff231ae2b0d96196eafb0dcb449df5eda019b163de4a8b581da276452085d6d6263d3dbed4f718359b4425dfb56537e88c848563ec10bb246c77a19167d59
SSDEEP 393216:/+S+JEKUxqnvmbntd98v4zn/R1Ft+1E4Ths2eJk2NyQsv:m9tUxgv8j9Zz/Lb+1PHeJk2cZ
TLSH
T1DC27D0B28D705691FE3A4C35CEA1AA6489357C291F60CBCF2905B18F67736F7603D289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-19832.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-19832.exe
Size 20.5MB
SHA256 f51a61b182aff410c5900e864f2ae75308291b4790a16033f1502da50941f838
MD5 69789a18a27db572fb85bebba452a959
SHA1 062a0dfebb33ab91850ca56d1a079189e1239871
SHA512 febf53dd52759c9209a154694e1dc10b83c30ad21abcde1cdd2b4b589e801509f7950ce015859eb1af0f87e5ea9afb81d02963c8b33698b9a6f4637b755674b8
SSDEEP 393216:/+S+JEKUxqnv9bntd98v4Mn/R1Ft+1EOThQ26Jk2NyEsv:m9tUxgvxj9ZM/Lb+1FD6Jk2ct
TLSH
T15B27D0B28D705691FE3A4C35CEA1AA6489357C291F60CBCF2905B18F67736F7603D289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-22684.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-22684.exe
Size 20.5MB
SHA256 9f92946c2de5c708e0779a9ba9d341754a74f5987e87f5934b213b0b09a5fbfd
MD5 7ac45228b1bb422ab668aa8f39c85244
SHA1 11100c3f4882d5665237581e14676c0731898899
SHA512 f31bf2908792fa1acfa45e4a2d8a0c0985c6f217d1ff9ad94981cd1fe9288582b85096c96ceba79e9f08147b1789a8455ddc37f15ace529ccec7c01c83454ba7
SSDEEP 393216:/+S+JEKUxqnvmbntd98v4Mn/R1Ft+1EOThs26Jk2NyEsv:m9tUxgv8j9ZM/Lb+1FH6Jk2ct
TLSH
T17A27D0B28D705691FE3A4C35CEA1AA6489357C291F60CBCF2905B18F67736F7603D289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-23143.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-23143.exe
Size 20.5MB
SHA256 0c61b3a6850c49f7ef4934aa36df2349b491ea95167decf466d8f86ceaa9bb7f
MD5 1b28771a58c169588306e858214838f6
SHA1 71b542fa5d69a47192edc661948a0d041ed874ce
SHA512 07e85d2e18916e69a08809a07a3f6b506cc90c8f33fab61531915cc8c75f4c261dc1e7029495a33303ccb42be8b13853c310cac336ce13a8cbbb49ce78f05fd1
SSDEEP 393216:/+S+JEKUxqnr9bntd98v4Mn/Z1Ft+1EOThs26JY2NdEsv:m9tUxgrxj9ZM/Db+1FH6JY2zt
TLSH
T12827D0B28D705691FE3A4C35CEA1AA6489357C291F60CBCF2905B18F67736F7603D289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-2782.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-2782.exe
Size 20.5MB
SHA256 366b1986606a99d38da19d9ba4e32d7f65d7e1e9ad6f120f71aa4559a8b1fd51
MD5 40650b6117dd7406af77e72515e6aa8f
SHA1 e763af4789d03c6c360e89db1af694ff92e91ce0
SHA512 73d46331f32f08bb55bc7d6599e95c5cba4ebb1aa11b92e9d70b4775052801a2cfd30305d132a289b005e48e41ef0775210f05e96cfd14e37598187e660b0d4a
SSDEEP 393216:/+S+JEKUxqnvmbntd98v4Mn/R1Ft+1EOThs26Jk2NyQsv:m9tUxgv8j9ZM/Lb+1FH6Jk2cZ
TLSH
T1BF27D0B28D705691FE3A4C35CEA1AA6489357C291F60CBCF2905B18F67736F7603D289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-31925.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-31925.exe
Size 20.5MB
SHA256 dd64e18b4a066da737a51c20c7d9ae696b6845c613de58d3fb73a24e2d74676a
MD5 1b900d53e4701534399eb5d30eec02c5
SHA1 dc5bc5f93e567362aafe86b2d02f18b9529c3a57
SHA512 ef3184c7188e132b125cdda65694b12d5c7eea64cf9300081bd637867774a109f77a00be2f45370987ae0d2b80e4e10c69ae8028f6a1bcc905e5a2db5d0deada
SSDEEP 393216:/+S+JEKUxqnv9bntd98v4Mn/R1Ft+1EOThs26Jk2NtEsv:m9tUxgvxj9ZM/Lb+1FH6Jk2jt
TLSH
T17C27D0B28D705691FE3A4C35CEA1AA6489357C291F60CBCF2905B18F67736F7603D289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-32380.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-32380.exe
Size 20.5MB
SHA256 1ceb1e36bb038c4525a3d0c980499f27b549d7e21b89de09470e160869ac9658
MD5 39201657029cd560faa5c9976cf7aa1a
SHA1 e9d17b738e5d7f70fe54a5159fdd163880332e00
SHA512 e4f0daf27cd8de264d6ae21273908e548bc7b33049eb6bf599762a14fb735d9d3cf5d31341478eb4ed1f1657d59421340bd4a8d31394a53604a7301068727fe3
SSDEEP 393216:/1S+JEKUxqnv9bn1d98v4Mn/R1Ft+2EOThs26Jk2NyEsv:t9tUxgvxb9ZM/Lb+2FH6Jk2ct
TLSH
T18427D0B28D705691FE3A4C35CEA1AA6489357C291F60CBCF2905B18F67736F7603D289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-33611.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-33611.exe
Size 20.5MB
SHA256 95cf25f1d6401f8813edaf1b02a519a3fc613074ccbc8cede344c6bf484c17d5
MD5 49f637f5def2e07f5945109966ea98d0
SHA1 2a987239b811ca1113022ae767e63a327f3b6cad
SHA512 71b9e4b6876f0640e312d1884030885052873f1ca49a69ef36c08fb7c856eccc7819ba4efe91c4b1039bf25c1876c53e7951c8a6f8ed67a457ca2ccdc7b72352
SSDEEP 393216:/+S+JEKUxqnvmbntd98v4zn/R1Ft+1E4Ths26Jk2NyQsv:m9tUxgv8j9Zz/Lb+1PH6Jk2cZ
TLSH
T19E27D0B28D705691FE3A4C35CEA1AA6489357C291F60CBCF2905B18F67736F7603D289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-34978.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-34978.exe
Size 20.5MB
SHA256 0f0130163d7845e5eeefa7e3cfa4bbc72e4f7d31c4dab14113cde59c126213b0
MD5 8e8e0dbeeb79c1d93291ffd343adaefa
SHA1 836f0bbf0987a4542dc6a411344685a067119201
SHA512 c1966098e73cb5ab44a35a9ce14531515279761dea62e76adb666dc996227a09344317d3be0f3d9a5a10a57fc2dc97cb9e835c18f971a6c5cb7757984c2834bd
SSDEEP 393216:/+S+JEKUxqnv9bntd98v4Mn/Z1Ft+1EOThs26Jk2NtEsv:m9tUxgvxj9ZM/Db+1FH6Jk2jt
TLSH
T18727D0B28D705691FE3A4C35CEA1AA6489357C291F60CBCF2905B18F67736F7603D289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-35395.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-35395.exe
Size 20.5MB
SHA256 206fa7511b59b879f4a8a2b3555bb31c4a68c21cd5a350f291fe45ab46964c66
MD5 5f3a26010b6cf326e7ba5c502eff2043
SHA1 6ea725ecd22bdcf4c158a8678bf9ebb34627fe67
SHA512 e13e7360a97d7b4daf39b6e8f7ef0e8ae1c0c0393d995622dba9d557c4b79c80a556ccd6c14a26bb0ca9b1454ce46838797bfe05de8ef24a45d8461dce002075
SSDEEP 393216:/+S+JEKUxqnvmbntv98v4zn/R1Ft+1E4Ths2eJk2NyQsv:m9tUxgv8R9Zz/Lb+1PHeJk2cZ
TLSH
T16F27D0B28D705691FE3A4C35CEA1AA6489357C291F60CBCF2905B18F67736F7603D289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-38196.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-38196.exe
Size 20.5MB
SHA256 4b60f486a903080a65ea6e27ebe27d0ad2c4761515aa4e1cffa361165ef2fa69
MD5 5620a000e1a6d3d4f7ecaba3970159bd
SHA1 6529d3c3470c32ff27c409e4fdd66dedf1a795b5
SHA512 23f437498293ed749129b0f07ed84b72d109d1cfafba8661b53776d117b2dda2d80dddbebce2888f9797885e6723faec1652b0f7e9ac2e5cc8f5c87bec3973cf
SSDEEP 393216:/+SfJEKUxqnvmbntd98v4zn/R1Ft+1E4Ths26Jk2NyQsv:mQtUxgv8j9Zz/Lb+1PH6Jk2cZ
TLSH
T11327D0B28D705691FE3A4C35CEA1AA6489357C291F60CBCF2905B18F67736F7603D289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-39407.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-39407.exe
Size 20.5MB
SHA256 261859b6d0f6c218fd53f10f356190c27f361007b749bc80b5c73c12a76fb7c5
MD5 da5d21bf126120d8779b98bf51916aab
SHA1 b86db977fd976bc941f329cc85ad75b5739f98d1
SHA512 c2cdd339f1f7049e30876f945cd558ed27e498a98d1c4caacd071afca7901d3bf1d4843f4b4ea3b8bd172411592c19371716e8414433e06f923d03c5f1a0c7d8
SSDEEP 393216:/iS+JEKUxqnvmbntd98v4Mn/R1Ft+1EOThs26Jk2NyEsv:q9tUxgv8j9ZM/Lb+1FH6Jk2ct
TLSH
T18D27D0B28D705691FE3A4C35CEA1AA6489357C291F60CBCF2905B18F67736F7603D289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-42007.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42007.exe
Size 20.5MB
SHA256 35bf7ddbcbe6325c19a2eb86e50bfa5608e25cc530e666bc2bbe1666098ca248
MD5 97d1b9f3706d87fdd81d6964a923aa59
SHA1 64a7f9a967a25832b1cd0bd163b4dc6e9a112db6
SHA512 e16b3a085d48a5d0e1bcf1b1b0c855947cc4a04943c13ca511957485b7b6ea43fad2f1bb07d2133391f507e7e3670890795b2e6634b198d9a946924cbdd49bba
SSDEEP 393216:/+S+JEKUxqnv9bnld98v4Mn/Z1Ft+1EOThs26Jk2NtEsv:m9tUxgvxr9ZM/Db+1FH6Jk2jt
TLSH
T1BD27D0B28D705691FE3A4C35CEA1AA6489357C291F60CBCF2905B18F67736F7603D289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-42823.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42823.exe
Size 20.5MB
SHA256 7c57c8e2ca8c1214cb07d7901c1297a5dc3f7afe60e9e730e112a331bffd41f2
MD5 2fb7d9e88e5e79f44ecac5dd5ff69a2d
SHA1 444f069fe54d74142dda40629f24420904e07fe0
SHA512 2a4ee179ad80815569b3fefa410da02a1f4ba0233e3d7adbd0d48ed24b2084207ede319d4ec2f02d5bd3aa31d5ebef50222ccb163a95f9b692ee50ea2231a322
SSDEEP 393216:/+S+JEKUxqnvmbnvd98v4Mn/R1Ft+1EOThs26Jk2NyEsv:m9tUxgv8V9ZM/Lb+1FH6Jk2ct
TLSH
T14F27D0B28D705691FE3A4C35CEA1AA6489357C291F60CBCF2905B18F67736F7603D289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-45284.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-45284.exe
Size 20.5MB
SHA256 83cd39b0c7281cad4677f5fc7242531fe86f53e5170cbce940ee932ab719a526
MD5 a7c588aa98ad24bc31ef52f06f40328a
SHA1 7f7f5a66f8fb6f08cef2209cc6e54e4655a1794e
SHA512 76f212dc83e872c0ef70c98a699d20948774278c2bbccc979860630db5ebedbab6510afe9d85c3da02b82312413dd0f37fc018743fa976ae68e78c8b7aedaa51
SSDEEP 393216:/+S+JEKUxqnvmbntd98v4Mn/R1Ft+1E4Ths26Jk2NyQsv:m9tUxgv8j9ZM/Lb+1PH6Jk2cZ
TLSH
T16E27D0B28D705691FE3A4C35CEA1AA6489357C291F60CBCF2905B18F67736F7603D289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-45537.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-45537.exe
Size 20.5MB
SHA256 9a75807e5504504c857ea58e60cbcad0117bb41269f8d9c930e5680808547a9b
MD5 ec7afb9fee20b7fe45030691115ac123
SHA1 755ab5700eacbb2be278afa17e19fd6388dfe8e5
SHA512 6e93a62ae0508051efcc7eacb52dfe96552cf0e75c642e76c3fff5512caf031579da9f264bdba1b48e56c8f523767307c1d53873f16a44f600303bc47cf5ad64
SSDEEP 393216:/+S+JEKUxqnv9bntd98v4Mn/Z1Ft+1EOThs26JY2NdEsv:m9tUxgvxj9ZM/Db+1FH6JY2zt
TLSH
T14B27D0B28D705691FE3A4C35CEA1AA6489357C291F60CBCF2905B18F67736F7603D289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-46670.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-46670.exe
Size 20.5MB
SHA256 98e02ced90fbe69dac16452f3e0b7578fc09d9d09de73a6cd39b973f38923139
MD5 005c6a5eb13457cd250f681d4f52fb80
SHA1 4329a7a29db9e51fc43bff43c740532d42030440
SHA512 f22aca8e413d005e7344961aacf0873ecd5d1a12fc7f0d48c432725bb0828dd573a6a37f9a16603e676f67db8dd4ffe8b72d2ad5299f3fc5d9dc0f26570fd302
SSDEEP 393216:/+S+JEKUxqnvmbntd98v4Mn/R1Ft+1E4Ths26Jk2Ny6sv:m9tUxgv8j9ZM/Lb+1PH6Jk2cT
TLSH
T1FF27D0B28D705691FE3A4C35CEA1AA6489357C291F60CBCF2905B18F67736F7603D289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-57789.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-57789.exe
Size 20.5MB
SHA256 ce76fc09e1940c5728762f439fe092675100567bcc3270dd3d96436323dbcb41
MD5 ea302bcba61cc47d74183ad8a38ab6a6
SHA1 15fba1c3d0e954be82d7f7723b3827c97b8245fa
SHA512 0da83cd2dde26b38fffde294207eed9ee59ef87797c344c0d495c326512147ca4825b901f53000bc6b73d96222e3afec5b940d27887466a84740d38b34a60b82
SSDEEP 393216:/+S+JEKUxqnvmbnvdW8v4Mn/R1Ft+1EOThs26Jk2NyEsv:m9tUxgv8VWZM/Lb+1FH6Jk2ct
TLSH
T17827D0B28D705691FE3A4C35CEA1AA6489357C291F60CBCF2905B18F67736F7603D289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-57953.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-57953.exe
Size 20.5MB
SHA256 551bf9ca2e701c358c7df9f34b094f226a59ff86f31f7e990fefb245adece989
MD5 ccb9dd206537456c0beaab634790196c
SHA1 88f85564cbb0671007fa4aee2746ab6972dde72c
SHA512 778af8ed4caaac881c7674447af92fd4602899843872e59116db771b735756dfa93af14945c06dabcacf1d90d9ac311d520518a8b23aabad1f5a4840ffef28e7
SSDEEP 393216:/+S+JEKUxqnvAbntd98v4Mn/R1Ft+1EOThs26Jk2NtEsv:m9tUxgvej9ZM/Lb+1FH6Jk2jt
TLSH
T18D27D0B28D705691FE3A4C35CEA1AA6489357C291F60CBCF2905B18F67736F7603D289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-58154.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-58154.exe
Size 20.5MB
SHA256 40b4b9849df4b09d09643872d5acf94ab9eac7d2c1d58ffa4bb3a5e3591a1308
MD5 0bed03b6fa638116ba13d8586c7dedec
SHA1 31074896aeef38eb05231c3e1e762926843c0a95
SHA512 b09de6d13663d85a149b1d79e5faca10a816aaa2a44593d0b55a11d5242e4c1fea315ce8144c15c14e259c3df16dd4b8271d8bd28cefe1ddff1a42512df56f3d
SSDEEP 393216:/+S+JEKUxqnv9bntd98v4Mn/R1Fo+1EOThs26Jk2NtEsv:m9tUxgvxj9ZM/LC+1FH6Jk2jt
TLSH
T1B727D0B28D705691FE3A4C35CEA1AA6489357C291F60CBCF2905B18F67736F7603D289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-59413.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-59413.exe
Size 20.5MB
SHA256 2e4ce946e0f5b1d45935b4d72e9c806e8a3bb6622f83e83051c900af44c01896
MD5 47b08dfda98cfafd495c6afddc9a753d
SHA1 eeb33a358f74a9861317ab81438825113ea1756a
SHA512 2586c82b0a2ae6b3c8a4f9530e00efcebc7c65b37cf71c0a2e1cf5b553e81065617e43966d2f964eb96d1db2f1befa286b5daf2268ff114412d5258b1335e52b
SSDEEP 393216:/1S+JEKUxqnv9bn1d98v4Mn/R1Ft+1EOThs26Jk2NyEsv:t9tUxgvxb9ZM/Lb+1FH6Jk2ct
TLSH
T16827D0B28D705691FE3A4C35CEA1AA6489357C291F60CBCF2905B18F67736F7603D289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-60253.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-60253.exe
Size 20.5MB
SHA256 f0a12b9d9975c6036b8ac48079c884c146a0ee8e62a4baa17b6fc0bb8e67e7b5
MD5 dc4086212c949fc906e767500a5f2702
SHA1 45655b56e423f0d13616ddaf7637ad5d08c8f50d
SHA512 cce78f4ee4d910e0115cde14796ce201c16b0ea80f5a343c1ed5dbc1559f898922999d952f6c9f9812b39276c21e08cf7c537dca54711df9060a0c9dcb3de8c5
SSDEEP 393216:/+S+JEKUxqnv9bntd98v4Mn/Z1Ft+1EOThs26JY2NtEsv:m9tUxgvxj9ZM/Db+1FH6JY2jt
TLSH
T14E27D0B28D705691FE3A4C35CEA1AA6489357C291F60CBCF2905B18F67736F7603D289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-63215.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-63215.exe
Size 20.5MB
SHA256 4d3ec96b2243709e9ff232a8017168c82f04f1c004f552561e7e16c9cdb59c15
MD5 95112ad66bb7e34e90d04a06b69a2ab2
SHA1 c319416dd3faa6fe11c7c8577c907841ccadaefb
SHA512 ba8d89ba72e60a89094cf7794454c2acbc06b9a5a0d8144e3d910e6c49c499287d5de64a6d8f02f9cc034621b39d2f2dcc2b2a4e19f12c9febe62d1888c18940
SSDEEP 393216:/TS+JEKUxqnvmbnvdW8v4Mn/R1Ft+1EOThs26Jk2NyEsv:79tUxgv8VWZM/Lb+1FH6Jk2ct
TLSH
T1E827D0B28D705691FE3A4C35CEA1AA6489357C291F60CBCF2905B18F67736F7603D289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-64566.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-64566.exe
Size 20.5MB
SHA256 3e5c33616ada256989faf5cd9d690f149125affe8363b54db1c7be4649dee137
MD5 ab7abfc282b2be9d8ea7c9074702ce0d
SHA1 df0f64f6684680a2f9d29f5fa77218f4383a31c7
SHA512 b3864af4db152f71e49e5a819e1c5e44068bbd5a563833472ad93f7a6b954413bfdb3d51d26976d498bd18054039677d3de553c98651006e45b699758e299bae
SSDEEP 393216:/+S+JEKUxqnvmbntd9xv4Mn/R1Ft+1E4Ths26Jk2NyQsv:m9tUxgv8j9aM/Lb+1PH6Jk2cZ
TLSH
T11927D0B28D705691FE3A4C35CEA1AA6489357C291F60CBCF2905B18F67736F7603D289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-8592.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-8592.exe
Size 20.5MB
SHA256 50ff77a5977e5db32fe70cad23cafbb0d50f1823c660f7ac23143056bff9f300
MD5 b5b271dd1bd234c39d9f4ee27e7e6437
SHA1 67b0a00dba18271bf4d338290a2fdbd4c0b6ce79
SHA512 f00cdcd3ac64336a402cee26b552cff3c26c357f4a5032a55a1d412918c020047a69473871d2115907796bcea49523baedcd88c88c427b2e2b5364d2da00c3da
SSDEEP 393216:/+S+JEKUxqnvmbntd98v4Mn/R1Ftb1EOThs26Jk2NyQsv:m9tUxgv8j9ZM/Lbb1FH6Jk2cZ
TLSH
T12527D0B28D705691FE3A4C35CEA1AA6489357C291F60CBCF2905B18F67736F7603D289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-8752.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-8752.exe
Size 20.5MB
SHA256 3a642ae2663303ff47a9626b7333c6a253ecd2d02f41f012e4a43a02190a5ce1
MD5 455f33b598e25a3db1a460b57df1de2a
SHA1 77534b6549d18894dc6caeec28af0829770a2ff9
SHA512 be6a9d1d7fd52d12d367727f4e21dee6194906ed4bf770197d64282c5cd3d51d0506269db7b0b9e9f8c1891595a86b9a122b0ee30109cf16e47d181d031c7965
SSDEEP 393216:/KS+JEKUxqnv9bnld98v4Mn/Z1Ft+1EOThs26Jk2NtEsv:C9tUxgvxr9ZM/Db+1FH6Jk2jt
TLSH
T1EF27D0B28D705691FE3A4C35CEA1AA6489357C291F60CBCF2905B18F67736F7603D289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1244-415-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1504-782-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1748-814-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1756-137-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1976-813-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2004-781-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2096-818-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2112-647-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2652-0-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2696-815-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2700-820-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2864-812-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2972-416-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3340-811-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3408-817-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3480-816-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3612-452-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3660-454-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3900-254-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4400-821-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4696-414-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4992-641-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5052-555-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5228-253-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5248-646-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5316-453-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5396-657-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5620-846-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5800-819-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5884-850-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5896-252-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6372-849-0x0000000000400000-0x0000000000475000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads