kawaiiunicorn | 994094a613965705d1e536b5d4fc305a4bb147e3650792767ecb5de3ed9c6e43

Analysis

max time kernel
21s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 16:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_baa10aaec810df9aa82b019ff0c98eb2_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Size 15.7MB
Sample260709-t4p3daew2v
SHA256 994094a613965705d1e536b5d4fc305a4bb147e3650792767ecb5de3ed9c6e43
MD5 baa10aaec810df9aa82b019ff0c98eb2
SHA1 ba5cb478936958337df0d5a2cc682720a60f3a76
SHA512 f6c057e2c6dff7bef1206684a57f50425905cb69bb2792d51755ae8ff329f9e0ed6bb56e557f16b9ac81f19acfe204fab04b82028a4ef2b9b7ef16549c60a49a
SSDEEP 393216:Wbntd78v4Mn/R1Ft6mEeThsq6Jk2N0JsJ:Mj7ZM/Lb6mlj6Jk2Su
TLSH
T17EF6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery kawaiiunicorn trojan

Malware Config

Signatures

Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
trojan kawaiiunicorn

Detects KawaiiUnicorn 23 IoCs

resource	yara_rule
behavioral2/memory/2596-0-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2128-355-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5836-360-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1680-381-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1796-437-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3484-503-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2432-542-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5784-577-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2696-600-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1572-704-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5436-702-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2940-739-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3084-738-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2500-737-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5232-869-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3916-868-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4536-866-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4200-836-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5956-835-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2368-784-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3588-891-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6732-965-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7052-1157-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 37 IoCs

resource	yara_rule
behavioral2/files/0x0005000000016b3d-6.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x0005000000016b40-11.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x0009000000019ebb-20.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000500000001b816-28.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000400000001b871-41.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x001200000001c2d5-40.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x001900000001c27a-49.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000e00000001c417-63.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000e00000001c418-71.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c41a-76.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x001200000001c416-84.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c419-73.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c41b-108.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c41e-119.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c41c-118.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c421-124.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c41d-134.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c420-130.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c41f-122.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c424-186.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c43d-194.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c43c-202.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c446-229.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c43b-230.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c440-234.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c43a-232.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c448-231.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c43e-226.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c43f-225.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c427-224.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c44a-222.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c443-212.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c441-228.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c447-227.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c442-205.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c445-198.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c425-185.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

UPX dump on OEP (original entry point) 37 IoCs

resource	yara_rule
behavioral2/files/0x0005000000016b3d-6.dat	UPX
behavioral2/files/0x0005000000016b40-11.dat	UPX
behavioral2/files/0x0009000000019ebb-20.dat	UPX
behavioral2/files/0x000500000001b816-28.dat	UPX
behavioral2/files/0x000400000001b871-41.dat	UPX
behavioral2/files/0x001200000001c2d5-40.dat	UPX
behavioral2/files/0x001900000001c27a-49.dat	UPX
behavioral2/files/0x000e00000001c417-63.dat	UPX
behavioral2/files/0x000e00000001c418-71.dat	UPX
behavioral2/files/0x000d00000001c41a-76.dat	UPX
behavioral2/files/0x001200000001c416-84.dat	UPX
behavioral2/files/0x000d00000001c419-73.dat	UPX
behavioral2/files/0x000d00000001c41b-108.dat	UPX
behavioral2/files/0x000d00000001c41e-119.dat	UPX
behavioral2/files/0x000d00000001c41c-118.dat	UPX
behavioral2/files/0x000d00000001c421-124.dat	UPX
behavioral2/files/0x000d00000001c41d-134.dat	UPX
behavioral2/files/0x000d00000001c420-130.dat	UPX
behavioral2/files/0x000d00000001c41f-122.dat	UPX
behavioral2/files/0x000d00000001c424-186.dat	UPX
behavioral2/files/0x000d00000001c43d-194.dat	UPX
behavioral2/files/0x000d00000001c43c-202.dat	UPX
behavioral2/files/0x000d00000001c446-229.dat	UPX
behavioral2/files/0x000d00000001c43b-230.dat	UPX
behavioral2/files/0x000d00000001c440-234.dat	UPX
behavioral2/files/0x000d00000001c43a-232.dat	UPX
behavioral2/files/0x000d00000001c448-231.dat	UPX
behavioral2/files/0x000d00000001c43e-226.dat	UPX
behavioral2/files/0x000d00000001c43f-225.dat	UPX
behavioral2/files/0x000d00000001c427-224.dat	UPX
behavioral2/files/0x000d00000001c44a-222.dat	UPX
behavioral2/files/0x000d00000001c443-212.dat	UPX
behavioral2/files/0x000d00000001c441-228.dat	UPX
behavioral2/files/0x000d00000001c447-227.dat	UPX
behavioral2/files/0x000d00000001c442-205.dat	UPX
behavioral2/files/0x000d00000001c445-198.dat	UPX
behavioral2/files/0x000d00000001c425-185.dat	UPX

Executes dropped EXE 11 IoCs

pid	Process
6120	Unicorn-21063.exe
5684	Unicorn-54607.exe
4636	Unicorn-22489.exe
3532	Unicorn-58172.exe
3008	Unicorn-59106.exe
5392	Unicorn-35156.exe
5868	Unicorn-48892.exe
1144	Unicorn-10694.exe
4252	Unicorn-3595.exe
4180	Unicorn-42490.exe
1120	Unicorn-21969.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22489.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58172.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59106.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35156.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48892.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10694.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3595.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42490.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_baa10aaec810df9aa82b019ff0c98eb2_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54607.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2596	2026-07-09_baa10aaec810df9aa82b019ff0c98eb2_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
6120	Unicorn-21063.exe
5684	Unicorn-54607.exe
4636	Unicorn-22489.exe
3532	Unicorn-58172.exe
3008	Unicorn-59106.exe
5392	Unicorn-35156.exe
5868	Unicorn-48892.exe
1144	Unicorn-10694.exe
4252	Unicorn-3595.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 6120	2596	2026-07-09_baa10aaec810df9aa82b019ff0c98eb2_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe	88
PID 6120 wrote to memory of 5684	6120	Unicorn-21063.exe	89
PID 2596 wrote to memory of 4636	2596	2026-07-09_baa10aaec810df9aa82b019ff0c98eb2_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe	90
PID 5684 wrote to memory of 3532	5684	Unicorn-54607.exe	91
PID 4636 wrote to memory of 3008	4636	Unicorn-22489.exe	92
PID 6120 wrote to memory of 5392	6120	Unicorn-21063.exe	93
PID 2596 wrote to memory of 5868	2596	2026-07-09_baa10aaec810df9aa82b019ff0c98eb2_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe	94
PID 3008 wrote to memory of 1144	3008	Unicorn-59106.exe	95
PID 5392 wrote to memory of 4252	5392	Unicorn-35156.exe	96
PID 3532 wrote to memory of 4180	3532	Unicorn-58172.exe	97
PID 6120 wrote to memory of 1120	6120	Unicorn-21063.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-07-09_baa10aaec810df9aa82b019ff0c98eb2_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_baa10aaec810df9aa82b019ff0c98eb2_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21063.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21063.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54607.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54607.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58172.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42490.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9091.exe
        6⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39711.exe
        7⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34610.exe
        8⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63447.exe
        7⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60247.exe
        8⤵
        
        PID:8960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        7⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50921.exe
        6⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2805.exe
        7⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57953.exe
        8⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42026.exe
        7⤵
        
        PID:9092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27266.exe
        6⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35785.exe
        7⤵
        
        PID:9128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33766.exe
        5⤵
        
        PID:1464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58487.exe
        6⤵
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18239.exe
        7⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7678.exe
        8⤵
        
        PID:548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27906.exe
        7⤵
        
        PID:8800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52565.exe
        6⤵
        
        PID:7148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33929.exe
        5⤵
        
        PID:1516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8726.exe
        6⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32375.exe
        7⤵
        
        PID:2844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18264.exe
        6⤵
        
        PID:7352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61746.exe
        5⤵
        
        PID:6404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42188.exe
        6⤵
        
        PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26397.exe
        5⤵
        
        PID:9032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56366.exe
      4⤵
      PID:1492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17753.exe
        5⤵
        
        PID:2960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43796.exe
        6⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5322.exe
        7⤵
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17666.exe
        6⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27181.exe
        7⤵
        
        PID:8356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33515.exe
        5⤵
        
        PID:1796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7226.exe
        6⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24612.exe
        7⤵
        
        PID:9168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28185.exe
        6⤵
        
        PID:7180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60567.exe
        5⤵
        
        PID:1512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12836.exe
        6⤵
        
        PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31970.exe
        5⤵
        
        PID:7928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37196.exe
      4⤵
      PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9442.exe
        5⤵
        
        PID:4764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20356.exe
        6⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48446.exe
        7⤵
        
        PID:6788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26297.exe
        6⤵
        
        PID:7080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61943.exe
        5⤵
        
        PID:2500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54113.exe
        6⤵
        
        PID:7460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19887.exe
        5⤵
        
        PID:7252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20880.exe
      4⤵
      PID:2468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3905.exe
        5⤵
        
        PID:6608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57232.exe
        6⤵
        
        PID:7880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46952.exe
        5⤵
        
        PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15928.exe
      4⤵
      PID:7380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35156.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35156.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3595.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49112.exe
        5⤵
        
        PID:4724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52563.exe
        6⤵
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47880.exe
        7⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27751.exe
        8⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64108.exe
        9⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48820.exe
        8⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31926.exe
        7⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63091.exe
        8⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59977.exe
        7⤵
        
        PID:240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36919.exe
        6⤵
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64149.exe
        7⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34757.exe
        8⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1051.exe
        7⤵
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20578.exe
        6⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5997.exe
        7⤵
        
        PID:1996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36781.exe
        5⤵
        
        PID:1044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22764.exe
        6⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32738.exe
        7⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49484.exe
        8⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22099.exe
        7⤵
        
        PID:7440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5197.exe
        6⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27653.exe
        7⤵
        
        PID:7432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34926.exe
        6⤵
        
        PID:2080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9919.exe
        5⤵
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9385.exe
        6⤵
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48005.exe
        7⤵
        
        PID:8000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57185.exe
        6⤵
        
        PID:7692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48670.exe
        5⤵
        
        PID:6528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47331.exe
        6⤵
        
        PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27423.exe
        5⤵
        
        PID:1436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59973.exe
      4⤵
      PID:2704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8022.exe
        5⤵
        
        PID:3284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40060.exe
        6⤵
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18073.exe
        7⤵
        
        PID:844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12561.exe
        8⤵
        
        PID:7660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-755.exe
        7⤵
        
        PID:7212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63360.exe
        6⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21135.exe
        7⤵
        
        PID:8972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34988.exe
        6⤵
        
        PID:7404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19596.exe
        5⤵
        
        PID:2696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32494.exe
        6⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40258.exe
        7⤵
        
        PID:1124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17309.exe
        5⤵
        
        PID:6184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8991.exe
      4⤵
      PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57465.exe
        5⤵
        
        PID:2820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2037.exe
        6⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21799.exe
        7⤵
        
        PID:7508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2125.exe
        6⤵
        
        PID:8664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5799.exe
        5⤵
        
        PID:3084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29967.exe
        6⤵
        
        PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54755.exe
        5⤵
        
        PID:7956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34201.exe
      4⤵
      PID:3068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10044.exe
        5⤵
        
        PID:7036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38914.exe
        6⤵
        
        PID:2056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36043.exe
        5⤵
        
        PID:5004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-915.exe
      4⤵
      PID:2680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21969.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21969.exe
    3⤵
    - Executes dropped EXE
    PID:1120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36035.exe
      4⤵
      PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16433.exe
        5⤵
        
        PID:5692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2675.exe
        6⤵
        
        PID:4232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48337.exe
        6⤵
        
        PID:7412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14605.exe
        5⤵
        
        PID:4820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9660.exe
        6⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28068.exe
        7⤵
        
        PID:6900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54952.exe
        5⤵
        
        PID:6208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48783.exe
      4⤵
      PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25317.exe
        5⤵
        
        PID:2764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16349.exe
        6⤵
        
        PID:8012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29312.exe
        5⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57549.exe
        6⤵
        
        PID:4376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64303.exe
      4⤵
      PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27938.exe
        5⤵
        
        PID:7028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42815.exe
        5⤵
        
        PID:5468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29977.exe
      4⤵
      PID:5544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26592.exe
      4⤵
      PID:5404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8250.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8250.exe
    3⤵
    PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26848.exe
      4⤵
      PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28332.exe
        5⤵
        
        PID:1884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15519.exe
        6⤵
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47601.exe
        7⤵
        
        PID:8244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10044.exe
        5⤵
        
        PID:7336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4382.exe
      4⤵
      PID:1572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26018.exe
        5⤵
        
        PID:7360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31129.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31129.exe
    3⤵
    PID:3224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2805.exe
      4⤵
      PID:4060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33086.exe
        5⤵
        
        PID:6172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4341.exe
      4⤵
      PID:3664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-967.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-967.exe
    3⤵
    PID:4536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24316.exe
      4⤵
      PID:7392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49055.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49055.exe
    3⤵
    PID:7932
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22489.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22489.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59106.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59106.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10694.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14301.exe
        5⤵
        
        PID:1460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55578.exe
        6⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20517.exe
        7⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58482.exe
        8⤵
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-688.exe
        9⤵
        
        PID:7920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29281.exe
        8⤵
        
        PID:8676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47470.exe
        7⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39972.exe
        8⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54534.exe
        9⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41372.exe
        7⤵
        
        PID:7904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38263.exe
        6⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10812.exe
        7⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35716.exe
        7⤵
        
        PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22967.exe
        5⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35435.exe
        6⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28737.exe
        7⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45613.exe
        8⤵
        
        PID:8832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35560.exe
        7⤵
        
        PID:8576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58486.exe
        6⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37352.exe
        7⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47886.exe
        6⤵
        
        PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46182.exe
        5⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34575.exe
        6⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38208.exe
        7⤵
        
        PID:9160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11435.exe
        6⤵
        
        PID:1176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61528.exe
        5⤵
        
        PID:6968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50673.exe
        6⤵
        
        PID:8772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25022.exe
        5⤵
        
        PID:1072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22147.exe
      4⤵
      PID:4656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33596.exe
        5⤵
        
        PID:4100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57574.exe
        6⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62374.exe
        7⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40470.exe
        8⤵
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21528.exe
        7⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15509.exe
        8⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5726.exe
        7⤵
        
        PID:7268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26172.exe
        6⤵
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52914.exe
        7⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1965.exe
        8⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2399.exe
        6⤵
        
        PID:6624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33624.exe
        5⤵
        
        PID:2200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60366.exe
        6⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21545.exe
        7⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51840.exe
        6⤵
        
        PID:8032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18932.exe
        5⤵
        
        PID:6888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12255.exe
        6⤵
        
        PID:3512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25613.exe
        5⤵
        
        PID:8460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27465.exe
      4⤵
      PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40169.exe
        5⤵
        
        PID:248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2037.exe
        6⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64969.exe
        7⤵
        
        PID:7236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14569.exe
        6⤵
        
        PID:7484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50013.exe
        5⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10091.exe
        6⤵
        
        PID:8076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57246.exe
        5⤵
        
        PID:1248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39795.exe
      4⤵
      PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56941.exe
        5⤵
        
        PID:2568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33797.exe
        6⤵
        
        PID:8052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6723.exe
        5⤵
        
        PID:7972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49765.exe
      4⤵
      PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6521.exe
        5⤵
        
        PID:8368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42783.exe
      4⤵
      PID:5720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21492.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21492.exe
    3⤵
    PID:3208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44779.exe
      4⤵
      PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40060.exe
        5⤵
        
        PID:3708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4175.exe
        6⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16729.exe
        7⤵
        
        PID:7644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17522.exe
        6⤵
        
        PID:7980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60812.exe
        5⤵
        
        PID:6360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-605.exe
        6⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51418.exe
        7⤵
        
        PID:7400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51133.exe
        5⤵
        
        PID:7808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36919.exe
      4⤵
      PID:4400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64149.exe
        5⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12452.exe
        6⤵
        
        PID:8024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12369.exe
        5⤵
        
        PID:9152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30226.exe
      4⤵
      PID:7052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27653.exe
        5⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60844.exe
        6⤵
        
        PID:468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5483.exe
        5⤵
        
        PID:9180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38047.exe
      4⤵
      PID:9052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64057.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64057.exe
    3⤵
    PID:5132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52421.exe
      4⤵
      PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26926.exe
        5⤵
        
        PID:916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38113.exe
        5⤵
        
        PID:8084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6183.exe
      4⤵
      PID:992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41543.exe
      4⤵
      PID:7952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5556.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5556.exe
    3⤵
    PID:4852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2888.exe
      4⤵
      PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14398.exe
        5⤵
        
        PID:7528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58425.exe
      4⤵
      PID:6960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56281.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56281.exe
    3⤵
    PID:6392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2935.exe
      4⤵
      PID:7800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17669.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17669.exe
    3⤵
    PID:8788
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48892.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48892.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45028.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45028.exe
    3⤵
    PID:5848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6953.exe
      4⤵
      PID:5060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5358.exe
        5⤵
        
        PID:6092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41954.exe
        6⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1046.exe
        7⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16255.exe
        8⤵
        
        PID:6576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54460.exe
        5⤵
        
        PID:3828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13831.exe
        5⤵
        
        PID:8020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60158.exe
      4⤵
      PID:700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45675.exe
        5⤵
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53018.exe
        6⤵
        
        PID:6800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45104.exe
        5⤵
        
        PID:8164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46727.exe
      4⤵
      PID:6592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8140.exe
        5⤵
        
        PID:7940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58192.exe
      4⤵
      PID:792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35219.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35219.exe
    3⤵
    PID:1252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35627.exe
      4⤵
      PID:52
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50527.exe
        5⤵
        
        PID:6440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28068.exe
        6⤵
        
        PID:2360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54139.exe
        5⤵
        
        PID:8360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23976.exe
      4⤵
      PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13786.exe
        5⤵
        
        PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10589.exe
      4⤵
      PID:944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15155.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15155.exe
    3⤵
    PID:4760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25826.exe
      4⤵
      PID:1904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36438.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36438.exe
    3⤵
    PID:7284
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44763.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44763.exe
  2⤵
  PID:4496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62184.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62184.exe
    3⤵
    PID:5428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35016.exe
      4⤵
      PID:2128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64621.exe
        5⤵
        
        PID:1908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63163.exe
        6⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23958.exe
        7⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49119.exe
        8⤵
        
        PID:8488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61954.exe
        6⤵
        
        PID:7860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33951.exe
        5⤵
        
        PID:6732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56962.exe
        6⤵
        
        PID:8224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21522.exe
        5⤵
        
        PID:7572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24335.exe
      4⤵
      PID:4880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1622.exe
        5⤵
        
        PID:2180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35923.exe
      4⤵
      PID:7452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27293.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27293.exe
    3⤵
    PID:2964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9136.exe
      4⤵
      PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46495.exe
        5⤵
        
        PID:7324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22545.exe
      4⤵
      PID:6636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52207.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52207.exe
    3⤵
    PID:5596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62769.exe
      4⤵
      PID:7844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61134.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61134.exe
    3⤵
    PID:8608
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63560.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63560.exe
  2⤵
  PID:2396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35016.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35016.exe
    3⤵
    PID:5856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13858.exe
      4⤵
      PID:5732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19758.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19758.exe
    3⤵
    PID:1660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55540.exe
      4⤵
      PID:8064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1662.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1662.exe
    3⤵
    PID:7912
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39098.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39098.exe
  2⤵
  PID:2524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20076.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20076.exe
    3⤵
    PID:7100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30611.exe
      4⤵
      PID:1192
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64960.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64960.exe
  2⤵
  PID:6540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-10694.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-10694.exe
Size 15.7MB
SHA256 f87a1991d3bf451533416ec97099456f2a40e344cf37812f609561a310a2fb72
MD5 9ee555cc8877c4e0e0717f8186a0f4c3
SHA1 e4bd70d63c693d3e2fe07e14fa493ad2e0d4c2f5
SHA512 990229a4802f9857db25965a4be640386aa21f3a05798a44aa6bd74c50d90fa5d1191fa81d11ce3a8e393cb5f6f7d7708e938958e40186b656038468a9e12786
SSDEEP 393216:Wbntd78v4Mn/R1Ft6mbeThsqvJc2N0JsJ:Mj7ZM/Lb6mijvJc2Su
TLSH
T192F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-14301.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-14301.exe
Size 15.7MB
SHA256 902a6eda93e12084579f8d898350bfdc8c353c014d63a4ee86cc886433115f3e
MD5 2b85498a8ee52f7cad36a2fa04bf6e44
SHA1 ec4ebddbdf42ba0bd1112ea1cc90c482dc622fd3
SHA512 591014d927f9896ac5541601923447946c30e8b42fd21836024d7355bbc464109312c287c72a3e57a6056b03ca651c674953605daeb68e379a565232eafaa716
SSDEEP 393216:Wbntd78v4Mn/R1Ft6mbeThsqvJZ2N0JsJ:Mj7ZM/Lb6mijvJZ2Su
TLSH
T188F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-17753.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-17753.exe
Size 15.7MB
SHA256 1d59109f8767d6e6730c9b6316717d314b230a1930f2c30e13203e929b6f05cb
MD5 ca7a68671ded8da5960109de1e287102
SHA1 d592fd55addcfd913807121f81203ef53995e109
SHA512 80d2896541384bfaa6f75377ee6a06695a3564d19e7b379bbb861c883d97ac562cd0feb6331a2ee2d97bbd80e7bbfd593ca9649246d7c0301b93cf1c4a0b60c9
SSDEEP 393216:Wbntd7LvYMn/R1Ft65EeThsq6tk2N0JsJ:Mj7kM/Lb65lj6tk2Su
TLSH
T11BF6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-21063.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-21063.exe
Size 15.7MB
SHA256 56281a5f236bf442df6e869b656f2a6c03e81566e6e3594f22132e5601e2befb
MD5 6a3fc300f620c3b5375a8fac5cc4110b
SHA1 48743b2a109d3be35d1c816b9a8ea90785a6bed0
SHA512 1b0175cf4e722897614a4c38173fbe5910c088ff7505e48db3fb2ba80ceca21bc05752da38005819a1f335f831918074aa052cc7d8ef0e01be57136c910fda67
SSDEEP 393216:Wbntd78vYMn/R1Ft6mEeThsq6Jk2N0JsJ:Mj75M/Lb6mlj6Jk2Su
TLSH
T12BF6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-21492.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-21492.exe
Size 15.7MB
SHA256 9d2ae1feaf8e875b44b87064822727bb0eb5fba42201686d9f4c53803f712049
MD5 33b33bacaa0961f95ac093acad623dd8
SHA1 8efa32c4e2eef3b7152966be8c25398645f4b293
SHA512 d8d0945d74876049eb2f3e327897643d00b761881102285574c4231018326dd800db655998a2fab701fa617f73bfbe8205e21befd10fda3a08079282a7b60afe
SSDEEP 393216:Wbntd78v4Mn/R1Ft6mEeThsZvJk2N0JsJ:Mj7ZM/Lb6mlsvJk2Su
TLSH
T18CF6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-21969.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-21969.exe
Size 15.7MB
SHA256 b9eb68424c701acd98cff20baf5c724e71798c0da0c7fd48a4b431a664998267
MD5 cff2401e11dcbdd615843a98498ec098
SHA1 c73bc2433408b7bfc73d89c2dec6a79125fa7bc0
SHA512 7b23b41bb8f4f4b7c477530a76edba05ac78614da03bad99da942a9c7deb279705d899be9a47d79ff6fc701eece9f870245a3808b1a44983b292fcda29600dfc
SSDEEP 393216:Wbntd78vYMn/R1Ft6mEeThsq6Jk2NNJsJ:Mj75M/Lb6mlj6Jk2Tu
TLSH
T1DDF6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-22147.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-22147.exe
Size 15.7MB
SHA256 92f4b6f66bc394b5aec001886fd967e43a84247a90b34ad1be54d2304717e672
MD5 271501aeacc81bf43a5b54a16f7274a6
SHA1 a52ced0ddadefbda4a2e6fa043ad9d831d1fbc88
SHA512 f6fcc1c8c3af568e2866c648063fd501492d28e949c282008539e2f8bc156ceee23dd4f4a16e89b3f9f02439cfc8e8a582f0f4575494cd63e61ade75d5288263
SSDEEP 393216:Wbntd78v4Mn/R1Ft6mEdThsqvJc2N0JsJ:Mj7ZM/Lb6m2jvJc2Su
TLSH
T1C7F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-22489.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-22489.exe
Size 15.7MB
SHA256 f895e30d9054f52d89b224a572a68c4a7751b69810aba29736f098580cd36a67
MD5 451c4dc5f84928e0784bb51fbf0c54f1
SHA1 2b273e36b97adda94c5c4210cec986ade7ccab0b
SHA512 596dbc2b3b1740a73baf6dc26066029fcf65bba6a025520671b046f83fb2964d654b707f0ad300946c849ce35ff3767516dfd272154b1a2fa6c78d2c7ff20eb9
SSDEEP 393216:Wbntd78v4Mn/R1Ft6mEeThsqvJk2N0JsJ:Mj7ZM/Lb6mljvJk2Su
TLSH
T1C5F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-22967.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-22967.exe
Size 15.7MB
SHA256 0649affeb0cb32e13bd29c0dab66b5331956eacf484b19c44b779635f50ee0f4
MD5 1550260ec82c82cf96e4413f091a382e
SHA1 ffac186820ae3add86950150abf335d85d5b5531
SHA512 635fd3cb3619851244f3f13cee8a0a1acaba87154f62f513ecf5f645866605c2a617092e306409adac8fdcdfa0db19e324be6557f54c6e51997735c4c27a5fca
SSDEEP 393216:Wbntd78v4Mn/R1Ft6mbeThsqVJc2N0JsJ:Mj7ZM/Lb6mijVJc2Su
TLSH
T1EFF6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-27465.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-27465.exe
Size 15.7MB
SHA256 c766e876565cf67b9d999c91602afc838340f5364f026bda31918e4e2cdc9125
MD5 45dea68ab8d6207e19e3b9900a7b7f24
SHA1 a86599a0f7d63b549ac409f5936aa499675049e2
SHA512 52002215112d697bbca193dd221d380a60b20f44f5026b6316bc71f4048d0490f4d20358a08c8a5ef486ecc6d64f0714d524a8b7ed32271e3fb87b5eae118120
SSDEEP 393216:Wbntd78vDMn/R1Ft6mEeThsqvJc2N0JsJ:Mj7yM/Lb6mljvJc2Su
TLSH
T1C2F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-33596.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-33596.exe
Size 15.7MB
SHA256 e0ff53fd7673d709c62b2c47788e43b85ab8e06276c9ed7d20e98f646b5a4f7c
MD5 8eb40a2549f8ef9eb86c42a9727bdbbf
SHA1 47f5b7e5f3a3904a5b4dce9646dc4a772b93366e
SHA512 e34c97e44ac055a6946113c04d199f05d747841314620d6c42448c503925eb26de5fdf0dbc936d0e420d7c91968f8a795f1b2ed678d273f7f8cdf81ac56e0498
SSDEEP 393216:Wbntd78v4Mn/R1Ft6mEdThVqvJc2N0JsJ:Mj7ZM/Lb6m2WvJc2Su
TLSH
T1B4F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-33766.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-33766.exe
Size 15.7MB
SHA256 659f18e1dfa7e7bc61a8ce63a58e67c4a00c438ed2e0e1d884846ce4f05667f1
MD5 5d623c723ffa82194664e51a4aeb7d6b
SHA1 d1884f79497f1770f59495673c5478af7d8b6f0d
SHA512 48ae7cbc71dab7b5ebd43ef91aba7d33a8d16ee810097db22a05edc380ecb17bc03bfdc589945edb0a895147f0531aa351e39c5c03fd150d3d9514f2fde057d9
SSDEEP 393216:Wbntd7zvYMn/R1Ft6mEeThsq6tX2N0JsJ:Mj78M/Lb6mlj6tX2Su
TLSH
T1D4F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-35156.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-35156.exe
Size 15.7MB
SHA256 796b3e1cbd8a8769ef5500b7bacb2e3983f1534d0a7c91d8619c295530e8e4a1
MD5 f7842e599a04337eade29629d7c0c355
SHA1 b1dee4d23e2127a937247a946f050bf0c1a6d505
SHA512 d464e4970bf78ffbe1d7feeb4d26ce332f6ef37eb851c3fbc8971df4ae57f4734157ce3126555d50b2d30869ecffa249f66650a23c1a6c11b10a1695c635d4e4
SSDEEP 393216:Wbntd78vYMn/R1Ft6mEeThsq6Jk2NAJsJ:Mj75M/Lb6mlj6Jk2+u
TLSH
T157F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-35219.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-35219.exe
Size 15.7MB
SHA256 22e60d4890f8d87c2768d24543bbe09f0e4be947528eda8e1f9297b811be6c48
MD5 daebcfd9a4570cab35cda8eb804d0ad3
SHA1 d7ae6c1a3b3158edfa0ec9811b58123da0c3c909
SHA512 83566f98cac97e6183c3383f0ef30f2676225bc60e08df66be1a5bd41b18975b38d90dcc03ea5492fa2f37d30b1a81571f124db9840f55da13b431d77674c5fa
SSDEEP 393216:Wbntd78v4Mn/R1Ft6mEeThcq6Jk2NjJsJ:Mj7ZM/Lb6mlT6Jk2pu
TLSH
T1C5F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-3595.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-3595.exe
Size 15.7MB
SHA256 e50ed68faf8b174404b2c64b41c8b51739fefaf56d01578dc78981558596252c
MD5 4c2417867d4eb4239fd5597faa5da615
SHA1 18a0ed39e51a111b8aee78b565a9b6cbea43bbf7
SHA512 34d50b035aaee00e7bd0c639527740bb0041a23f66b9b8e8cdca0db2eb2fc075b6133fe53e81cc554f80ba66a7ce759a00bc621bd31689089a384fcaaa038c8d
SSDEEP 393216:Wbntd78vYMn/R1Ft6mEeThsQ6Jk2NAJsJ:Mj75M/Lb6mlp6Jk2+u
TLSH
T108F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-36035.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-36035.exe
Size 15.7MB
SHA256 24b81e87060181f0ec8ae995ec1c6d4f6fcc5cdefdb3a6243061484dd1443939
MD5 16b0fe623b6c6ec53bd0403173ef8abe
SHA1 9fe8ab1b7058d7f27bb501f5c28cc96e961d5506
SHA512 a131e593f2d25a97cc31aa55483e11a827c941de7afd332cbef81e802053ad17c33893603823887746fc31ed731709a753b5532b4380d775f52cc5bc78068f9f
SSDEEP 393216:Wbntd7GvYMn/R1Ft6mEeThsq6Jk2NNJsJ:Mj7DM/Lb6mlj6Jk2Tu
TLSH
T1A3F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-37196.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-37196.exe
Size 15.7MB
SHA256 2fe6231b5a63b30e7bdada5c88e659b024bb077cdb1d1aaa2c6546ad514b1cdc
MD5 a12ee57e2b54e869aa7c4aea81bc0966
SHA1 890df13a02aed5ebb8d6e480e3ffd47b7d1bab72
SHA512 f0bc24438cd19e58b6d4df0ef1fc0189feec4fe344c2fc18d824befe8df6e1c3e145ee328d69781de2a836c9d764994c59408693a6dc8b77ff34019f2619d383
SSDEEP 393216:Wbntd78vYMn/R1Ft6mEcThsq6tk2N0JsJ:Mj75M/Lb6m7j6tk2Su
TLSH
T166F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-42490.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42490.exe
Size 15.7MB
SHA256 9747f8c26806b4c68630c2f036a94c5bbc192581566ef61cc826d3bc192a932e
MD5 65e2dd0da31a2c897eae9aaf6ec0e117
SHA1 2fb0e45230c936465c6247325c8c8301180a6ba2
SHA512 51e91b81fd3ef32070771e3e895a1607646844f7e339bb918954ce822cd05071358ac4b73ede6fbb70ba339d2a77349854920f03dd120ad82898436dde466850
SSDEEP 393216:WbnNd78vYMn/R1Ft6mEeThsq6tX2N0JsJ:MD75M/Lb6mlj6tX2Su
TLSH
T152F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-44763.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-44763.exe
Size 15.7MB
SHA256 5d1ce659a47379d66f7052c34ff7796373de06b808106ef71e7f73ebe95bd75f
MD5 da8e073144c782094ce3adc16ec70cc0
SHA1 3f5481e4154660a5179775c63e35cafe45ac68dd
SHA512 8c3d22f09abdfd6c2f145c09cb7697ba1f8b92d90bc8c826b49050d59f33889806970943bc1a12e827fefb5709a6d996d79c5b94107d2a5d331c2685386e8483
SSDEEP 393216:Wbntd78v4Mn/R1Ft6mEeThsq6Jk2NCJsJ:Mj7ZM/Lb6mlj6Jk2ku
TLSH
T18FF6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-44779.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-44779.exe
Size 15.7MB
SHA256 b956dceff374ca9a481164f853a1bc48707b987050131d2c6ad817716076bf6f
MD5 bb913d5d8d6026060b9d8fbd5517fd0f
SHA1 0f481e313daa1b8b9a75f57f2a80d09a64deebfa
SHA512 51e2ee297155a9f53726c702935a9fa731fc28ce4fa610690dd1db1b332c384a7b3f6d34cc1446baa8c897c7942f58407d8c1dfb9c57840f1160c8671794f444
SSDEEP 393216:Wbntd78v4Mn/R1Ft6mEeThTZvJk2N0JsJ:Mj7ZM/Lb6ml7vJk2Su
TLSH
T193F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-45028.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-45028.exe
Size 15.7MB
SHA256 703720305723467d100e5a0c11b7a863e2671d895755e571c5e41ea680bbc65c
MD5 59c6fda4c1df59010117a550eb408f00
SHA1 37281f75ea27ac73fa62dc3b0a05e6639d6af70c
SHA512 93a9ac3fd93ce682bd8444dcab2e1901314d96dfd6e3d8adbd65a608b0b61d68c405c286f01317c94655dda0b2e76ed6854aeb5a73ca5afc58a500fecbd183fc
SSDEEP 393216:Wbntd78v6Mn/R1Ft6mEeThcq6Jk2N0JsJ:Mj7nM/Lb6mlT6Jk2Su
TLSH
T1A3F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-48892.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-48892.exe
Size 15.7MB
SHA256 9cd89140b67947772c63527f3528689e854fc1c9a18b2a60024253330600e485
MD5 28aa6a0a00bf987e760bbd1b01a50562
SHA1 c08fce3d469e8bcf8052bbcebd52cdb6de2e4e3b
SHA512 8b552f9e11384c9f607ef690ac45bcb5342f98f15dfdc4368075d7df98866083ba511d57fdc66a252d8b9daab035dfbce315a858364e3e7d40dc7793ddb71144
SSDEEP 393216:Wbntd78v4Mn/R1Ft6mEeThcq6Jk2N0JsJ:Mj7ZM/Lb6mlT6Jk2Su
TLSH
T181F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-49112.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-49112.exe
Size 15.7MB
SHA256 5b2bc48d805b199d046f1a6b29177504bd4e180ff8c3c492e2a88f790921c304
MD5 fcd7d608e60d46cc36635b347a8bffcc
SHA1 303b241716af6c157b0e52758e884299fd5b9a8f
SHA512 19a03262d5e4a735d15a9dc70a8bdcf3d2ccd07ef865b757065f6deb8181701c4c6d625c6f904c8944ecbc5f60034db5827dfcb40460c153087bd5934037adce
SSDEEP 393216:Wbntd78vYMn/R1Ft6mEeThs26Jk2NAJsJ:Mj75M/Lb6mlf6Jk2+u
TLSH
T1EEF6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-52563.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-52563.exe
Size 15.7MB
SHA256 861f49289d6717bbc6ce28c594666999012b086b1587693284196137a7f38135
MD5 600cd8bd8bfa56af01919880beb23d17
SHA1 19973bc401601d76958e53e46bd4b6b80e736825
SHA512 c80e646841f82c9799f34a6eefb1a1b55bd2473d8150483d12534b7c13310d6a2f199c709b656c6e54c17adf2227d3d2333cfba7d94dcf3dbfcf8fb46a821c01
SSDEEP 393216:Wbntd78vYMn/R1Ft6mEdThs26Jk2NAJsJ:Mj75M/Lb6mmf6Jk2+u
TLSH
T1D1F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-54607.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-54607.exe
Size 15.7MB
SHA256 da614988bc08389f0a9a44b496cbfb16d2113aa07698876d524afd1d061144cd
MD5 0f3492634187fbca0e292d48abb6d9d4
SHA1 3d1e4c1082dc461cf4d77f95689baa66f792766f
SHA512 b1913f7fe9bf1a436ce2d365063ec8c85d51413687216452b3f03f1d2cec809cb5f3a436d4aaca758d1f32ba108f32b23a24d0c5ce6d4138507eefe9327bd1c5
SSDEEP 393216:Wbntd78vYMn/R1Ft6mEeThsq6tk2N0JsJ:Mj75M/Lb6mlj6tk2Su
TLSH
T13DF6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-55578.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-55578.exe
Size 15.7MB
SHA256 e47a2493cecbae4a6682a47186708f83d4a53faf5d729f0ed25fcb9ec77f1f33
MD5 0a68d012774a9ec2ae7040d3a37acd9a
SHA1 87cd8014d415efe3319b7fd2ae1b37d035b4d8c0
SHA512 980738862138fd5bb223e2bdb39b99d5da9cfd4ae51f1771fd68952755f54477aad78c8eb9f8547653da9d1fa5a16d775953d74bd63d968243ab85bb78697030
SSDEEP 393216:Wbntd78v4Mn/R1Ft6mbeThs7vJZ2N0JsJ:Mj7ZM/Lb6miivJZ2Su
TLSH
T1DDF6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-56366.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-56366.exe
Size 15.7MB
SHA256 b1eeb38a7db50cb7cc20f506f6016175b0d4e060892b539a8219001a3d003e4b
MD5 eac9a4b0089118980e95f045187f2fbc
SHA1 09ac3500d2eb25370bab3665bba87c0a6cab8c31
SHA512 a69fa567a43e584a01c93f4477bb62add824aa4ff719ab659fea3530bd21c96b0eec92e69b255feda68103a3e8f381c0094322791dfd59a03f1d2ab4251b1b56
SSDEEP 393216:Wbntd78vYMn/R1Ft65EeThsq6tk2N0JsJ:Mj75M/Lb65lj6tk2Su
TLSH
T137F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-58172.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-58172.exe
Size 15.7MB
SHA256 2f2068a157fee7bdd8218dab83070a56b77aa5d8df048ec812d88972ecb8b0a8
MD5 341e41a2ee788c1d6b027ccc4520a77d
SHA1 8d36f149189c35ee901f27c47c6d58841081c2b7
SHA512 b32bcb2ac783001c0c607f9521cb0990df20f2766d3ef41701f0b57083b69346c4b9871b7e248626afaf67746880aec97ebc4c95613fb511c433692beba16dd4
SSDEEP 393216:Wbntd78vYMn/R1Ft6mEeThsq6tX2N0JsJ:Mj75M/Lb6mlj6tX2Su
TLSH
T125F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-59106.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-59106.exe
Size 15.7MB
SHA256 97369bf0fee133fb08ec44b59457ae4bf6e97ff04b94a46f0d99b511197cca46
MD5 e17c63cd26735e414ba2e4af73dfcbab
SHA1 8872e205665d320f619eca7d66177a45b8389a6c
SHA512 8845b8957811766435d93bac3d100161ae4519b16508b00906d6816a313fb13ed4721caebec7f3d1c8406d2eed7ca6ac1923ccf7782171c77b7ec74c3a94d9ac
SSDEEP 393216:Wbntd78v4Mn/R1Ft6mEeThsqvJc2N0JsJ:Mj7ZM/Lb6mljvJc2Su
TLSH
T1F8F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-59973.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-59973.exe
Size 15.7MB
SHA256 6026759bf59045d870bd4171bdd4f6ff50810a01184b8a31d22443500963c89e
MD5 02912efcd82fbbb7a4d866548a3aca15
SHA1 da1062eca663fff176beb4f17bb51bba2ce97ad8
SHA512 77aedd313a16421b8d0da55aef0b7df0a67d60801c9cce1071f44a4b04c49f971a637fa5846d2af936f237ef57281c94b69d183d0eec30886546c76540b1175a
SSDEEP 393216:Wbntd78vYMn/R1Fh6mEeThsq6Jk2NAJsJ:Mj75M/LX6mlj6Jk2+u
TLSH
T1D1F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-62184.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-62184.exe
Size 15.7MB
SHA256 d88475a33da9215d88af47d642d26c3f2461e2aa82c63e09c85ff8dc0bb0cf55
MD5 9b64b7890eeb835cdf0f79916c520d49
SHA1 02e9d5ed595dbc3f96fb672f82281f89d5a0849e
SHA512 5d5693ca488d333828c5b29b9cec55f9f6e0c91e93ca43b65d7116729cb59a3756d89b4a8b2d926dee6c90119d93ecce8f57f36e249703a67059b9eb8d0de3cd
SSDEEP 393216:Wbntd78v4Mn/R1Ft6mEeThsq6Jk2NNJsJ:Mj7ZM/Lb6mlj6Jk2/u
TLSH
T1D6F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-64057.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-64057.exe
Size 15.7MB
SHA256 79c1727f34303f82a9404ae55a8c21335bac41e9ec2476074318ecfdefe6f955
MD5 7e45d62f61aa28821c21a7ce1a478268
SHA1 d38bc06814312c984dcd76555affc0a7ae70f45a
SHA512 7ac089e5660c8e3fb545df4e3491e6226e4986278d251b58004aa3f1829b1ebcf3fba5002d1fd3490162906a7e3c8d7c6bbd4d6c43b568c244a792bc8839008a
SSDEEP 393216:Wbntdp8v4Mn/R1Ft6mEeThsqvJk2N0JsJ:MjpZM/Lb6mljvJk2Su
TLSH
T1A1F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-6953.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-6953.exe
Size 15.7MB
SHA256 b90e25809c25328e073527dd19bdbcffca8b3517fdf8850c79737206c162517c
MD5 8e3a05cd0d9a8e3f72fdc30ef75ec9ce
SHA1 75288a427b0ab9460a3dcb71153efefbcea6448c
SHA512 1e1c1a73d202abea4c3fb3451551d36f97e8b406de40168c3a55ce9064514fd9879c39d07d8c30f0ef818d3529c8a7c832070c1ea22526ce096898b4c168802f
SSDEEP 393216:Wbntd78v6Mn/R1Ft6mEeThcq6Jk2NAJsJ:Mj7nM/Lb6mlT6Jk2mu
TLSH
T1A5F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-8022.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-8022.exe
Size 15.7MB
SHA256 69edcd14c89bcfc42829e90fbe08f5e3e510b94a99acdaffdd55f182d0ee7257
MD5 5872ae1b91c2beb3e59f4d0fae7400e0
SHA1 c594f8ceaedc15f9b3690bd500bb0bebb2fe4559
SHA512 2acdb76d3c1b68b855e61437549c6a66f4df88633f1c979cd1239358fc9abe7794e34052881b8bd1800a88c25e97df55a0864d48ce1b7bc6f991de43f8d09991
SSDEEP 393216:Wbntd78vYMn/R1Fh6mEeThsK6Jk2NAJsJ:Mj75M/LX6mlD6Jk2+u
TLSH
T114F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-8250.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-8250.exe
Size 15.7MB
SHA256 4fc141a4ea5ff5d5f9eaa6f1bdbdfa392d519748705575cc01432c9b7b4c11ad
MD5 4a6e545e7548fcd46ff301818099ab3c
SHA1 35bad09a1e06d8dabf7e6907b2e73b5e671e7a61
SHA512 d55ac30b0cf1b09f6698b0978dc5bd2f86a2f2bf1e46a03a3518c441be3ebebfc81b75c25a989a5689c0dd14d59e3f98f43935b1176aedac584fca98f2fe551e
SSDEEP 393216:Wbntd48vYMn/R1Ft6mEeThsq6Jk2N0JsJ:Mj45M/Lb6mlj6Jk2Su
TLSH
T131F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-8991.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-8991.exe
Size 15.7MB
SHA256 8807c693e8f0b2bbfe38cf766a803fcdda18de01cb885d15daf04ea4ec4eab27
MD5 67098e6be1375b3f773e2dc295e46444
SHA1 e6ff33598b7512dd25b043df0278f2c8c24fc556
SHA512 c75a3b1ac50de6ec110f324a05c0cf78c1a4e94302c60ed56df4ed173cb32edb681b291336c9b515c3d06a9744803053e93016cba59801335c08bfbc36c25491
SSDEEP 393216:Wbntd78vYMn/R1Ft6mEeThsq6Jk2NAJHJ:Mj75M/Lb6mlj6Jk2+P
TLSH
T1DDF6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-9091.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-9091.exe
Size 15.7MB
SHA256 f28de71e0d656013413c5395f5b1e73872680e18df31502913be347d378365d4
MD5 82c8c40dd0dfbef763c75f7d709edb10
SHA1 258e04b6a372a7535b900508dec3f93c9c386dc4
SHA512 e735f2a65da0fa1bd99ecc503686bd859d136d8b4dee7f17a73dedaf407d6bcd4caeca32acea57212ee3ab5c50dbaba16c79f4a87f237736aa2a1d54571a176c
SSDEEP 393216:WbnNd7GvYMn/R1Ft6mEeThsq6tX2N0JsJ:MD7DM/Lb6mlj6tX2Su
TLSH
T1B1F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1572-704-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1680-381-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1796-437-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2128-355-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2368-784-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2432-542-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2500-737-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2596-0-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2696-600-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2940-739-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3084-738-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3484-503-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3588-891-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3916-868-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4200-836-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4536-866-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5232-869-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5436-702-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5784-577-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5836-360-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5956-835-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6732-965-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7052-1157-0x0000000000400000-0x0000000000475000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads