kawaiiunicorn | 02a7cb2e7ff8c49ffc529b8a0b2c74171ff810dc02a306f117c3d8c4ec21e0b6

Analysis

max time kernel
21s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-16_5dcb3b388ca46cf0e4b1d7221731e66b_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Size 12.9MB
Sample260716-eahc4scv8p
SHA256 02a7cb2e7ff8c49ffc529b8a0b2c74171ff810dc02a306f117c3d8c4ec21e0b6
MD5 5dcb3b388ca46cf0e4b1d7221731e66b
SHA1 75bc18c0dd85cbf39f0ff8ed15c5c4826e3bb63a
SHA512 f036fc42bd221218a7bf2d2dc821037d142443a787507a6fab7cebefecbcf3351fd3ae4696b33dc54792a9d8a2ec7cf36bc8dd9016716f620295eaa3de55d6cb
SSDEEP 196608:EP0Gi/Mn/p11fmmpLDHIWKLpqwSLTK+ZIXcB38+dXn5ZjBxcO4TTV2VNgLsJ1m+H:E8G4Mn/p1Ztn/EYTusBfJ02NzJs+
TLSH
T149D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery kawaiiunicorn trojan

Malware Config

Signatures

Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
trojan kawaiiunicorn

Detects KawaiiUnicorn 49 IoCs

resource	yara_rule
behavioral2/memory/520-0-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3880-218-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2480-202-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6124-184-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5688-310-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3888-309-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/240-336-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4644-354-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3752-371-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2036-450-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2444-582-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1260-556-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5968-699-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1876-698-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4072-697-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2340-703-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5064-701-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3124-740-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4464-732-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5160-700-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6712-964-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6464-963-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6720-959-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6452-878-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/200-762-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6348-1024-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6988-1021-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6744-1018-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7000-1017-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6500-1016-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6444-1014-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6492-1015-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6436-966-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/796-962-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6736-961-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6728-960-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7160-957-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7140-956-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1472-1095-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6824-1094-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3348-1097-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6916-1092-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6920-1093-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6960-1091-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2864-1023-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/400-1022-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6932-1020-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7020-1019-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6484-1011-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn

Custom signature

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 31 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c505-6.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000e00000001c506-11.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000e00000001c508-20.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c50b-29.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c50a-32.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c50e-44.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c50d-50.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c50c-56.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c512-80.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c513-81.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c515-84.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c514-97.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c511-105.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c516-109.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c517-100.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c50f-116.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c510-94.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c521-143.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c520-135.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c522-140.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c51d-164.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c51a-168.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c518-196.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c524-203.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c51f-213.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c51b-221.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c51e-219.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c525-216.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c523-207.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c519-191.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c564-407.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Custom signature

UPX dump on OEP (original entry point) 31 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c505-6.dat	UPX
behavioral2/files/0x000e00000001c506-11.dat	UPX
behavioral2/files/0x000e00000001c508-20.dat	UPX
behavioral2/files/0x000d00000001c50b-29.dat	UPX
behavioral2/files/0x000d00000001c50a-32.dat	UPX
behavioral2/files/0x000d00000001c50e-44.dat	UPX
behavioral2/files/0x000d00000001c50d-50.dat	UPX
behavioral2/files/0x000d00000001c50c-56.dat	UPX
behavioral2/files/0x000d00000001c512-80.dat	UPX
behavioral2/files/0x000d00000001c513-81.dat	UPX
behavioral2/files/0x000d00000001c515-84.dat	UPX
behavioral2/files/0x000d00000001c514-97.dat	UPX
behavioral2/files/0x000d00000001c511-105.dat	UPX
behavioral2/files/0x000d00000001c516-109.dat	UPX
behavioral2/files/0x000d00000001c517-100.dat	UPX
behavioral2/files/0x000d00000001c50f-116.dat	UPX
behavioral2/files/0x000d00000001c510-94.dat	UPX
behavioral2/files/0x000d00000001c521-143.dat	UPX
behavioral2/files/0x000d00000001c520-135.dat	UPX
behavioral2/files/0x000d00000001c522-140.dat	UPX
behavioral2/files/0x000d00000001c51d-164.dat	UPX
behavioral2/files/0x000d00000001c51a-168.dat	UPX
behavioral2/files/0x000d00000001c518-196.dat	UPX
behavioral2/files/0x000d00000001c524-203.dat	UPX
behavioral2/files/0x000d00000001c51f-213.dat	UPX
behavioral2/files/0x000d00000001c51b-221.dat	UPX
behavioral2/files/0x000d00000001c51e-219.dat	UPX
behavioral2/files/0x000d00000001c525-216.dat	UPX
behavioral2/files/0x000d00000001c523-207.dat	UPX
behavioral2/files/0x000d00000001c519-191.dat	UPX
behavioral2/files/0x000d00000001c564-407.dat	UPX

Executes dropped EXE 11 IoCs

pid	Process
2216	Unicorn-45445.exe
5972	Unicorn-41906.exe
2504	Unicorn-7650.exe
3504	Unicorn-889.exe
616	Unicorn-28471.exe
3240	Unicorn-35456.exe
2144	Unicorn-18797.exe
352	Unicorn-32532.exe
4656	Unicorn-19306.exe
4356	Unicorn-58201.exe
3904	Unicorn-25851.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7650.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-889.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28471.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18797.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-16_5dcb3b388ca46cf0e4b1d7221731e66b_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45445.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41906.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35456.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32532.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
520	2026-07-16_5dcb3b388ca46cf0e4b1d7221731e66b_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
2216	Unicorn-45445.exe
5972	Unicorn-41906.exe
2504	Unicorn-7650.exe
3504	Unicorn-889.exe
616	Unicorn-28471.exe
3240	Unicorn-35456.exe
2144	Unicorn-18797.exe
352	Unicorn-32532.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 520 wrote to memory of 2216	520	2026-07-16_5dcb3b388ca46cf0e4b1d7221731e66b_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe	87
PID 2216 wrote to memory of 5972	2216	Unicorn-45445.exe	88
PID 520 wrote to memory of 2504	520	2026-07-16_5dcb3b388ca46cf0e4b1d7221731e66b_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe	89
PID 5972 wrote to memory of 3504	5972	Unicorn-41906.exe	90
PID 2504 wrote to memory of 616	2504	Unicorn-7650.exe	91
PID 3504 wrote to memory of 3240	3504	Unicorn-889.exe	92
PID 2216 wrote to memory of 2144	2216	Unicorn-45445.exe	93
PID 520 wrote to memory of 352	520	2026-07-16_5dcb3b388ca46cf0e4b1d7221731e66b_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe	94
PID 3504 wrote to memory of 4356	3504	Unicorn-889.exe	96
PID 2504 wrote to memory of 4656	2504	Unicorn-7650.exe	95
PID 2144 wrote to memory of 3904	2144	Unicorn-18797.exe	98
PID 352 wrote to memory of 2464	352	Unicorn-32532.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-07-16_5dcb3b388ca46cf0e4b1d7221731e66b_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-16_5dcb3b388ca46cf0e4b1d7221731e66b_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:520
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45445.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45445.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41906.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41906.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-889.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35456.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45093.exe
        6⤵
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7846.exe
        7⤵
        
        PID:696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27647.exe
        8⤵
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47207.exe
        9⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8411.exe
        10⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52931.exe
        9⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33843.exe
        10⤵
        
        PID:9892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49389.exe
        9⤵
        
        PID:10804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53438.exe
        8⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41327.exe
        9⤵
        
        PID:7404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26042.exe
        9⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60549.exe
        8⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49527.exe
        8⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41588.exe
        7⤵
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44877.exe
        8⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61924.exe
        9⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27485.exe
        9⤵
        
        PID:9576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46719.exe
        8⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12084.exe
        9⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32445.exe
        8⤵
        
        PID:10236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22218.exe
        7⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6050.exe
        8⤵
        
        PID:8400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28858.exe
        7⤵
        
        PID:8748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30819.exe
        6⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37778.exe
        7⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21271.exe
        8⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5913.exe
        9⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62879.exe
        7⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28084.exe
        6⤵
        
        PID:476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37026.exe
        7⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8804.exe
        7⤵
        
        PID:7052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22532.exe
        6⤵
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43105.exe
        6⤵
        
        PID:6168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58201.exe
        5⤵
        Executes dropped EXE
        
        PID:4356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4639.exe
        6⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21491.exe
        7⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59931.exe
        8⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21982.exe
        9⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15168.exe
        10⤵
        
        PID:8376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11018.exe
        9⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2692.exe
        8⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39401.exe
        9⤵
        
        PID:11248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30364.exe
        8⤵
        
        PID:8812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37927.exe
        7⤵
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23653.exe
        8⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15878.exe
        9⤵
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13344.exe
        8⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36547.exe
        7⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56474.exe
        7⤵
        
        PID:11000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5901.exe
        6⤵
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53600.exe
        7⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30897.exe
        8⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60667.exe
        9⤵
        
        PID:11088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62737.exe
        8⤵
        
        PID:740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8063.exe
        7⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50609.exe
        7⤵
        
        PID:9736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13536.exe
        6⤵
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15079.exe
        7⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26625.exe
        8⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46567.exe
        7⤵
        
        PID:8660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11794.exe
        6⤵
        
        PID:7776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27829.exe
        6⤵
        
        PID:10056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6677.exe
        5⤵
        
        PID:3416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30728.exe
        6⤵
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3657.exe
        7⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36595.exe
        8⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6844.exe
        9⤵
        
        PID:8520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46787.exe
        8⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18585.exe
        8⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41534.exe
        7⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17037.exe
        8⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25483.exe
        7⤵
        
        PID:9048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7043.exe
        8⤵
        
        PID:9796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33158.exe
        6⤵
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27711.exe
        7⤵
        
        PID:1300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1284.exe
        7⤵
        
        PID:11148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43750.exe
        6⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39675.exe
        7⤵
        
        PID:10560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45922.exe
        5⤵
        
        PID:1824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22381.exe
        6⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1317.exe
        7⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19028.exe
        8⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-843.exe
        7⤵
        
        PID:9132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62256.exe
        6⤵
        
        PID:8176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6924.exe
        6⤵
        
        PID:6384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19418.exe
        5⤵
        
        PID:5000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29199.exe
        6⤵
        
        PID:10940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16462.exe
        5⤵
        
        PID:8692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47199.exe
        6⤵
        
        PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18237.exe
      4⤵
      PID:1256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28267.exe
        5⤵
        
        PID:5988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55738.exe
        6⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25848.exe
        7⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52551.exe
        8⤵
        
        PID:10920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        7⤵
        
        PID:1692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65297.exe
        6⤵
        
        PID:8184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15092.exe
        6⤵
        
        PID:1904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33847.exe
        5⤵
        
        PID:2340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3590.exe
        6⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24757.exe
        7⤵
        
        PID:1816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18901.exe
        6⤵
        
        PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35972.exe
        5⤵
        
        PID:7340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6677.exe
      4⤵
      PID:2196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27647.exe
        5⤵
        
        PID:1992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12152.exe
        6⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47877.exe
        7⤵
        
        PID:8228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31274.exe
        7⤵
        
        PID:10112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60191.exe
        6⤵
        
        PID:7336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52613.exe
        5⤵
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25893.exe
        6⤵
        
        PID:9148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30288.exe
        5⤵
        
        PID:9088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36685.exe
      4⤵
      PID:5128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37264.exe
        5⤵
        
        PID:4748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57093.exe
        6⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-729.exe
        7⤵
        
        PID:10864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27714.exe
        5⤵
        
        PID:3260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9776.exe
      4⤵
      PID:1684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38816.exe
        5⤵
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49984.exe
        6⤵
        
        PID:8652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52013.exe
        5⤵
        
        PID:8920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33577.exe
        6⤵
        
        PID:11164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29686.exe
      4⤵
      PID:6652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12236.exe
        5⤵
        
        PID:8312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62362.exe
        5⤵
        
        PID:6612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22152.exe
      4⤵
      PID:8948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37469.exe
        5⤵
        
        PID:6236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18797.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18797.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25851.exe
      4⤵
      Executes dropped EXE
      PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58994.exe
        5⤵
        
        PID:4896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35811.exe
        6⤵
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52993.exe
        7⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2490.exe
        8⤵
        
        PID:8832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53637.exe
        7⤵
        
        PID:9068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35950.exe
        6⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61790.exe
        7⤵
        
        PID:8720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62741.exe
        6⤵
        
        PID:8996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64299.exe
        5⤵
        
        PID:1000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28396.exe
        6⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7548.exe
        7⤵
        
        PID:5084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29540.exe
        6⤵
        
        PID:10332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27939.exe
        5⤵
        
        PID:7572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1959.exe
        6⤵
        
        PID:9540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58479.exe
      4⤵
      PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27647.exe
        5⤵
        
        PID:3752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59568.exe
        6⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23451.exe
        7⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5263.exe
        8⤵
        
        PID:9764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38674.exe
        7⤵
        
        PID:6656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21784.exe
        6⤵
        
        PID:8740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43132.exe
        5⤵
        
        PID:200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30695.exe
        6⤵
        
        PID:8068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46578.exe
        7⤵
        
        PID:4984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48612.exe
        6⤵
        
        PID:1232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33466.exe
        5⤵
        
        PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35404.exe
        5⤵
        
        PID:6256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47248.exe
      4⤵
      PID:2448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56143.exe
        5⤵
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49143.exe
        6⤵
        
        PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31462.exe
        5⤵
        
        PID:2924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60783.exe
      4⤵
      PID:796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23202.exe
        5⤵
        
        PID:1576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64041.exe
      4⤵
      PID:8792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42279.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42279.exe
    3⤵
    PID:5884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60062.exe
      4⤵
      PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27647.exe
        5⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63216.exe
        6⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59304.exe
        7⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40225.exe
        8⤵
        
        PID:10588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36999.exe
        6⤵
        
        PID:6828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57817.exe
        6⤵
        
        PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16437.exe
        5⤵
        
        PID:6176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64955.exe
        6⤵
        
        PID:8840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10663.exe
        5⤵
        
        PID:7920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30405.exe
      4⤵
      PID:240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64098.exe
        5⤵
        
        PID:3356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7871.exe
        6⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10482.exe
        7⤵
        
        PID:4592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20495.exe
        6⤵
        
        PID:10844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9194.exe
        5⤵
        
        PID:6916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49245.exe
        6⤵
        
        PID:11036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51444.exe
        5⤵
        
        PID:7416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25103.exe
      4⤵
      PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25329.exe
        5⤵
        
        PID:7824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62390.exe
        6⤵
        
        PID:3064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64652.exe
        5⤵
        
        PID:11156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42770.exe
      4⤵
      PID:7280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31119.exe
      4⤵
      PID:5776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60674.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60674.exe
    3⤵
    PID:4532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20614.exe
      4⤵
      PID:1348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48281.exe
        5⤵
        
        PID:1696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61400.exe
        6⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6626.exe
        7⤵
        
        PID:7476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34529.exe
        6⤵
        
        PID:8800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64477.exe
        5⤵
        
        PID:6932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50944.exe
        6⤵
        
        PID:8884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19261.exe
        5⤵
        
        PID:5376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47767.exe
      4⤵
      PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54135.exe
        5⤵
        
        PID:7536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27995.exe
        6⤵
        
        PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2374.exe
        5⤵
        
        PID:10916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10008.exe
      4⤵
      PID:7288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11683.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11683.exe
    3⤵
    PID:4284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63652.exe
      4⤵
      PID:4924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30695.exe
        5⤵
        
        PID:8052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3656.exe
        6⤵
        
        PID:6644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18710.exe
        5⤵
        
        PID:10292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31462.exe
      4⤵
      PID:7472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7268.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7268.exe
    3⤵
    PID:4240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37794.exe
      4⤵
      PID:1964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13846.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13846.exe
    3⤵
    PID:7964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44732.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44732.exe
    3⤵
    PID:6280
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7650.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7650.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28471.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28471.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51424.exe
      4⤵
      PID:1668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46741.exe
        5⤵
        
        PID:4864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11376.exe
        6⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10071.exe
        7⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53953.exe
        8⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2781.exe
        9⤵
        
        PID:8496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16809.exe
        9⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42697.exe
        8⤵
        
        PID:8440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17559.exe
        7⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45646.exe
        8⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52243.exe
        7⤵
        
        PID:8680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47741.exe
        6⤵
        
        PID:672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6117.exe
        7⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43015.exe
        8⤵
        
        PID:8620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51812.exe
        8⤵
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28092.exe
        7⤵
        
        PID:9776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44912.exe
        6⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55052.exe
        7⤵
        
        PID:11084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20884.exe
        6⤵
        
        PID:9920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39642.exe
        5⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60123.exe
        6⤵
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19382.exe
        7⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22437.exe
        8⤵
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50809.exe
        7⤵
        
        PID:2580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50663.exe
        6⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16923.exe
        7⤵
        
        PID:9096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7175.exe
        6⤵
        
        PID:9956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9644.exe
        5⤵
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2059.exe
        6⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15745.exe
        7⤵
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18698.exe
        7⤵
        
        PID:4548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59888.exe
        6⤵
        
        PID:8584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42412.exe
        5⤵
        
        PID:6996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32905.exe
      4⤵
      PID:3880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42784.exe
        5⤵
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45588.exe
        6⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4675.exe
        7⤵
        
        PID:8896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17482.exe
        6⤵
        
        PID:9192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50196.exe
        5⤵
        
        PID:4552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27061.exe
        6⤵
        
        PID:6376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37865.exe
        5⤵
        
        PID:10976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45210.exe
      4⤵
      PID:4472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45453.exe
        5⤵
        
        PID:6008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25760.exe
        6⤵
        
        PID:7328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
        6⤵
        
        PID:6304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33029.exe
        5⤵
        
        PID:4576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27993.exe
        5⤵
        
        PID:10492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20491.exe
      4⤵
      PID:1828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1172.exe
        5⤵
        
        PID:7524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32110.exe
        6⤵
        
        PID:10316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1305.exe
        5⤵
        
        PID:10504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42398.exe
      4⤵
      PID:8060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14455.exe
        5⤵
        
        PID:10832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54335.exe
      4⤵
      PID:792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19306.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19306.exe
    3⤵
    - Executes dropped EXE
    PID:4656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20976.exe
      4⤵
      PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23629.exe
        5⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18515.exe
        6⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36657.exe
        7⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58401.exe
        8⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64938.exe
        8⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43938.exe
        7⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18585.exe
        7⤵
        
        PID:7348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33449.exe
        6⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53217.exe
        7⤵
        
        PID:8240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16246.exe
        6⤵
        
        PID:8908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40065.exe
        5⤵
        
        PID:2444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2692.exe
        6⤵
        
        PID:400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12862.exe
        7⤵
        
        PID:9928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58626.exe
        6⤵
        
        PID:9548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27205.exe
        5⤵
        
        PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62794.exe
        5⤵
        
        PID:5844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22237.exe
      4⤵
      PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48089.exe
        5⤵
        
        PID:1872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29750.exe
        6⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44888.exe
        7⤵
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32069.exe
        6⤵
        
        PID:8260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48141.exe
        5⤵
        
        PID:7112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56922.exe
        6⤵
        
        PID:2492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32239.exe
        6⤵
        
        PID:1848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56735.exe
        5⤵
        
        PID:8216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60791.exe
      4⤵
      PID:1656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12256.exe
        5⤵
        
        PID:7140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35296.exe
        6⤵
        
        PID:8632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58977.exe
        5⤵
        
        PID:9884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32111.exe
      4⤵
      PID:7548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6043.exe
        5⤵
        
        PID:11100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26630.exe
      4⤵
      PID:11048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50006.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50006.exe
    3⤵
    PID:252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47508.exe
      4⤵
      PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33632.exe
        5⤵
        
        PID:7132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59390.exe
        6⤵
        
        PID:8716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57801.exe
        7⤵
        
        PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41112.exe
        5⤵
        
        PID:9140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37798.exe
      4⤵
      PID:6760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52769.exe
      4⤵
      PID:2228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29314.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29314.exe
    3⤵
    PID:3772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30462.exe
      4⤵
      PID:3332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4368.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4368.exe
    3⤵
    PID:8932
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32532.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32532.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31004.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31004.exe
    3⤵
    PID:2464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12807.exe
      4⤵
      PID:3496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48325.exe
        5⤵
        
        PID:4188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42744.exe
        6⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52931.exe
        7⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25423.exe
        8⤵
        
        PID:8816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45983.exe
        7⤵
        
        PID:4044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64176.exe
        6⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26933.exe
        7⤵
        
        PID:6640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32582.exe
        6⤵
        
        PID:6816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65107.exe
        6⤵
        
        PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11311.exe
        5⤵
        
        PID:3452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17711.exe
        6⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63497.exe
        7⤵
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11731.exe
        7⤵
        
        PID:6248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45983.exe
        6⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5073.exe
        7⤵
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60288.exe
        5⤵
        
        PID:6952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48064.exe
        6⤵
        
        PID:8868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17923.exe
        5⤵
        
        PID:8860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36627.exe
      4⤵
      PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37347.exe
        5⤵
        
        PID:1208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        6⤵
        
        PID:7688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24752.exe
        5⤵
        
        PID:7636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58736.exe
      4⤵
      PID:4524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41504.exe
        5⤵
        
        PID:7028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56201.exe
        6⤵
        
        PID:8412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5913.exe
        5⤵
        
        PID:6156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48359.exe
      4⤵
      PID:7996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19495.exe
        5⤵
        
        PID:11204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9988.exe
      4⤵
      PID:10972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54395.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54395.exe
    3⤵
    PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41034.exe
      4⤵
      PID:2548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61301.exe
        5⤵
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34073.exe
        6⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11120.exe
        7⤵
        
        PID:7208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32095.exe
        6⤵
        
        PID:6200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24513.exe
        5⤵
        
        PID:7124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8214.exe
        6⤵
        
        PID:7496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36184.exe
        5⤵
        
        PID:8760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8571.exe
      4⤵
      PID:248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26201.exe
        5⤵
        
        PID:7644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34569.exe
      4⤵
      PID:6876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8861.exe
      4⤵
      PID:7076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28873.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28873.exe
    3⤵
    PID:2544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56314.exe
      4⤵
      PID:4464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24369.exe
        5⤵
        
        PID:7424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18207.exe
        5⤵
        
        PID:10540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52765.exe
      4⤵
      PID:7676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5779.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5779.exe
    3⤵
    PID:4892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18910.exe
      4⤵
      PID:7220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42398.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42398.exe
    3⤵
    PID:8076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57621.exe
      4⤵
      PID:11040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36789.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36789.exe
    3⤵
    PID:4664
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5933.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5933.exe
  2⤵
  PID:5728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13876.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13876.exe
    3⤵
    PID:5328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2139.exe
      4⤵
      PID:3440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14347.exe
        5⤵
        
        PID:2036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45339.exe
        6⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54779.exe
        7⤵
        
        PID:8288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47611.exe
        7⤵
        
        PID:7080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54950.exe
        6⤵
        
        PID:9204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4726.exe
        5⤵
        
        PID:6920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59024.exe
        6⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47879.exe
        7⤵
        
        PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24422.exe
        5⤵
        
        PID:9040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23921.exe
      4⤵
      PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60440.exe
        5⤵
        
        PID:7888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45826.exe
        6⤵
        
        PID:10792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34034.exe
        5⤵
        
        PID:6784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18238.exe
      4⤵
      PID:4832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1625.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1625.exe
    3⤵
    PID:1380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54223.exe
      4⤵
      PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25552.exe
        5⤵
        
        PID:6348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59603.exe
        6⤵
        
        PID:9244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10687.exe
        5⤵
        
        PID:9820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22811.exe
      4⤵
      PID:7196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49540.exe
      4⤵
      PID:5312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32114.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32114.exe
    3⤵
    PID:6192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47104.exe
      4⤵
      PID:8704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10141.exe
        5⤵
        
        PID:6164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51812.exe
      4⤵
      PID:6220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34369.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34369.exe
    3⤵
    PID:8768
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22351.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22351.exe
  2⤵
  PID:4064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18476.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18476.exe
    3⤵
    PID:4068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37347.exe
      4⤵
      PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28977.exe
        5⤵
        
        PID:1472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5744.exe
        6⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47398.exe
        6⤵
        
        PID:9704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59112.exe
        5⤵
        
        PID:9176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13901.exe
      4⤵
      PID:7812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35826.exe
        5⤵
        
        PID:10652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3968.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3968.exe
    3⤵
    PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42065.exe
      4⤵
      PID:5424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34668.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34668.exe
    3⤵
    PID:8784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27459.exe
      4⤵
      PID:2588
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52517.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52517.exe
  2⤵
  PID:4496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
    3⤵
    PID:4412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26668.exe
      4⤵
      PID:6868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52418.exe
        5⤵
        
        PID:8984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40894.exe
        6⤵
        
        PID:6884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62819.exe
      4⤵
      PID:9940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40216.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40216.exe
    3⤵
    PID:7556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20813.exe
      4⤵
      PID:5528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29430.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29430.exe
    3⤵
    PID:4448
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15817.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15817.exe
  2⤵
  PID:6088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32807.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32807.exe
    3⤵
    PID:1936
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48397.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48397.exe
  2⤵
  PID:4212
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42547.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42547.exe
  2⤵
  PID:10496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-12807.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-12807.exe
Size 12.9MB
SHA256 5a8dcb50a478e62e76662c6e98aa527ce4b7973e1188fc9a38e9243583f9ccd0
MD5 5a6b2b83311d76ddaae7c8c7e91d689b
SHA1 4fe537fe143340975d19a24bd2c1675aa240cfea
SHA512 5bc45e0a399fd2726676e80c6af23e67195b4bc2a81edd02f53df4ebb2f39a211bdbd44f3eca3231dc316cc5ef770d8cd898437507371a70be0fc7dc86aaad88
SSDEEP 196608:EP0Gi/Mn/p11fmmpLiHIWKLpqwSLTK+ZIXcB38OdXJ5ZjBxcO4TTV2VNfLsJ1m+H:E8G4Mn/p1Zto/EYTusxtJ02NAJs+
TLSH
T1C2D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-13876.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-13876.exe
Size 12.9MB
SHA256 ef0d607e765b958355f0d7e6a8d2695d495cff5a9eab99cf956d4acedf87fbc8
MD5 a6a71183dc5dd6dc99501f61ce7525c2
SHA1 ef8ad5a5839a9ce63471e0e609f5c154a942a839
SHA512 fbfe319e53e1a5f0694f5f1b451ef789ed083658a57d583a3e45b55c53d10691e587d8ee9f6f6985b959a0451cabd30765f47525bb357a89a7e3ff2816df5290
SSDEEP 196608:EP0Gi/Mn/p81fmmpLDHI9KLpqwSLTK+ZIXcB38+dXn5ZjBxcO4TTV2VNgLsJ1m+H:E8G4Mn/p8ZtnoEYTusBfJ02NzJs+
TLSH
T1ECD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-18237.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-18237.exe
Size 12.9MB
SHA256 82f696ac8605472a354f91e57c4c5cc8d6544b5f98c949b5796612d194dd4fef
MD5 2c6ffa51a905a41a91fdca7b2b7e5e2c
SHA1 4629ccdac6c1d3b40a366543b3b6521edd80fc7d
SHA512 7f30bed6ef6377a6f2eb6e64a130fb1369ab0ee1c81032d92a6bdda39d2e93aff9aa236957b47c7615a5fb1c5537f355f2ada7ca683555ef714176cd43646011
SSDEEP 196608:EP0Gi/Mn/p11fmmpLDHIWKLpqwSLTK+ZIXcBP8OdXh5ZjBxcO4TTV2VNgLsJ1m+H:E8G4Mn/p1Ztn/EYTusJFJ02NzJs+
TLSH
T1F4D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-18797.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-18797.exe
Size 12.9MB
SHA256 1f112ae30b65c436f5826a46fad387624c880e35d869f3d832d5f15f444bf215
MD5 67cba10db387aff8e5da8422279cf845
SHA1 af6c111d3312686b7c55ba4518bfaec3f7de1f39
SHA512 6cf50423a3bbabc0700e537c667f8979536e52414ef4dc77b93728c189afe534e93cc3f64643ff2a7c9f56d8dfdbee165025036b2c73c1bc38dd963835f3a1b6
SSDEEP 196608:EP0Gi/Mn/p11fmmpLDHIWKLpqwSLTK+ZIXcB38OdXJ5ZjBxcO4TTV2VNgLsJ1m+H:E8G4Mn/p1Ztn/EYTusxtJ02NzJs+
TLSH
T16DD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-19306.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-19306.exe
Size 12.9MB
SHA256 a2082a5b0f617575ac781364c280ea09d4814f5151c53c50a70a97bf7c0df5b7
MD5 93cb82c998e27dc01c22f322916325c6
SHA1 29d5b544592723b1a8606d0d9ef714057b0bcd21
SHA512 795c495303c0c18ff9754f26b195d0f6f0f3a90d28dd802f2473ebd31a173208f77b48f66416107e3ea47675df353feb579b26f278d6214594e52310dd92abbd
SSDEEP 196608:EP0Gi/Mn/p11fmmpLDHIWKLpqwSLTK+ZIXqB38+dXndZjBxcO4TTV2VNgLsJ1m+H:E8G4Mn/p1Ztn/EYTu6BzJ02NzJs+
TLSH
T139D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-20976.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-20976.exe
Size 12.9MB
SHA256 9f5c375f16b9f53ed7b4de4bc0c7ac037267b494924d992181a9dc8813ddc284
MD5 e41496ba9744f80fb1a91565da0baad1
SHA1 02d0b308f6d079ae59fc48c0d8f000e62424a4b8
SHA512 39843fa1cd50924d9f2a733e41cba6d674712ae94c361bda5143926d8ea110c3401e595ed23fec4120d77917ae886ce11eec216bfbd0b5eb964962810c0223f7
SSDEEP 196608:EPWGi/Mn/p11fmmpLDHIWKLpqwSLTK+ZIXqB38+dXndZjBxcO4TTV2VNgLsJ1m+H:EuG4Mn/p1Ztn/EYTu6BzJ02NzJs+
TLSH
T1F1D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-22351.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-22351.exe
Size 12.9MB
SHA256 d67fdfda89429c01a4e7e00e11469b0d6340712e8c833c50b2bbc9f201aa3b0a
MD5 87f574b2d7702d32873b9117b45b4d0d
SHA1 70cf3700ea3e100e0a79a6ab8ad6058a2fe2d97c
SHA512 6e543fc2b2f1a8a8fecc5e00f72b40407dd32466fddfa2a7259749648372ea727ab5ef94f21f70c1018c657e3591c419433101f6d004c1757243a8e1dd2c7811
SSDEEP 196608:EP0GV/Mn/p11fmmpLDHIWKLpqwSLTK+ZIXcB38+dXn5ZjBxcO4TTV2VNgLsJ1m+H:E8GlMn/p1Ztn/EYTusBfJ02NzJs+
TLSH
T1FCD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-25851.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-25851.exe
Size 12.9MB
SHA256 a67d9c87f34bd9fb2910d53ff5b77f2a5a7fee9af8752b7d93913f98441d89bc
MD5 73fb77f7347279c452ef7eca0a701d62
SHA1 e3c21997283572821d4aecf2475c6f75e934b71b
SHA512 48ac9698a438912b958dabb4c5ad662c60c5f5da6f0caee95c81264d1597ed853646b399a81821952b3b098d82e1c4c2c34d613f607175dcc00e617d5bb756c9
SSDEEP 196608:EP0Gi/Mn/p11fmmpLDHIWKLpqwSLTK+ZIXcB38OdXJ5ZjBxcO4TTV2VNfLsJ1m+H:E8G4Mn/p1Ztn/EYTusxtJ02NAJs+
TLSH
T1BDD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-28471.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-28471.exe
Size 12.9MB
SHA256 6a991f05687ebc46676dff3ea07e3a8d5a6f318075ff0ae43f5bf8ddf3f26231
MD5 658e3b73c53d6d0e85d078ed2f89369b
SHA1 18168fa95820ebbdba7a0d7d6c4cad3f3d6088ed
SHA512 ead120e396ad6e34b2beff5796a9bb268e0e85dadae4a8c1ce2d037fcfb80fce517692a37cc36ef5d7436976c6f8f521ad9412e30fa8730509b21ddbb9080a2b
SSDEEP 196608:EP0Gi/Mn/p11fmmpLDHIWKL6qwSLTK+ZIXqB38+dXn5ZjBxcO4TTV2VNgLsJ1m+H:E8G4Mn/p1Ztn/E9Tu6BfJ02NzJs+
TLSH
T14FD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-31004.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-31004.exe
Size 12.9MB
SHA256 b0b59e4701245e086597bece397004bac5d69f73fc83b0f7310b3080b0af4fd7
MD5 3f0a6e25966bb7c0207a4661b9ae4198
SHA1 64e3146988bb8d7cc19168b8d139c2c92d8998c7
SHA512 525b51fb9c3a146f132b41e05b030282bd222659c532aa91a6299ac3243e350738a84e4687447b25ccefe3125fe0119bcf1ffd2f6fb5695ee15dd5c871083bd7
SSDEEP 196608:EP0Gi/Mn/y11fmmpLDHIWKLpqwSLTK+ZIXcB38+dXn5ZjBxcO4TTV2VNgLsJ1m+H:E8G4Mn/y1Ztn/EYTusBfJ02NzJs+
TLSH
T16BD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-32532.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-32532.exe
Size 12.9MB
SHA256 5acb92a538c67a9bea9b465f93a708c0e4de18ab2ae084e0189a4bfeb8eccd8d
MD5 7a4a2158013f8112ead74d5d677ca0b0
SHA1 1a3fbfbaa914e226300c96e14610bb1be644cbf7
SHA512 c06b07c5055c227bd368bfa6e244bc76cd2073015f9c33e55637198c5eb5bea486203943c1acf41e5aca725fb5e013b5acf055667f064356ff1edaf3e986875c
SSDEEP 196608:EP0Gi/Mn/i11fmmpLDHIWKLpqwSLTK+ZIXcB38+dXn5ZjBxcO4TTV2VNgLsJ1m+H:E8G4Mn/i1Ztn/EYTusBfJ02NzJs+
TLSH
T10AD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-32905.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-32905.exe
Size 12.9MB
SHA256 544dc263bd021b806b3b2037961ab4269f1596ebab4097b1c65a9f9311492009
MD5 2d6296c1b8f7f33f1e529e88762f85fd
SHA1 64b904adab10cc31d88c1c5d4a237b7de27aa9c2
SHA512 6a9b8a38b9bc40f8ad9ca7d45f517ea0947a09b1c1dca96ad934429a0ff3eb62dfc685b09ec1e981a7b603e166a4bba74f5df6a18771a85ca10adaba06685bef
SSDEEP 196608:EPKGi/Mn/p11fmmpLDHIWKL6qwSLTK+ZIXqB38+dXn5ZjBxcO4TTV2VNgLsJ1m+H:EyG4Mn/p1Ztn/E9Tu6BfJ02NzJs+
TLSH
T160D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-35456.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-35456.exe
Size 12.9MB
SHA256 bfbb87dbe8a6e8528107f38737f8e333cbf6ff42d670e3871c78738bba98689a
MD5 605fe77ad2c7cb23e2b484bf2574f411
SHA1 a16b1cd8682f273f0909c0b8a3232972f10ae9ea
SHA512 812dcbf7bbedd15d3739bb884c3344aca80fc44be5ef5d35a000a9a99a8b26d4df732db0f57da87106cd3fdd63510f74e77eada9dcb14c3d5847d7e0e4d06f41
SSDEEP 196608:EP0Gj/Mn/p11fmmpLDHIWKLpqwSLTK+ZwXcBP8OdXn5ZjBxcO4TTV2VNgLsJ1m+H:E8GDMn/p1Ztn/EYTmsJfJ02NzJs+
TLSH
T1C7D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-41906.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-41906.exe
Size 12.9MB
SHA256 c526a6b792fe783ee4bbbf76ef3aed097c21349da0a001bc4c31adaee65b30f3
MD5 c6c0de26405935416fadd84ebd4f5869
SHA1 a435078dfaf47bbbe724d847a372be6f64b24834
SHA512 accf996bbf9d8c1952345cfbf3cf1b9dfb397a147a39e4904c655280395d8791c722a96ffc073f99d662f21b3435d529d1f810f8cda86a77dc2f56cd68fde03b
SSDEEP 196608:EP0Gi/Mn/p11fmmpLDHIWKLpqwSLTK+ZIXcBP8OdXn5ZjBxcO4TTV2VNgLsJ1m+H:E8G4Mn/p1Ztn/EYTusJfJ02NzJs+
TLSH
T1DED6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-42279.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42279.exe
Size 12.9MB
SHA256 fe435266fea94fdc834c8947289af86952918fc6b3691ea077248ce8a7477d77
MD5 9a237e7a6e2fc95c4ec454ccb418ead4
SHA1 6ce9dcee455ec35f50a19d05c3b68ecd7983035e
SHA512 fcadbe3d33d05d93f234227e1e30f3e2e4de0c111d0c37ea8c3adfd68cdfef3898218fc3bf9bdb385b0ecedeb7794f051a01136d2b2496c6d87860d49917f099
SSDEEP 196608:EP0Gi/Mn/p11fmmpLDHIWKLpqwSLTK+ZIYcB38OdXn5ZjBxcO4TTV2VNgLsJ1m+H:E8G4Mn/p1Ztn/EYTuFxfJ02NzJs+
TLSH
T1EAD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-45093.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-45093.exe
Size 12.9MB
SHA256 804377987907e3bec3763701c03274cc3072d8c6cea7aeb05030ee472a5d7dfd
MD5 21e66f68ba8a12519d16e40392fc805f
SHA1 77e0cce51bd2118f268017ad6d7fe5cd65eb8a88
SHA512 a5a5f86aed3ac5237ce2f963f95d1e663a91205d74720286698e259f1193943369e94725fd470cea8751e604725442bc0c9c9149eca13c5992583a08e290caea
SSDEEP 196608:EP0Gj/Mn/p11fmmpLDHIWKLpqwSLTK+ZwXcBP8OdCn5ZjBxcO4TTV2VNgLsJ1m+H:E8GDMn/p1Ztn/EYTmsJoJ02NzJs+
TLSH
T144D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-45445.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-45445.exe
Size 12.9MB
SHA256 d31d21cb44090b3e74479d1ea07c94c7311efb34fd9018e976f75c2009cd33e7
MD5 aa5015239b7fee989793641345c4cce8
SHA1 7b68454949f218e7eca7404a2021e2584936a59a
SHA512 c32a85120111e47733a69e459f1f4cdf7c396964870c407cb1c386913e1603f9edd7955a353b9326b9269b8ca6c270d7ba081872b2a09ef6172e5e2f8d3d7f17
SSDEEP 196608:EP0Gi/Mn/p11fmmpLDHIWKLpqwSLTK+ZIXcB38OdXn5ZjBxcO4TTV2VNgLsJ1m+H:E8G4Mn/p1Ztn/EYTusxfJ02NzJs+
TLSH
T178D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-4639.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-4639.exe
Size 12.9MB
SHA256 203e31aacd7bf06a73566801a44c09d0122b7afbc66ce271c2a3e5eb00724397
MD5 3e35fe3a36c4738326e9d63a2da9ccc9
SHA1 55778514b70633b7eadf01d6e151f21eda47506e
SHA512 a16a0b31cd11e3cf5aefb06d92b3d605652b36c1a54cf6be1e39221a7744eb344cbe9890bbd13ab2505029ed889def99bab94c7d11585e517b3b8bb62fa0f3e2
SSDEEP 196608:EP0Gj/Mn/p11fmmpLDHIWKLpqwSLTK+ZIXcBP8OdXn5ZjBxcO4TTV2VNgLsy1m+H:E8GDMn/p1Ztn/EYTusJfJ02Nzys+
TLSH
T1D8D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-46741.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-46741.exe
Size 12.9MB
SHA256 06bfaa7eaeab671f80fe8a753db181ada33f128636a44980f36a851eed514b6e
MD5 916788f738ff6355086a9df47c419ea4
SHA1 a7967b892c504b1534713b550ce8a3d3d676c706
SHA512 2543b0be0ea95544484a7ce55172ca336f5ae18af14275ac043b9ff598d8cd3cd13de4507c3ce07eb0192911df3f92e9cd5ab45f223329af068e56cb1d349850
SSDEEP 196608:EP0Gi/Mn/p11fmmpLDHIWKL6fwSLTK+ZIXqB38+d1n5ZjBxcO4TTV2VNgLsJ1m+H:E8G4Mn/p1Ztn/EMTu6BxJ02NzJs+
TLSH
T180D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-51424.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-51424.exe
Size 12.9MB
SHA256 7e523db45a54335c2dc884d51e580007145c95db4513f319d1106cfc28aa4bfa
MD5 2beb76682abe2afdb2f9f3eea2a1c00c
SHA1 0a0feba14d037bf55cff3b43b974e37eaadbc729
SHA512 5a69c2fb1202c98e0af4ec5070ce4915f685e24ffbe48e29afd010607246e92bdf4da256bef2883b7f5b9eaddc00a0374c93e6355327985195fb23b3a322f94c
SSDEEP 196608:EP0Gi/Mn/p11fmmpLDHIWKL6fwSLTK+ZIXqB38+dXn5ZjBxcO4TTV2VNgLsJ1m+H:E8G4Mn/p1Ztn/EMTu6BfJ02NzJs+
TLSH
T14AD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-54395.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-54395.exe
Size 12.9MB
SHA256 c0bda73a392a356847404fbf99a5842f9d46abb8682162db246ebf8cd84c752a
MD5 651c8230afa17611523d9a4b4ff27f82
SHA1 dc9e05433b10f52ae7415178f9674e7396d55d74
SHA512 e4b529cb7be3a5ea42df8631e61c6dd40f39d5a0042f2cc6a8ea84aeccc7c60d18cfdf6f91253f7daed1b5888b99b7c9e14f59029063c6de2a56f1835492f367
SSDEEP 196608:EP0Gi/Mn/i11fmmpLsHIWKLpqwSLTK+ZIXcB38+dXn5ZjBxcO4TTV2VNgLsJ1m+H:E8G4Mn/i1ZtC/EYTusBfJ02NzJs+
TLSH
T167D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-58201.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-58201.exe
Size 12.9MB
SHA256 218870a54119582f8988488b16e3517aab5d461d05bbe7e7da4a4f8be94cce66
MD5 0e265972d71a5d4f73c31b3715a53058
SHA1 0b766d97dda1839d6f3d89fa261146bc35100b21
SHA512 6760e20e64e0a2787dab3869155c6dde375baa3044bd6e6bc2b52de969a4e53086a6adbecb7ae2e5dd3023366e70b6c50b12b5f2fac58b847dd68f0884e7bf89
SSDEEP 196608:EP0Gj/Mn/p11fmmpLDHIWKLpqwSLTK+ZIXcBP8OdXn5ZjBxcO4TTV2VNgLsJ1m+H:E8GDMn/p1Ztn/EYTusJfJ02NzJs+
TLSH
T160D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-58479.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-58479.exe
Size 12.9MB
SHA256 90f6ae5cecc0e8743f2dff2f18d6d2fb2151eb26f5bfa2e72a716da0de8b1082
MD5 0a73d150cc17ae21e37b1a1770c05f29
SHA1 d9e4ef9d68167e9ea65835e4d1989d15689fb64e
SHA512 2861f3a66890410dba110ffd958accc257d033208d02c7027742a5204d62ddecab4320165a358d8f5b888cb46dcbe42ccbd8bd616ea2611d41adedc61d46875d
SSDEEP 196608:EP0Gi/Mn/p11fmmpLDHIWKLpqwSLTK+ZIXYB38OdXJ5ZjBxcO4TTV2VNgLsJ1m+H:E8G4Mn/p1Ztn/EYTuIxtJ02NzJs+
TLSH
T1DFD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-5933.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-5933.exe
Size 12.9MB
SHA256 8b6cf75685eb2a46716f0101dfdf124bb47fccecd174c5994d5c68642bdc5002
MD5 a639d23e771a232f932653e36a2447c9
SHA1 e388ecd26cb3396db59a4df84d370b704e8d06c8
SHA512 1190362d7f4e9d89705c6f4d0527097f6e362dfbbe122990132278e2c47ae69752a75d0ce87c66406400b15b9ee5c3ffc5ec4afcd73c50229539fe7d2de31b97
SSDEEP 196608:EP0Gi/Mn/p11fmmpLDHI9KLpqwSLTK+ZIXcB38+dXn5ZjBxcO4TTV2VNgLsJ1m+H:E8G4Mn/p1ZtnoEYTusBfJ02NzJs+
TLSH
T132D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-60062.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-60062.exe
Size 12.9MB
SHA256 52f61c2c3f2283b6b2685135f8f0db1e4458080b6aeeef5f2b723c7f731ae2a4
MD5 fa9c89199e3c11b8909bc2a15c5fc656
SHA1 732452551316cd1d87cc3a068bce3722a109b87f
SHA512 c202e16dfcbba62e0d3500107729b1d0ccabef98b93ee0d060d406870c45fd8fe90ba3f054e64642daa28a8da64e1c6fe754c39229bf7df57fcea2ed5a31d3c4
SSDEEP 196608:EP0Gi/Mn/p11fmmpLDHIWKLpqwSLTK+ZIYcB38OdXn5ZjBxcO4TTV2VNgMsJ1m+H:E8G4Mn/p1Ztn/EYTuFxfJ02NkJs+
TLSH
T111D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-60123.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-60123.exe
Size 12.9MB
SHA256 74768d3f5c0720921cf0d2ad30fe7d1e21f97ac8cab0e1831574dcf5ede9917d
MD5 474b2c23de8fe92e7791245e7c150ea4
SHA1 249eca57b41a6b79b3d9a272f820c07815bd12b6
SHA512 8a542a41492b1e478fb0f3b32c2ac65dc5d5024e9876d36fe238b4112e5d1e9c4b4a251071bb52ece225587c6f091f56af9e2e996c263d24d25e7068170c72f6
SSDEEP 196608:PP0Gi/Mn/p11fmmpLDHIWKL6fwSLTK+ZIXqB38+dXn5ZjBxcO4TTV2VNg7sJ1m+H:P8G4Mn/p1Ztn/EMTu6BfJ02NDJs+
TLSH
T194D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-60674.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-60674.exe
Size 12.9MB
SHA256 efc64d2c95bbcb9cdc924ddbb19190f131d9950e12d47a7abfa1b2461830ea3c
MD5 0ef276cb57deb4f552f9098412a47984
SHA1 2aba8bb0880ea94bf827868ace783c28b3f44463
SHA512 acf20b03dba90f17eb5fb20cf8a6839088d9d1e3cb7fea0447a868d873d3d33c8b7300bf87fd9e8ec4a2c2148c54a87e1c2f4c737c953898d7506ceeeb0c8a03
SSDEEP 196608:EP0Gi/Mn/p11fmmpLDHIWKLpqw/LTK+ZIXcB38OdXn5ZjBxcO4TTV2VNgLsJ1m+H:E8G4Mn/p1Ztn/ElTusxfJ02NzJs+
TLSH
T175D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-6677.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-6677.exe
Size 12.9MB
SHA256 5e329264c7fb43ced3e74f680df00eb7702648b2b9052bfdc28ffc5cef0699d4
MD5 3cfcda6ca58250d3e74fb788f2aa79bc
SHA1 fc76d9257a155b05d9a266f0ec75f61ec83a05a3
SHA512 9ff145e8418ceb6119141bf8d65cb56c94378f7204f74bea0cd0c48802eed7abcfd32bbe2bb428a3772b18327273017968bf11a2aa1789e2b0d4295ca3af30b3
SSDEEP 196608:EP0Gi/Mn/p11fmmpLDHIWKLpqwSLTK+ZIXcBP8pdXn5ZjBxcO4TTV2VNgLsJ1m+H:E8G4Mn/p1Ztn/EYTusufJ02NzJs+
TLSH
T19ED6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-7650.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-7650.exe
Size 12.9MB
SHA256 33f164d08ac4b581870f37079a5f72e7d70b155223b135088bb22add7488245a
MD5 d66a564649248c4ee03ad693f1f25c0b
SHA1 f81d16e04a61376f56dd5cee4ae4278e384cdc5a
SHA512 2bb4b69f8c358367dc87a802b2e0f8b9274725947b921dba47c46e61897cde8c557b63f2057d0932bf62e6edf1ece1deb69b5c4412c6f711cb7f371ceacc691a
SSDEEP 196608:EP0Gi/Mn/p11fmmpLDHIWKLpqwSLTK+ZIXqB38+dXn5ZjBxcO4TTV2VNgLsJ1m+H:E8G4Mn/p1Ztn/EYTu6BfJ02NzJs+
TLSH
T17DD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-7846.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-7846.exe
Size 12.9MB
SHA256 72e91d0c660d41659bdf4b9d219edbbed2fde4878aea1f1d0a4f9c77c8a4bfd7
MD5 bd399ff26eeb65b8527ba8aa5e033908
SHA1 680346bca72f5f9e39d64cc0e6e2957284a0d1cf
SHA512 40c48122a27f1c98e99cc310be179e6d20495e9b8deb3f29c260bca37c5d4d238e07289bd654327e7b839497c8e78b156211076c068785b37545cf43463d355d
SSDEEP 196608:EPKGj/Mn/p11fmmpLDHIWKLpqwSLTK+ZwXcBP8OdCn5ZjBxcO4TTV2VNgLsJ1m+H:ESGDMn/p1Ztn/EYTmsJoJ02NzJs+
TLSH
T1A3D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-889.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-889.exe
Size 12.9MB
SHA256 a74da10bcd3e15af84f57acb0a562fedc75e93569c844b68c2d30b233754dee8
MD5 d9d693c77069050a9aa116a3e8416b60
SHA1 12d69ee6326ad95e81920e254cc1dd29aa132835
SHA512 c015d8c56aa07edfeb17f3f687156b672eed54b33957a83dd370bec1f41d0d409b55f4440b20c4c7bed49d864337c08b64c5f533d28644a0b709288918b6630e
SSDEEP 196608:EP0Gj/Mn/p11fmmpLDHIWKLpqwSLTK+ZIXcBP8OdXn5ZjBxcO4TTV2VNgLsJ1m+H:E8GDMn/p1Ztn/EYTusJfJ02NzJs+
TLSH
T1A8D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/200-762-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/240-336-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/400-1022-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/520-0-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/796-962-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1260-556-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1472-1095-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1876-698-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2036-450-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2340-703-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2444-582-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2480-202-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2864-1023-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3124-740-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3348-1097-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3752-371-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3880-218-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3888-309-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4072-697-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4464-732-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4644-354-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5064-701-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5160-700-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5688-310-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5968-699-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6124-184-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6348-1024-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6436-966-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6444-1014-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6452-878-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6464-963-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6484-1011-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6492-1015-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6500-1016-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6712-964-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6720-959-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6728-960-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6736-961-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6744-1018-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6824-1094-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6916-1092-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6920-1093-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6932-1020-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6960-1091-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6988-1021-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7000-1017-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7020-1019-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7140-956-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7160-957-0x0000000000400000-0x0000000000475000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads