kawaiiunicorn | f2e4f4afe4187bd5397ed0f7580a43986ae312bef8f248118b586542b5032f81

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 09:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_1731e13e8d2405ec676bc81fa1c01b06_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Size 17.7MB
Sample260723-lbcbtaba89
SHA256 f2e4f4afe4187bd5397ed0f7580a43986ae312bef8f248118b586542b5032f81
MD5 1731e13e8d2405ec676bc81fa1c01b06
SHA1 7ba58097bc82abfd47c9cc253d6fe69eb65ad84a
SHA512 509f3d6a848e104d50a32929bf857b16ef1d446f62b970bd4480342033812af72ebf99ac71e68bc64e9edb2bbe5e8117ee184b804382f6588fd426c85dee4d0d
SSDEEP 393216:+JEKUxqnvpbn7dp8v4Mn/R1FgnXEOThQrdJk2z+Js+:+tUxgv9ppZM/L2nXFudJk26Z
TLSH
T1AF170122AAA05FA5F833413407A69966D62A7C3A172047CF334CFA5B3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery kawaiiunicorn trojan

Malware Config

Signatures

Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
trojan kawaiiunicorn

Detects KawaiiUnicorn 39 IoCs

resource	yara_rule
behavioral2/memory/5048-0-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2856-164-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1692-163-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2376-267-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5428-260-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2436-650-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2736-649-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1616-648-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5740-647-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1412-646-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1808-509-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4492-508-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3676-507-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/476-506-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2532-505-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4008-504-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3148-503-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5684-502-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5624-501-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5060-688-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5628-687-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6744-860-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4352-770-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6348-772-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1244-771-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1868-736-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3136-735-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2060-734-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3424-733-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/984-732-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2724-721-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6924-887-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6644-886-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6908-874-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7036-862-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6952-857-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6936-856-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6788-854-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6932-1005-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 32 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c5df-6.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c5e0-11.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5e4-21.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5e6-35.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5e5-41.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5e7-34.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5e8-48.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5ea-66.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5eb-74.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5ec-70.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5ee-88.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5ed-82.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5e9-81.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5ef-101.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5f0-127.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5f7-140.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5f3-139.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5f4-143.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5f6-171.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5f8-167.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5fa-165.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5fb-159.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5f2-156.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5f9-177.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5f5-183.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5f1-181.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c609-246.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c603-255.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c602-256.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c608-250.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c601-210.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x0003000000008f2c-209.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

UPX dump on OEP (original entry point) 32 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c5df-6.dat	UPX
behavioral2/files/0x000d00000001c5e0-11.dat	UPX
behavioral2/files/0x000c00000001c5e4-21.dat	UPX
behavioral2/files/0x000c00000001c5e6-35.dat	UPX
behavioral2/files/0x000c00000001c5e5-41.dat	UPX
behavioral2/files/0x000c00000001c5e7-34.dat	UPX
behavioral2/files/0x000c00000001c5e8-48.dat	UPX
behavioral2/files/0x000c00000001c5ea-66.dat	UPX
behavioral2/files/0x000c00000001c5eb-74.dat	UPX
behavioral2/files/0x000c00000001c5ec-70.dat	UPX
behavioral2/files/0x000c00000001c5ee-88.dat	UPX
behavioral2/files/0x000c00000001c5ed-82.dat	UPX
behavioral2/files/0x000c00000001c5e9-81.dat	UPX
behavioral2/files/0x000c00000001c5ef-101.dat	UPX
behavioral2/files/0x000c00000001c5f0-127.dat	UPX
behavioral2/files/0x000c00000001c5f7-140.dat	UPX
behavioral2/files/0x000c00000001c5f3-139.dat	UPX
behavioral2/files/0x000c00000001c5f4-143.dat	UPX
behavioral2/files/0x000c00000001c5f6-171.dat	UPX
behavioral2/files/0x000c00000001c5f8-167.dat	UPX
behavioral2/files/0x000c00000001c5fa-165.dat	UPX
behavioral2/files/0x000c00000001c5fb-159.dat	UPX
behavioral2/files/0x000c00000001c5f2-156.dat	UPX
behavioral2/files/0x000c00000001c5f9-177.dat	UPX
behavioral2/files/0x000c00000001c5f5-183.dat	UPX
behavioral2/files/0x000c00000001c5f1-181.dat	UPX
behavioral2/files/0x000c00000001c609-246.dat	UPX
behavioral2/files/0x000c00000001c603-255.dat	UPX
behavioral2/files/0x000c00000001c602-256.dat	UPX
behavioral2/files/0x000c00000001c608-250.dat	UPX
behavioral2/files/0x000c00000001c601-210.dat	UPX
behavioral2/files/0x0003000000008f2c-209.dat	UPX

Executes dropped EXE 13 IoCs

pid	Process
2772	Unicorn-3612.exe
1260	Unicorn-25699.exe
4176	Unicorn-37628.exe
1840	Unicorn-27318.exe
1860	Unicorn-1230.exe
1180	Unicorn-30333.exe
5156	Unicorn-5360.exe
1572	Unicorn-20571.exe
712	Unicorn-7572.exe
1688	Unicorn-54727.exe
5144	Unicorn-40437.exe
1848	Unicorn-56581.exe
704	Unicorn-12211.exe

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7572.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40437.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25699.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37628.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5360.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20571.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54727.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_1731e13e8d2405ec676bc81fa1c01b06_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3612.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27318.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1230.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30333.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
5048	2026-07-23_1731e13e8d2405ec676bc81fa1c01b06_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
2772	Unicorn-3612.exe
1260	Unicorn-25699.exe
4176	Unicorn-37628.exe
1840	Unicorn-27318.exe
1860	Unicorn-1230.exe
1180	Unicorn-30333.exe
5156	Unicorn-5360.exe
1572	Unicorn-20571.exe
1688	Unicorn-54727.exe
712	Unicorn-7572.exe
5144	Unicorn-40437.exe
1848	Unicorn-56581.exe
704	Unicorn-12211.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 2772	5048	2026-07-23_1731e13e8d2405ec676bc81fa1c01b06_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe	89
PID 2772 wrote to memory of 1260	2772	Unicorn-3612.exe	90
PID 5048 wrote to memory of 4176	5048	2026-07-23_1731e13e8d2405ec676bc81fa1c01b06_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe	91
PID 4176 wrote to memory of 1840	4176	Unicorn-37628.exe	92
PID 2772 wrote to memory of 1860	2772	Unicorn-3612.exe	93
PID 1260 wrote to memory of 1180	1260	Unicorn-25699.exe	94
PID 5048 wrote to memory of 5156	5048	2026-07-23_1731e13e8d2405ec676bc81fa1c01b06_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe	95
PID 4176 wrote to memory of 1572	4176	Unicorn-37628.exe	96
PID 1840 wrote to memory of 712	1840	Unicorn-27318.exe	97
PID 2772 wrote to memory of 1688	2772	Unicorn-3612.exe	99
PID 1860 wrote to memory of 5144	1860	Unicorn-1230.exe	98
PID 1180 wrote to memory of 1848	1180	Unicorn-30333.exe	100
PID 1260 wrote to memory of 704	1260	Unicorn-25699.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-07-23_1731e13e8d2405ec676bc81fa1c01b06_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_1731e13e8d2405ec676bc81fa1c01b06_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3612.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3612.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25699.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25699.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30333.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56581.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29882.exe
        6⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5193.exe
        7⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52272.exe
        8⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5121.exe
        9⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24196.exe
        10⤵
        
        PID:8564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42565.exe
        9⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63045.exe
        8⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5986.exe
        7⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39406.exe
        8⤵
        
        PID:9076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16854.exe
        7⤵
        
        PID:6600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22135.exe
        6⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42619.exe
        7⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38394.exe
        7⤵
        
        PID:9020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7570.exe
        6⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20392.exe
        6⤵
        
        PID:9032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14100.exe
        5⤵
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19081.exe
        6⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38292.exe
        7⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61857.exe
        8⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1790.exe
        9⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11473.exe
        8⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35707.exe
        7⤵
        
        PID:6996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3050.exe
        6⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51188.exe
        7⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37812.exe
        7⤵
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2572.exe
        6⤵
        
        PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29286.exe
        5⤵
        
        PID:5352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40539.exe
        6⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13066.exe
        7⤵
        
        PID:3916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51172.exe
        6⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31487.exe
        7⤵
        
        PID:8572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24815.exe
        5⤵
        
        PID:4660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27530.exe
        6⤵
        
        PID:2652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3036.exe
        5⤵
        
        PID:2912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12211.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16406.exe
        5⤵
        
        PID:4368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28069.exe
        6⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42236.exe
        7⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57763.exe
        8⤵
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25570.exe
        7⤵
        
        PID:7492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30538.exe
        6⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51430.exe
        7⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38590.exe
        6⤵
        
        PID:8472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59599.exe
        5⤵
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59247.exe
        6⤵
        
        PID:6076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33980.exe
        5⤵
        
        PID:7016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32988.exe
      4⤵
      PID:3756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9843.exe
        5⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13875.exe
        6⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59864.exe
        7⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25978.exe
        8⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4922.exe
        9⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25409.exe
        8⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34555.exe
        7⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-502.exe
        6⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10731.exe
        7⤵
        
        PID:3704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19048.exe
        6⤵
        
        PID:7796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40.exe
        5⤵
        
        PID:2844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10663.exe
        6⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14955.exe
        7⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42797.exe
        8⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51302.exe
        7⤵
        
        PID:4124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9672.exe
        6⤵
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18376.exe
        7⤵
        
        PID:9084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26277.exe
        6⤵
        
        PID:8632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57216.exe
        5⤵
        
        PID:2444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33015.exe
        6⤵
        
        PID:2936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3092.exe
        5⤵
        
        PID:5112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48281.exe
      4⤵
      PID:4204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51613.exe
        5⤵
        
        PID:1412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34442.exe
        6⤵
        
        PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49963.exe
        5⤵
        
        PID:7332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24099.exe
      4⤵
      PID:2060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55381.exe
        5⤵
        
        PID:2140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44362.exe
      4⤵
      PID:7144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1230.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1230.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40437.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7515.exe
        5⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5193.exe
        6⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44976.exe
        7⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35781.exe
        8⤵
        
        PID:7356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1800.exe
        7⤵
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54388.exe
        6⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9221.exe
        7⤵
        
        PID:7576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21400.exe
        6⤵
        
        PID:8344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16428.exe
        5⤵
        
        PID:4920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64057.exe
        6⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20965.exe
        7⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30270.exe
        8⤵
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35541.exe
        7⤵
        
        PID:5040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        6⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3796.exe
        7⤵
        
        PID:7904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13234.exe
        6⤵
        
        PID:6420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37206.exe
        5⤵
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22086.exe
        6⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60070.exe
        7⤵
        
        PID:7284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3282.exe
        6⤵
        
        PID:8728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54156.exe
        5⤵
        
        PID:1640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54064.exe
      4⤵
      PID:2856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29889.exe
        5⤵
        
        PID:4984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29906.exe
        6⤵
        
        PID:256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25153.exe
        7⤵
        
        PID:1272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41894.exe
        8⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64055.exe
        7⤵
        
        PID:8904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36890.exe
        6⤵
        
        PID:6656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53198.exe
        6⤵
        
        PID:8764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61155.exe
        5⤵
        
        PID:6360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48469.exe
        6⤵
        
        PID:7768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62485.exe
        5⤵
        
        PID:6564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17911.exe
      4⤵
      PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2604.exe
        5⤵
        
        PID:2532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15401.exe
        6⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5848.exe
        7⤵
        
        PID:7348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53383.exe
        6⤵
        
        PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9672.exe
        5⤵
        
        PID:6240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19461.exe
        5⤵
        
        PID:7836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64560.exe
      4⤵
      PID:460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40555.exe
        5⤵
        
        PID:8296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39814.exe
      4⤵
      PID:7808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54727.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54727.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38050.exe
      4⤵
      PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49615.exe
        5⤵
        
        PID:5552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40155.exe
        6⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27016.exe
        7⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39211.exe
        8⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25567.exe
        7⤵
        
        PID:7708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1805.exe
        6⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49403.exe
        7⤵
        
        PID:7412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9313.exe
        6⤵
        
        PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe
        5⤵
        
        PID:1868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35428.exe
        6⤵
        
        PID:1100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65151.exe
        5⤵
        
        PID:3296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51217.exe
      4⤵
      PID:2668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6958.exe
        5⤵
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24987.exe
        6⤵
        
        PID:6760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        5⤵
        
        PID:8872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13792.exe
      4⤵
      PID:7000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55433.exe
        5⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2779.exe
        6⤵
        
        PID:9164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4100.exe
      4⤵
      PID:1344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47022.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47022.exe
    3⤵
    PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13927.exe
      4⤵
      PID:1972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46268.exe
        5⤵
        
        PID:3064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42688.exe
        6⤵
        
        PID:8708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41815.exe
        5⤵
        
        PID:7288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55951.exe
      4⤵
      PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25039.exe
        5⤵
        
        PID:2232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6713.exe
      4⤵
      PID:4164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48853.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48853.exe
    3⤵
    PID:6132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65235.exe
      4⤵
      PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59226.exe
        5⤵
        
        PID:2424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4730.exe
        6⤵
        
        PID:7716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29490.exe
      4⤵
      PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17388.exe
        5⤵
        
        PID:8740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27325.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27325.exe
    3⤵
    PID:2012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54652.exe
      4⤵
      PID:7424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29960.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29960.exe
    3⤵
    PID:6560
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37628.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37628.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27318.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27318.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7572.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42326.exe
        5⤵
        
        PID:2924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12858.exe
        6⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28012.exe
        7⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2682.exe
        8⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46370.exe
        9⤵
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13182.exe
        8⤵
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26864.exe
        7⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65441.exe
        8⤵
        
        PID:9140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16093.exe
        7⤵
        
        PID:8264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46849.exe
        6⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4602.exe
        7⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7885.exe
        8⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8143.exe
        7⤵
        
        PID:4312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44191.exe
        6⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16923.exe
        7⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37955.exe
        6⤵
        
        PID:7480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28680.exe
        5⤵
        
        PID:4232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8359.exe
        6⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46450.exe
        7⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30244.exe
        8⤵
        
        PID:8544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36610.exe
        7⤵
        
        PID:7232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1504.exe
        6⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16573.exe
        7⤵
        
        PID:8160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51404.exe
        5⤵
        
        PID:1948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39704.exe
        6⤵
        
        PID:7660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11701.exe
        5⤵
        
        PID:8308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18184.exe
      4⤵
      PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11633.exe
        5⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55993.exe
        6⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33285.exe
        7⤵
        
        PID:4428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30606.exe
        6⤵
        
        PID:9096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36708.exe
        5⤵
        
        PID:6812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32198.exe
        6⤵
        
        PID:9112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62768.exe
        5⤵
        
        PID:7940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46692.exe
      4⤵
      PID:1508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64550.exe
        5⤵
        
        PID:4828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32086.exe
        6⤵
        
        PID:764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57638.exe
        5⤵
        
        PID:3192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35780.exe
      4⤵
      PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-404.exe
        5⤵
        
        PID:6892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55031.exe
        6⤵
        
        PID:9104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45491.exe
      4⤵
      PID:6300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47287.exe
      4⤵
      PID:4688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40570.exe
        5⤵
        
        PID:404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53367.exe
        6⤵
        
        PID:476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38199.exe
        7⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52426.exe
        8⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18354.exe
        7⤵
        
        PID:7176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61094.exe
        6⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48669.exe
        7⤵
        
        PID:8280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51912.exe
        6⤵
        
        PID:8056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18125.exe
        5⤵
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27369.exe
        6⤵
        
        PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58872.exe
        5⤵
        
        PID:6824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7191.exe
      4⤵
      PID:1632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61535.exe
        5⤵
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32994.exe
        6⤵
        
        PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25380.exe
        5⤵
        
        PID:6508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41098.exe
      4⤵
      PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15698.exe
        5⤵
        
        PID:1452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63168.exe
        6⤵
        
        PID:9204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59755.exe
      4⤵
      PID:900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41157.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41157.exe
    3⤵
    PID:1692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53325.exe
      4⤵
      PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39574.exe
        5⤵
        
        PID:2436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43217.exe
        6⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19637.exe
        7⤵
        
        PID:3752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47060.exe
        6⤵
        
        PID:7268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-191.exe
        5⤵
        
        PID:4716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31497.exe
      4⤵
      PID:6776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60970.exe
        5⤵
        
        PID:7732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5399.exe
      4⤵
      PID:1756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36029.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36029.exe
    3⤵
    PID:4964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43637.exe
      4⤵
      PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50513.exe
        5⤵
        
        PID:6676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-923.exe
        5⤵
        
        PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7487.exe
      4⤵
      PID:6924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25776.exe
        5⤵
        
        PID:5088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3208.exe
      4⤵
      PID:4776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18671.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18671.exe
    3⤵
    PID:1244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12754.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12754.exe
    3⤵
    PID:8024
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5360.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5360.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33966.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33966.exe
    3⤵
    PID:5096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44654.exe
      4⤵
      PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50103.exe
        5⤵
        
        PID:5508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3284.exe
        6⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7389.exe
        7⤵
        
        PID:7752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36854.exe
        6⤵
        
        PID:8584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47285.exe
        5⤵
        
        PID:3336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8146.exe
      4⤵
      PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27736.exe
        5⤵
        
        PID:7128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45964.exe
        5⤵
        
        PID:7184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4720.exe
      4⤵
      PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52120.exe
        5⤵
        
        PID:2992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50895.exe
      4⤵
      PID:1428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
    3⤵
    PID:3196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30809.exe
      4⤵
      PID:3676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22688.exe
        5⤵
        
        PID:6524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53570.exe
        6⤵
        
        PID:1340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47794.exe
        5⤵
        
        PID:1168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26833.exe
      4⤵
      PID:3504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3163.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3163.exe
    3⤵
    PID:6704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38905.exe
      4⤵
      PID:8120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21400.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21400.exe
    3⤵
    PID:7648
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33701.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33701.exe
  2⤵
  PID:716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55681.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55681.exe
    3⤵
    PID:5812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63180.exe
      4⤵
      PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34561.exe
        5⤵
        
        PID:6264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34803.exe
        6⤵
        
        PID:6608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27373.exe
        5⤵
        
        PID:7784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34046.exe
      4⤵
      PID:6720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60944.exe
        5⤵
        
        PID:7840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29575.exe
      4⤵
      PID:7920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12400.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12400.exe
    3⤵
    PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29206.exe
      4⤵
      PID:7512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4820.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4820.exe
    3⤵
    PID:7368
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13165.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13165.exe
  2⤵
  PID:4500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
    3⤵
    PID:4492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19787.exe
      4⤵
      PID:3136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53082.exe
        5⤵
        
        PID:7212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9143.exe
      4⤵
      PID:7204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56221.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56221.exe
    3⤵
    PID:6660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29263.exe
      4⤵
      PID:9068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
    3⤵
    PID:7468
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7455.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7455.exe
  2⤵
  PID:984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40768.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40768.exe
    3⤵
    PID:6192
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2518.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2518.exe
  2⤵
  PID:7700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-12211.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-12211.exe
Size 17.7MB
SHA256 3c3639312dfef7c0d5b215d78b75ba2f280555df7a6f029d841e5e7d6a212b3b
MD5 4d3e422422f4c1f47b6b25ce69436122
SHA1 89bc304262c3620f0d7423b2e6ba77580b8e7e94
SHA512 2890b9369cb418cb76c541026b8aeb15e1cd772468b2ebd914bfbc38e2826ef0cb387d54c94a984533031d65ddc921d4f6f773765306a9709eae8e8213c00032
SSDEEP 393216:+JEKUxqnvpbn7dpwv4Mn/R1FgnXEOPhQrdJk2z+JsI:+tUxgv9pptM/L2nXFCdJk26b
TLSH
T101170122AAA05FA5F833413407A69966D62A7C3A172047CF334CFA5B3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-1230.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-1230.exe
Size 17.7MB
SHA256 cb4b76b3269d68340a6a1775a20095c8b3005d6ce4f6206696e5fc6745282b45
MD5 ce3354af7e0c137a5f89782af60ffbe4
SHA1 d785edc1caa2121eee3aa0ce2fabae86213504c0
SHA512 2567cb85de31672c8c1ff371d21a9bb0b3d261496888ace3b9e883a35e858a1d0228b3034d7a706bcb4a8d8d1ed46967e077169160605137b2181b21f085a940
SSDEEP 393216:+JEKUxqnvpbn7dp8v4Mn/R1FmnXEOThQrdJk2z+JsI:+tUxgv9ppZM/LQnXFudJk26b
TLSH
T1AE170122AAA05FA5F833413407A69966D62A7C3A172047CF334CFA5B3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-14100.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-14100.exe
Size 17.7MB
SHA256 50ad4831f5d6042a23e91710efb64edd314db191f542a33414b53b56ecff123c
MD5 cb4e5d2000d0443ecc28e2edd25c051c
SHA1 216295dfe57a48c5ea0eb282d2b1e032e47f9b53
SHA512 2650d4ba15aa10ce65cfb57ac54cc29db0e05b430cb0c301235cc2f632e0544e33ad2104a9037fed6482a9203a5a411132cb8c33b82ef0011236a07cec929b58
SSDEEP 393216:+JEKUxqnvpbn7dpwv4Mn/R1dgnXEOThQrdJk2z+JBI:+tUxgv9pptM/LOnXFudJk264
TLSH
T1B2170122AAA05FA5F833413407A69966D62A7C3A172047CF334CFA5B3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-16428.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-16428.exe
Size 17.7MB
SHA256 69e3f46215a52efc5854cc821fc3c5a4cf849b91354fe88a0b225d9f931a4d56
MD5 53dd64e38a905d65fa5867e1242728ff
SHA1 62f672b64d457425e87a4e0d549785a1f03c1b16
SHA512 1e2935c00c217135e005371ac424b13d554a7a90f04d9ca0ac2075e5eb5c0c1d807e5caf3b34052575496f2de068540611f5d0b7b8b4fac1c357f22c5e17d2c0
SSDEEP 393216:+JEKUxqnvpbn7dp8v4Mn/R1FmnXE1ThfrdJk2z+JsI:+tUxgv9ppZM/LQnXexdJk26b
TLSH
T1F4170122AAA05FA5F833413407A69966D62A7C3A172047CF334CFA5B3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-18184.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-18184.exe
Size 17.7MB
SHA256 4aea850eafaa5d64c034e3425b36193c969a9a58c8127b22da0627feabe335f6
MD5 3fe12487261fbfdff317df9a74aa29b4
SHA1 08b3c2c04533b02a1d6d0629d498d1fb565e11bb
SHA512 25935dbd29f3df8885189e8e64eab5b948de028355e3fec31ad136166602506340526ba298a181cdee4d6abf661143a024e52546ac05fddf9bede6229f2f82f6
SSDEEP 393216:+JEKUxqnvpbn7dp8v1Mn/R1FgnXEOThQEdJk2z+JK+:+tUxgv9ppcM/L2nXFVdJk26L
TLSH
T116170122AAA05FA5F833413407A69966D62A7C3A172047CF334CFA5B3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-19081.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-19081.exe
Size 17.7MB
SHA256 4919981262f248c7257c7ed9e7771a36fff84517be7787c169a4c5016e5095b2
MD5 747f7da745fdbade6af85aa4743a232e
SHA1 9438d8d802389a5523d65edbbf508e7044c345cb
SHA512 e94b9228403d96ff827ffbee04f0bfa1ef327a7312d797c71270ccdfabac9f6cef2f62592e61091d2b2a69a546cce9b4644de4d0d2e5baa265e10cd1d2d9d022
SSDEEP 393216:+JEKUxqnvpbnPdpwv4Mn/R1dgnXEOThQrdJk2z+JBI:+tUxgv91ptM/LOnXFudJk264
TLSH
T18A170122AAA05FA5F833413407A69966D62A7C3A172047CF334CFA5B3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-20571.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
Size 17.7MB
SHA256 adbb3e3dfce66739fe6823bc56ca6cdac980f33ba0e0eef5a08ceaf1c6877312
MD5 383c26ae8ab11cca6e225bf46bba7cd6
SHA1 989975d20499c8638fe41152df835d9415876860
SHA512 f975f7242ee91f36f1cbb18803f3c1be8e4608fbeca85c054796cb6f4a83742fe47c991f4f1413ec6222c45f7bf6071d6a502bc59f83b6e33b7e5bb867ef765b
SSDEEP 393216:+JEKUxqnvpbn7dp8v4Mn/R1FgnXEOThQ+dJk2z+JK+:+tUxgv9ppZM/L2nXFbdJk26L
TLSH
T1C9170122AAA05FA5F833413407A69966D62A7C3A172047CF334CFA5B3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-25699.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-25699.exe
Size 17.7MB
SHA256 5eb271cc61305e4a0ec9d37ebb1d749fda38de2144a50e079e959db1d1c0955d
MD5 0e80d01d392c344c7cd23b64f859a960
SHA1 cf31060da08b565b5ff4a05ec9dd0d0ee6b2b2f5
SHA512 0eb697aa78e5837fae50abc6d55d1aa83d4cd8dbd3f60bdd29e5c0e90149ef8cc8d4cb4a14f403e4ed5483ff11fd84ffe11538d7cc8a45d40bbae86042113949
SSDEEP 393216:+JEKUxqnvpbn7dpwv4Mn/R1FgnXEOThQrdJk2z+JsI:+tUxgv9pptM/L2nXFudJk26b
TLSH
T14D170122AAA05FA5F833413407A69966D62A7C3A172047CF334CFA5B3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-27318.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-27318.exe
Size 17.7MB
SHA256 e01288880bbbb9fa8e6b7a43a3692587c390676e758a7b3ddbc62a172a68024c
MD5 ebb13f5b846c2fc3b87d5b48d1c7bf36
SHA1 097888867db833600d8db2e3f49cd531be4a2f39
SHA512 67a5f70fe4708d73cd02829bd126b19589a53e4f1bd037e84117647a363e2c18bc4ef587210cd674a741f00ac22d1cd74854be131f77eeddc0be67542ec96c4c
SSDEEP 393216:+JEKUxqnvpbn7dp8v1Mn/R1FgnXEOThQrdJk2z+JK+:+tUxgv9ppcM/L2nXFudJk26L
TLSH
T11B170122AAA05FA5F833413407A69966D62A7C3A172047CF334CFA5B3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-29882.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-29882.exe
Size 17.7MB
SHA256 91fc65c52d196ca706359f38fa83cbb8f920bebb357f8e1552a3eaea2d72c638
MD5 4b23f4b0fa0920c0b3a79035ce927e16
SHA1 c5c7320810e509fc3bb3b7d21eb130731c17bfc5
SHA512 58391cd6be1aaf3958473ed96bd10a16319806d5691d90f1de0f7acc95d829cc520ae5363dec60de388a5b0c31c5bb5f2a48d92d0498aaddeadcdb10949574cc
SSDEEP 393216:+JEKUxqnvpbn7dpwv4Mn/R1dgnXEOThLrdtk2z+JsI:+tUxgv9pptM/LOnXFFdtk26b
TLSH
T152170122AAA05FA5F833413407A69966D62A7C3A172047CF334CFA5B3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-30333.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-30333.exe
Size 17.7MB
SHA256 b6e68b6de80a169ebe2f945c62003f81eea85778efec868fd1f56f45507e3bd5
MD5 faf3fc1d23315aa6738010f1f4f6e0cb
SHA1 a830da56fa76dee2288627a7db53b7dbe7534239
SHA512 bfb51eb27c775c3132f4e79ced58e335fe9314ae52d303acd4f37066bf5928e91f16129f464c80605b0b3b15f00a0f99c30eb45a58fdb665f93c913e52dbba3b
SSDEEP 393216:+JEKUxqnvpbn7dpwv4Mn/R1dgnXEOThQrdJk2z+JsI:+tUxgv9pptM/LOnXFudJk26b
TLSH
T120170122AAA05FA5F833413407A69966D62A7C3A172047CF334CFA5B3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-32988.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-32988.exe
Size 17.7MB
SHA256 8c39a2059077e0ad4776f30f8209850b94c5dc51fc009074363efd4a4695376a
MD5 b7d1706199fbf96a58a598c3d70eab52
SHA1 09d4107f5db89fecf683fb8ec40d938e5f881648
SHA512 4bad8edb51e5a5e573d79f847b864ef8639eeda0749f75d66ab9801727185731060b8e868300d4d7af03d740bdbfa1d4c4e19a1ac5d9fbf58da1d8c2c34991fb
SSDEEP 393216:+JEKUxqnvnbn7dpwv4Mn/R1FgnXEOThQrdJk2z+JsI:+tUxgvrpptM/L2nXFudJk26b
TLSH
T1EF170122AAA05FA5F833413407A69966D62A7C3A172047CF334CFA5B3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-33701.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-33701.exe
Size 17.7MB
SHA256 bb586cb6d255c775a3eb581a013852af52490fef2bc35c1407e465b297715bc5
MD5 dc208011713d0dafed1a62c84f525db5
SHA1 30161c0c357a815c04d2492d3fcc877700540277
SHA512 40c2cae62055011d5c07e3327689eecaba7c0ae5cc341236dcf20ef127eb0f92f8687767e3c1a96203eb763f434e45abd5d76746bacc6d4a5353835dc54154ef
SSDEEP 393216:+JEKUxqnvpbn7dY8v4Mn/R1FgnXEOThQrdJk2z+Js+:+tUxgv9pYZM/L2nXFudJk26Z
TLSH
T135170122AAA05FA5F833413407A69966D62A7C3A172047CF334CFA5B3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-33966.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-33966.exe
Size 17.7MB
SHA256 cb721af4ba58180d324c7ca8d5d7aa7c831ad8af0ba1a32a4a6f1664c09ae4aa
MD5 b37b740be7eff9046f1865fe4dff91cc
SHA1 2d67aedf607088c8ec0ffcd65b2ff246e0837767
SHA512 2df5682fda6d5f99df2fd1394da9009e29def718e07a9f9eca93b7dd6aa93cb115e4911638d4471a8b40c0e32644d30ea58bfb35c32caa8e9e3a4706eeee80fe
SSDEEP 393216:+JEKUxqnvpbn7dp8v4Mn/R1FgnXEzThQrdJk2zrJs+:+tUxgv9ppZM/L2nXcudJk2fZ
TLSH
T145170122AAA05FA5F833413407A69966D62A7C3A172047CF334CFA5B3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-3612.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-3612.exe
Size 17.7MB
SHA256 a45643226699a338fe52b17a1ab99baff3bf9810138ab610057417f692f88352
MD5 c2f2d66b21ef13d3607dd232d7500b0f
SHA1 e04a80940ef7f9fc50ab69d8709c3997138a9201
SHA512 1ae2eaa0c17f8477f7b82ccd9e928e47c2624da36f3e2797b9d44f294cd9afc9e821ca042278f622c9a8183770192b91ddccd36cd55ed44e276ceb62a6b3e252
SSDEEP 393216:+JEKUxqnvpbn7dp8v4Mn/R1FgnXEOThQrdJk2z+JsI:+tUxgv9ppZM/L2nXFudJk26b
TLSH
T116170122AAA05FA5F833413407A69966D62A7C3A172047CF334CFA5B3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-37628.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-37628.exe
Size 17.7MB
SHA256 eb381180ffd2bc58632cdfe42593d0552f0ad4866d082c7a0c1eb540a1689cd5
MD5 b0dd44a6a0152fb5596e525c6ab1a23c
SHA1 ae634854965e6cef1908692eeb009ab4bc6da300
SHA512 c184a64f1e31de26a99b542e51abdcfc5cc5038cb63b78f671c51c740eb039f3538ec245ffef89507e3d659e8fd4f997800ae2bc8f4964200f4306f7aa8f8985
SSDEEP 393216:+JEKUxqnvpbn7dp8v4Mn/R1FgnXEOThQrdJk2z+JK+:+tUxgv9ppZM/L2nXFudJk26L
TLSH
T1F3170122AAA05FA5F833413407A69966D62A7C3A172047CF334CFA5B3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-38050.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-38050.exe
Size 17.7MB
SHA256 7aee78960747e60be287bf5514271488ec5179431f220f1dbee4c233e33f20f8
MD5 863382a110911552027c18c7c16fe4be
SHA1 dbd2fc10d652ed4a8c5250246e5ef68f83e37abd
SHA512 99089bb07221d24c0f2c708e88e738c8ac09ad65b61148754a0f555b1f51d45c698e5205a17a2bc98d6c7fa693202e32a0d8a49f325071578abedb0ddcc99299
SSDEEP 393216:+JEKUxqnvpbn7dp8v4Mn/R1FgnXEGThwrdJk2z+JsI:+tUxgv9ppZM/L2nXNOdJk26b
TLSH
T1F2170122AAA05FA5F833413407A69966D62A7C3A172047CF334CFA5B3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-40437.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-40437.exe
Size 17.7MB
SHA256 44de4ab2d5dfdb244453312d7e8732a38c6ab370f815d7383e597883c269e473
MD5 49e17853ca7a3465d7d78a1e673684a0
SHA1 2256d22e1be05ccc84656b6a0f575a8af12b0f63
SHA512 2861ae6bc11933079c6eb6d040a5fd1463585512911e6f6a96915afbe994ce056e11563a2f9ed26e990ebcfa4d7188650d19745e37ae2e7aa42cd7237ee61eb5
SSDEEP 393216:+JEKUxqnvpbn7dp8v4Mn/R1FmnXE1ThQrdJk2z+JsI:+tUxgv9ppZM/LQnXeudJk26b
TLSH
T13B170122AAA05FA5F833413407A69966D62A7C3A172047CF334CFA5B3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-40570.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-40570.exe
Size 17.7MB
SHA256 a7fac4f7b21d4a45446d1eaa59b587bc51bca9ee259adfe90b51ae4699c29f2f
MD5 69c4ba63dbc42c803b107ec8c696edef
SHA1 5434215ea98e96008713048e67c19c79e1e2d198
SHA512 6a9e13562c3370aa17a2b54b4f6005d5eb7659e1b7c811ea110be7dcad0a645906b3849eeab2a4b767b813e6045938aa7a6368b0e56f74683b5b2f15351e7b3b
SSDEEP 393216:+JEKUxqnvpbn7dp8vxMn/R1FgnXEeThQ+dJk2z+JK+:+tUxgv9ppwM/L2nXVbdJk26L
TLSH
T192170122AAA05FA5F833413407A69966D62A7C3A172047CF334CFA5B3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-41157.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-41157.exe
Size 17.7MB
SHA256 0db59d36235aa284c19329e8dd456c024cb3f16352393eb4ef422428736739e7
MD5 35289b679ec3078055970b736ccd18ed
SHA1 00924d43553bdbd2348bbd61ca46ab08239372c0
SHA512 b8b6380157daa0829b02ef4e1a3c4190d271217cd45d68fbef0d38eb9551d58926af724f71d1d8e51e71d92695c23c64ea6484284a894c54bce11565aac32226
SSDEEP 393216:+JEKUxqnvpbn7dp8v4Mn/R1FgnXEOThQadJk2z+JK+:+tUxgv9ppZM/L2nXFHdJk26L
TLSH
T15A170122AAA05FA5F833413407A69966D62A7C3A172047CF334CFA5B3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-42326.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42326.exe
Size 17.7MB
SHA256 29766f37219a5c1d8f29e17a9c6bb3f9778aca0aded5a9f7a5ae68acaf84ba6d
MD5 c86794b3eab1f02962f2d52df36b51be
SHA1 d1bc4923209841843236319daa2a13e39f009e40
SHA512 f4d23ce0c0293fd68e99c9c0f62b2f05cc3814667ec7d216835e6f54c45356143da4dbddc59df2a96bc8098ccd4377cd5cc9545c4be49bd0223a0d7364ca4386
SSDEEP 393216:UJEKUxqnvpbn7dp8v1Mn/R1FgnXEYThQrdJk2z+JK+:UtUxgv9ppcM/L2nXfudJk26L
TLSH
T1EB170122AAA05FA5F833413407A69966D62A7C3A172047CF334CFA5B3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-44654.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-44654.exe
Size 17.7MB
SHA256 f9c71378d00d8518efa7bc87758f445bcee6945aea5517784a3a63e02c39c2d3
MD5 7cee7ab549c3fdcc5c2bd16ab6bff31e
SHA1 1720862d27a65d4f2d209ec6abf8954e8aa48c4c
SHA512 097405aa8790c850d7de0c9b987e1cf43c4368c93e14b7008d5745074a865b3ec18bc1c291c459110fa795371687a891f2d7a6aa768f843d48e7036913858357
SSDEEP 393216:+JEKUxqnvpbn7dp8v4Mn/R1FgnXEzTdQrdJk2zrJs+:+tUxgv9ppZM/L2nXcSdJk2fZ
TLSH
T1CF170122AAA05FA5F833413407A69966D62A7C3A172047CF334CFA5B3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-47022.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-47022.exe
Size 17.7MB
SHA256 a82c57a3aabb816e65908d8021622c8645ef24b4424d9ca18f739f8cb371b09a
MD5 bfb3388f8f7f0933f0cc5490779fdea6
SHA1 9a0b3da85e0b1d64871581b6a170ea0e5df8b929
SHA512 342666926a4f433ae88a377ca084c88489bb88587c18801a923223db461d0ea3234760f26c7b979c578d0a0bf714b83b5792c2fc0fec8d3ab45f7a16ec2d4f57
SSDEEP 393216:+JEKUxqnvXbn7dp8v4Mn/R1FgnXEOThQrdJk2z+JsI:+tUxgv7ppZM/L2nXFudJk26b
TLSH
T1F8170122AAA05FA5F833413407A69966D62A7C3A172047CF334CFA5B3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-47287.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-47287.exe
Size 17.7MB
SHA256 32815f8a98540da9a162e124f40b5c92c011f11705ac13cb8c951ae940903fc9
MD5 7bd15e87aa9a3dcbbcf8b96e84e94933
SHA1 5b6735d0790f312bf70b87d6803e8e5fd7824f23
SHA512 43d2b78c366a60dcca49419a9e87dc86b51bac2cb2af5fdc59f8532a0da3dbb115f2d13d5497a56f547e647ab90796103c3af346387986f5bcde8b26b1db8143
SSDEEP 393216:+JEKUxqnvpbn7dp8vxMn/R1FgnXEOThQ+dJk2z+JK+:+tUxgv9ppwM/L2nXFbdJk26L
TLSH
T1EF170122AAA05FA5F833413407A69966D62A7C3A172047CF334CFA5B3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-49615.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-49615.exe
Size 17.7MB
SHA256 273bf36c5a9249ba939e2156c71272e67729ccf7e8e50654724f3c8185ae6264
MD5 750d498fee864202ff12d6808f58ed89
SHA1 1614110bb6a160d572f6881f3475e770e743b02c
SHA512 fcda0526a56caee0b22727770dd1755bf9817da9bfa67d7732b9252e4412fe82f68eb4ac35be5c1035b1795564662fd881fb2bc2aa19626f1b7b28cae58c3023
SSDEEP 393216:+JEKUxqnvpbn7dp8v4Mn/R1FCnXEGThwrdJk2z+JsI:+tUxgv9ppZM/LUnXNOdJk26b
TLSH
T1F5170122AAA05FA5F833413407A69966D62A7C3A172047CF334CFA5B3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-5360.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-5360.exe
Size 17.7MB
SHA256 328b383c6cde03343bc850a7ae78f15f796260bd2202e7103cd3dd0a2915ffcc
MD5 9e1d5495ca0e9f7170b29c5b935c38ee
SHA1 54cbab8ee86b5e9eba7203dc62d1fdcee56cf6e3
SHA512 bddccad49bc57ee3bb986d41bcf5d38bf4901cae724f2433c2a87b9e8e7739f960bd0ff1a73f5225d554f66bf19a5887babf41f4a8c82e784013457b6958328a
SSDEEP 393216:+JEKUxqnvpbn7dp8v4Mn/R1FgnXEOThQrdJk2zrJs+:+tUxgv9ppZM/L2nXFudJk2fZ
TLSH
T11C170122AAA05FA5F833413407A69966D62A7C3A172047CF334CFA5B3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-54064.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-54064.exe
Size 17.7MB
SHA256 37809a1b923583acdc014129ac19b6e4f58ce15bd0c6822ef23d97e942c1ed31
MD5 3b9fa3361ac6038dcb74a243706652ff
SHA1 2626cfb95375e3ae93646abc5cf39610e1baa3ce
SHA512 357106ad8cb33cbc18e530d4482f2a55c12d15b5fc76e7a3383daa0079c91260b767ad3c897d8c660c71801a75d4f9bf728fe84546de1a98a46d3912f5e787ab
SSDEEP 393216:+JEKUxqnvpbnJdp8v4Mn/R1FmnXEOThQrdJk2z+JsI:+tUxgv93pZM/LQnXFudJk26b
TLSH
T190170122AAA05FA5F833413407A69966D62A7C3A172047CF334CFA5B3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-54727.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-54727.exe
Size 17.7MB
SHA256 2274ab59d06f90e18b13163f40b6d8423c0f47f961553cabb741d62a6e070d15
MD5 b6e0efe8d7c629b84ccf098a1fc468ef
SHA1 7d25e2133273f70a45c97e0d73dfc8e230575099
SHA512 8c63196c9141cd9bcfb6d65c0ef1a0c5bffa2bda5fbd8a7563e6c2363d91b0c543a35b24600b5dbec5f0274e2fc72dd0d7c6a469b76c12be29f5dab9524152f9
SSDEEP 393216:+JEKUxqnvpbn7dp8v4Mn/R1FgnXEOThwrdJk2z+JsI:+tUxgv9ppZM/L2nXFOdJk26b
TLSH
T175170122AAA05FA5F833413407A69966D62A7C3A172047CF334CFA5B3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-56581.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-56581.exe
Size 17.7MB
SHA256 935ad40b3ac4f9fc3257411d2ed6896b42e2498b2a5be0931a11968261157a2c
MD5 de112eb1128f3a774ac9fcd370043413
SHA1 923def0fd22f86630f37e365d5540fed0900fea1
SHA512 c7d3e99513f2795d38e82233fb5bfeca92ed926bdead624996d625f72c9fa04cbd1d634932542679dba1ec1b71169253a76a3122568384093b5b6f4fc44e5f18
SSDEEP 393216:+JEKUxqnvpbn7dpwv4Mn/R1dgnXEOThQrdtk2z+JsI:+tUxgv9pptM/LOnXFudtk26b
TLSH
T15A170122AAA05FA5F833413407A69966D62A7C3A172047CF334CFA5B3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-7515.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-7515.exe
Size 17.7MB
SHA256 31398ccb6092b664a0894470b86e7c02ec217ef3352901119bde09e48708035a
MD5 1fb25250cd9fbdf47652239f663c800f
SHA1 7513469c676a058f779c8e833761448ae55187d7
SHA512 875d96fc5b1db91bc635aa8c088982c6e4edc26782a74934ed74f7fac22c2c49b0c44d2382a1060f50fdc43b595df962e95130bdaadfd1860c73ded67d88b145
SSDEEP 393216:9JEKUxqnvpbn7dp8v4Mn/R1FmnXE1ThQrdJk2z+JsI:9tUxgv9ppZM/LQnXeudJk26b
TLSH
T1D8170122AAA05FA5F833413407A69966D62A7C3A172047CF334CFA5B3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-7572.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-7572.exe
Size 17.7MB
SHA256 fac517d5c491ba0fe91143d0e82ce39546c25a85da2af3c95afd76a84fde7e49
MD5 0ead9accb678fce82a07169bbef5e77c
SHA1 b14df6ed8315bfa992f0160e360bf77abd9ecc24
SHA512 8b921d8589c67637fb524e263def649b30792d8626eef32c727a94e8c816ecf55bc039e38a85c1f33956e24f24372c8b8db412cdb6e1d42f1750f45f0c93e443
SSDEEP 393216:UJEKUxqnvpbn7dp8v1Mn/R1FgnXEOThQrdJk2z+JK+:UtUxgv9ppcM/L2nXFudJk26L
TLSH
T197170122AAA05FA5F833413407A69966D62A7C3A172047CF334CFA5B3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-9843.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-9843.exe
Size 17.7MB
SHA256 3f0b5a434d02ecc4e2a2de6cfebf07244859508c2664ef4e0040217d763ceee8
MD5 8b5d008d007bd9e6b49f865c965d2f50
SHA1 f0f2d17535ff26a1f024dfd43fb40f99663cb140
SHA512 afabb8c92a8acac1a301e47b4d0e318e0932ca8b00a2e7ad57bc196e0fe3416c6be68376c5b6cff0ae8e7c905c99929411fb09bff490dade43b6ba6195fab511
SSDEEP 393216:+JUKUxqnvnbn7dpwv4Mn/R1FgnXEOThQrdJk2z+JsI:+dUxgvrpptM/L2nXFudJk26b
TLSH
T104170122AAA05FA5F833413407A69966D62A7C3A172047CF334CFA5B3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/476-506-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/984-732-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1244-771-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1412-646-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1616-648-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1692-163-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1808-509-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1868-736-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2060-734-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2376-267-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2436-650-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2532-505-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2724-721-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2736-649-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2856-164-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3136-735-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3148-503-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3424-733-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3676-507-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4008-504-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4352-770-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4492-508-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5048-0-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5060-688-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5428-260-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5624-501-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5628-687-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5684-502-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5740-647-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6348-772-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6644-886-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6744-860-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6788-854-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6908-874-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6924-887-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6932-1005-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6936-856-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6952-857-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7036-862-0x0000000000400000-0x0000000000475000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads