kawaiiunicorn | 6e8dbe15fcda3fdfaf3d257b837cece5721fede3bda0af9a6b0881ff15b7e094

Analysis

max time kernel
149s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 08:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_043f1691d5a6130b4e1e541a81d50e54_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Size 15.7MB
Sample260804-kjayaa1vfy
SHA256 6e8dbe15fcda3fdfaf3d257b837cece5721fede3bda0af9a6b0881ff15b7e094
MD5 043f1691d5a6130b4e1e541a81d50e54
SHA1 5f40df5a8eee3246d9c25743c6b28f51ac790d4b
SHA512 3fcb5757d9c7a657241d9a6f642fdfbe80d91614f23c066c288fe36a2b0fb94baea1cecfae0b24f3265b8634239656ab8c00953301f2a28364f1338a9a02f3d7
SSDEEP 393216:Wbntjt8v4Mn/R1FtnXE9ThsrtJk2ecJs+:MdtZM/LbnXmCtJk2zZ
TLSH
T11FF6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery kawaiiunicorn trojan

Malware Config

Signatures

Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
trojan kawaiiunicorn

Detects KawaiiUnicorn 43 IoCs

resource	yara_rule
behavioral2/memory/2868-0-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5652-180-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6032-179-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6012-217-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2168-216-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4760-206-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2820-400-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1168-419-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5804-485-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6112-500-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2672-418-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5924-421-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/684-401-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5812-398-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5644-397-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2668-396-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6136-395-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1412-394-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4300-531-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4792-530-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5096-627-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6148-688-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2628-687-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2188-686-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4764-685-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2112-684-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3384-683-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5920-703-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6268-702-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6812-745-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6824-747-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6788-766-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6832-746-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6688-730-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7068-894-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6904-853-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6896-852-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7036-1003-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3408-1145-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7060-1279-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7028-1456-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3152-1364-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6944-1573-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 34 IoCs

resource	yara_rule
behavioral2/files/0x000a00000001b89b-6.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000600000001b8b6-11.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000f00000001c485-18.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x001200000001c491-33.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000e00000001c493-38.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000e00000001c492-41.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c494-48.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c495-57.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c496-60.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4af-80.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4ad-89.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4ae-95.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4b0-101.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c498-91.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c497-84.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4b3-113.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4b2-141.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4b8-148.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4b4-158.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4b1-161.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4bf-155.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4ba-170.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4b5-143.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4bf-160.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4b9-186.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4c1-187.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4bb-190.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4b7-181.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4be-200.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4bd-208.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4bc-211.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4bc-205.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4c3-236.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4c4-244.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

UPX dump on OEP (original entry point) 34 IoCs

resource	yara_rule
behavioral2/files/0x000a00000001b89b-6.dat	UPX
behavioral2/files/0x000600000001b8b6-11.dat	UPX
behavioral2/files/0x000f00000001c485-18.dat	UPX
behavioral2/files/0x001200000001c491-33.dat	UPX
behavioral2/files/0x000e00000001c493-38.dat	UPX
behavioral2/files/0x000e00000001c492-41.dat	UPX
behavioral2/files/0x000d00000001c494-48.dat	UPX
behavioral2/files/0x000d00000001c495-57.dat	UPX
behavioral2/files/0x000d00000001c496-60.dat	UPX
behavioral2/files/0x000d00000001c4af-80.dat	UPX
behavioral2/files/0x000d00000001c4ad-89.dat	UPX
behavioral2/files/0x000d00000001c4ae-95.dat	UPX
behavioral2/files/0x000d00000001c4b0-101.dat	UPX
behavioral2/files/0x000d00000001c498-91.dat	UPX
behavioral2/files/0x000d00000001c497-84.dat	UPX
behavioral2/files/0x000d00000001c4b3-113.dat	UPX
behavioral2/files/0x000d00000001c4b2-141.dat	UPX
behavioral2/files/0x000d00000001c4b8-148.dat	UPX
behavioral2/files/0x000d00000001c4b4-158.dat	UPX
behavioral2/files/0x000d00000001c4b1-161.dat	UPX
behavioral2/files/0x000d00000001c4bf-155.dat	UPX
behavioral2/files/0x000d00000001c4ba-170.dat	UPX
behavioral2/files/0x000d00000001c4b5-143.dat	UPX
behavioral2/files/0x000d00000001c4bf-160.dat	UPX
behavioral2/files/0x000d00000001c4b9-186.dat	UPX
behavioral2/files/0x000d00000001c4c1-187.dat	UPX
behavioral2/files/0x000d00000001c4bb-190.dat	UPX
behavioral2/files/0x000d00000001c4b7-181.dat	UPX
behavioral2/files/0x000d00000001c4be-200.dat	UPX
behavioral2/files/0x000d00000001c4bd-208.dat	UPX
behavioral2/files/0x000d00000001c4bc-211.dat	UPX
behavioral2/files/0x000d00000001c4bc-205.dat	UPX
behavioral2/files/0x000d00000001c4c3-236.dat	UPX
behavioral2/files/0x000d00000001c4c4-244.dat	UPX

Executes dropped EXE 4 IoCs

pid	Process
2216	Unicorn-24465.exe
1232	Unicorn-12150.exe
1296	Unicorn-3468.exe
3944	Unicorn-49540.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_043f1691d5a6130b4e1e541a81d50e54_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24465.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12150.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3468.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49540.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2868	2026-08-04_043f1691d5a6130b4e1e541a81d50e54_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
2216	Unicorn-24465.exe
1232	Unicorn-12150.exe
1296	Unicorn-3468.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2216	2868	2026-08-04_043f1691d5a6130b4e1e541a81d50e54_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe	90
PID 2216 wrote to memory of 1232	2216	Unicorn-24465.exe	91
PID 2868 wrote to memory of 1296	2868	2026-08-04_043f1691d5a6130b4e1e541a81d50e54_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe	92
PID 1232 wrote to memory of 3944	1232	Unicorn-12150.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-08-04_043f1691d5a6130b4e1e541a81d50e54_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_043f1691d5a6130b4e1e541a81d50e54_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24465.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24465.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12150.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12150.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49540.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18752.exe
        5⤵
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12415.exe
        6⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26644.exe
        7⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54821.exe
        8⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17682.exe
        9⤵
        
        PID:1332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34665.exe
        8⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24051.exe
        7⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17251.exe
        8⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43083.exe
        7⤵
        
        PID:5104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19223.exe
        6⤵
        
        PID:684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43363.exe
        7⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46093.exe
        8⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31593.exe
        7⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33615.exe
        6⤵
        
        PID:3688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20716.exe
        6⤵
        
        PID:6608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11901.exe
        5⤵
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36505.exe
        6⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31220.exe
        7⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59253.exe
        8⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25366.exe
        8⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4769.exe
        7⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1624.exe
        6⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11801.exe
        7⤵
        
        PID:636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40989.exe
        7⤵
        
        PID:8096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13704.exe
        6⤵
        
        PID:2588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45642.exe
        5⤵
        
        PID:2820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11655.exe
        6⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41054.exe
        7⤵
        
        PID:1100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10799.exe
        6⤵
        
        PID:5876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13694.exe
        5⤵
        
        PID:2188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33592.exe
        6⤵
        
        PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9332.exe
        5⤵
        
        PID:5420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11138.exe
      4⤵
      PID:3360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47226.exe
        5⤵
        
        PID:832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47449.exe
        6⤵
        
        PID:3120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53451.exe
        7⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5086.exe
        8⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12515.exe
        8⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63368.exe
        7⤵
        
        PID:7660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60529.exe
        6⤵
        
        PID:7068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34664.exe
        6⤵
        
        PID:6636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8279.exe
        5⤵
        
        PID:372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62953.exe
        6⤵
        
        PID:4176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25841.exe
        6⤵
        
        PID:7156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4918.exe
        5⤵
        
        PID:7080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36446.exe
        5⤵
        
        PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46471.exe
        5⤵
        
        PID:6408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25636.exe
      4⤵
      PID:2168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13707.exe
        5⤵
        
        PID:2668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35802.exe
        6⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43555.exe
        7⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28564.exe
        8⤵
        
        PID:7960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56970.exe
        7⤵
        
        PID:6892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50498.exe
        6⤵
        
        PID:376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21065.exe
        7⤵
        
        PID:1044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54815.exe
        6⤵
        
        PID:7756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27010.exe
        5⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15818.exe
        6⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16711.exe
        7⤵
        
        PID:8108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3882.exe
        6⤵
        
        PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57518.exe
        5⤵
        
        PID:1480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64775.exe
        6⤵
        
        PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6788.exe
        5⤵
        
        PID:5264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56660.exe
      4⤵
      PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29824.exe
        5⤵
        
        PID:6536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36446.exe
        6⤵
        
        PID:1432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3522.exe
        6⤵
        
        PID:8588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12382.exe
        5⤵
        
        PID:8384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45071.exe
      4⤵
      PID:6368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3492.exe
      4⤵
      PID:7132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46011.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46011.exe
    3⤵
    PID:5764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37911.exe
      4⤵
      PID:2872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4247.exe
        5⤵
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37745.exe
        6⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17678.exe
        7⤵
        
        PID:3876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57234.exe
        8⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31058.exe
        7⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52013.exe
        7⤵
        
        PID:3844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44875.exe
        6⤵
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11541.exe
        7⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7084.exe
        8⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8158.exe
        7⤵
        
        PID:1292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2443.exe
        6⤵
        
        PID:1852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24978.exe
        5⤵
        
        PID:4696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11647.exe
        6⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7675.exe
        7⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25756.exe
        8⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43846.exe
        7⤵
        
        PID:4276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-145.exe
        6⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61168.exe
        7⤵
        
        PID:1792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20632.exe
        6⤵
        
        PID:7340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64832.exe
        5⤵
        
        PID:3608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18122.exe
        6⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3330.exe
        7⤵
        
        PID:1956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15091.exe
        6⤵
        
        PID:1280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25641.exe
        5⤵
        
        PID:6244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
        5⤵
        
        PID:4768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42627.exe
      4⤵
      PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9623.exe
        5⤵
        
        PID:4084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32455.exe
        6⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41226.exe
        7⤵
        
        PID:5564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21474.exe
        6⤵
        
        PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3248.exe
        5⤵
        
        PID:5096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25891.exe
        6⤵
        
        PID:5324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49231.exe
        5⤵
        
        PID:8000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8454.exe
      4⤵
      PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11313.exe
        5⤵
        
        PID:6744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25584.exe
      4⤵
      PID:6964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9856.exe
      4⤵
      PID:948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33726.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33726.exe
    3⤵
    PID:4292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50241.exe
      4⤵
      PID:3748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-111.exe
        5⤵
        
        PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15793.exe
        5⤵
        
        PID:2224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17655.exe
        6⤵
        
        PID:6716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43487.exe
        6⤵
        
        PID:2520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-471.exe
        5⤵
        
        PID:6800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45429.exe
        5⤵
        
        PID:5752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41506.exe
      4⤵
      PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14278.exe
        5⤵
        
        PID:4688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20011.exe
        6⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37427.exe
        7⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-346.exe
        7⤵
        
        PID:9100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52014.exe
        6⤵
        
        PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15220.exe
        5⤵
        
        PID:6924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7503.exe
        5⤵
        
        PID:2772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25444.exe
      4⤵
      PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59590.exe
        5⤵
        
        PID:6448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26384.exe
        6⤵
        
        PID:7872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52775.exe
        6⤵
        
        PID:7016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43570.exe
        5⤵
        
        PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51925.exe
      4⤵
      PID:7060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64667.exe
      4⤵
      PID:7700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1844.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1844.exe
    3⤵
    PID:6020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2379.exe
      4⤵
      PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4961.exe
        5⤵
        
        PID:6788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17853.exe
        6⤵
        
        PID:732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        5⤵
        
        PID:5088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43507.exe
      4⤵
      PID:6580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15065.exe
        5⤵
        
        PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25805.exe
        5⤵
        
        PID:2488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34747.exe
      4⤵
      PID:4828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32106.exe
      4⤵
      PID:2092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23983.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23983.exe
    3⤵
    PID:1168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60768.exe
      4⤵
      PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64749.exe
        5⤵
        
        PID:7940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56290.exe
      4⤵
      PID:2472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45691.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45691.exe
    3⤵
    PID:6884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3095.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3095.exe
    3⤵
    PID:7796
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3468.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3468.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20760.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20760.exe
    3⤵
    PID:3800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4169.exe
      4⤵
      PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17569.exe
        5⤵
        
        PID:1236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10801.exe
        6⤵
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19767.exe
        7⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55423.exe
        8⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61962.exe
        9⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41307.exe
        8⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63879.exe
        8⤵
        
        PID:8716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53347.exe
        7⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32523.exe
        8⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4929.exe
        7⤵
        
        PID:2332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62314.exe
        6⤵
        
        PID:840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60550.exe
        7⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22164.exe
        7⤵
        
        PID:7636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33856.exe
        6⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45186.exe
        6⤵
        
        PID:4236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15440.exe
        5⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44655.exe
        6⤵
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54375.exe
        7⤵
        
        PID:1336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38323.exe
        6⤵
        
        PID:7540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8043.exe
        6⤵
        
        PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61768.exe
        5⤵
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25465.exe
        6⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17505.exe
        7⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61858.exe
        6⤵
        
        PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27504.exe
        5⤵
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58999.exe
        6⤵
        
        PID:4188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32554.exe
        5⤵
        
        PID:1196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33390.exe
      4⤵
      PID:5028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-433.exe
        5⤵
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43036.exe
        6⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49565.exe
        7⤵
        
        PID:7404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49160.exe
        6⤵
        
        PID:7884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59844.exe
        5⤵
        
        PID:7036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41122.exe
        6⤵
        
        PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11644.exe
        5⤵
        
        PID:6228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
      4⤵
      PID:5924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28381.exe
        5⤵
        
        PID:6500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43238.exe
      4⤵
      PID:6204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54153.exe
      4⤵
      PID:3412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16976.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16976.exe
    3⤵
    PID:1616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21653.exe
      4⤵
      PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33552.exe
        5⤵
        
        PID:4684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19383.exe
        6⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39663.exe
        7⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59596.exe
        8⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15065.exe
        7⤵
        
        PID:3588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50223.exe
        6⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14863.exe
        7⤵
        
        PID:872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14405.exe
        6⤵
        
        PID:2372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3165.exe
        5⤵
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42844.exe
        6⤵
        
        PID:6720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28578.exe
        6⤵
        
        PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45541.exe
        5⤵
        
        PID:6920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        5⤵
        
        PID:6104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49566.exe
      4⤵
      PID:6136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39087.exe
        5⤵
        
        PID:2628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26773.exe
        6⤵
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58753.exe
        6⤵
        
        PID:8420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46201.exe
        5⤵
        
        PID:6864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57243.exe
      4⤵
      PID:3408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45621.exe
      4⤵
      PID:1344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8231.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8231.exe
    3⤵
    PID:4760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7568.exe
      4⤵
      PID:1652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12382.exe
        5⤵
        
        PID:1768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15297.exe
      4⤵
      PID:7596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9111.exe
      4⤵
      PID:8352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27880.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27880.exe
    3⤵
    PID:3340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47193.exe
      4⤵
      PID:7868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63081.exe
      4⤵
      PID:8256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41672.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41672.exe
    3⤵
    PID:6024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15798.exe
      4⤵
      PID:4208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55293.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55293.exe
    3⤵
    PID:1484
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26881.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26881.exe
  2⤵
  PID:240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36240.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36240.exe
    3⤵
    PID:5856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17569.exe
      4⤵
      PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10500.exe
        5⤵
        
        PID:4900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7514.exe
        6⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47193.exe
        7⤵
        
        PID:3676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17514.exe
        6⤵
        
        PID:7612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28798.exe
        6⤵
        
        PID:8876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49953.exe
        5⤵
        
        PID:4792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
        6⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23238.exe
        6⤵
        
        PID:2900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27471.exe
        5⤵
        
        PID:6752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29700.exe
        5⤵
        
        PID:4108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24807.exe
      4⤵
      PID:2672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38018.exe
        5⤵
        
        PID:6268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-981.exe
        6⤵
        
        PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47634.exe
        5⤵
        
        PID:6940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58892.exe
        5⤵
        
        PID:7520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25940.exe
      4⤵
      PID:6944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41604.exe
      4⤵
      PID:7100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15985.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15985.exe
    3⤵
    PID:2816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26007.exe
      4⤵
      PID:4156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62439.exe
        5⤵
        
        PID:6308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62445.exe
        6⤵
        
        PID:7564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9206.exe
        5⤵
        
        PID:2848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11053.exe
      4⤵
      PID:1776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11464.exe
        5⤵
        
        PID:904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61229.exe
      4⤵
      PID:1980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52549.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52549.exe
    3⤵
    PID:1300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46544.exe
      4⤵
      PID:6700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41822.exe
        5⤵
        
        PID:7864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7068.exe
      4⤵
      PID:476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26352.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26352.exe
    3⤵
    PID:7088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37012.exe
      4⤵
      PID:6856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19612.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19612.exe
    3⤵
    PID:4784
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34906.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34906.exe
  2⤵
  PID:3700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1040.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1040.exe
    3⤵
    PID:3472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19162.exe
      4⤵
      PID:2192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5054.exe
      4⤵
      PID:1520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64598.exe
        5⤵
        
        PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57700.exe
      4⤵
      PID:7624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27207.exe
      4⤵
      PID:8740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19716.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19716.exe
    3⤵
    PID:4480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36238.exe
      4⤵
      PID:6260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21989.exe
        5⤵
        
        PID:1904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39465.exe
      4⤵
      PID:928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63060.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63060.exe
    3⤵
    PID:2112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32502.exe
      4⤵
      PID:4680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15921.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15921.exe
    3⤵
    PID:8132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28022.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28022.exe
    3⤵
    PID:8948
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26920.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26920.exe
  2⤵
  PID:5964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33682.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33682.exe
    3⤵
    PID:1412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe
      4⤵
      PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31604.exe
        5⤵
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        6⤵
        
        PID:2392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39579.exe
        5⤵
        
        PID:2724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57623.exe
      4⤵
      PID:6688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25261.exe
      4⤵
      PID:6412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19335.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19335.exe
    3⤵
    PID:5952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11541.exe
      4⤵
      PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54287.exe
        5⤵
        
        PID:7572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11742.exe
        5⤵
        
        PID:8828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2600.exe
      4⤵
      PID:5736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50502.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50502.exe
    3⤵
    PID:6936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3532.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3532.exe
    3⤵
    PID:8060
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13452.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13452.exe
  2⤵
  PID:4476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20613.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20613.exe
    3⤵
    PID:4764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13912.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13912.exe
    3⤵
    PID:7932
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16571.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16571.exe
  2⤵
  PID:1312
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46935.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46935.exe
  2⤵
  PID:6668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-1040.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-1040.exe
Size 15.7MB
SHA256 8d3d885310c8011b3548e3e64327eead40150050d0f1f2344e42dc7fb472ed5f
MD5 2f96b0a69cee64ffe4c9986c1017dae4
SHA1 d9c7d8958cc80daba1adfcc321d4ecc87a912ffb
SHA512 256899ca16ea88ed85b054b430c2e07afb321df7ee7f74861dc9ba93f8dadc63a0c3c1a188879d8ad793b47640b2ddbac0a8ef4ff677ff98eb994ae6ede71492
SSDEEP 393216:Wbntjt8v4Mn/R1FtnoE9ThsrzJk2ecJs+:MdtZM/LbnomCzJk2zZ
TLSH
T198F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-1040.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-1040.exe
Size 13.4MB
SHA256 6755d7126cfd26008d2653b5b5c86998a2f103e43aae8ca18c6f76b7f3c2bc27
MD5 825a1a1044bd672fb2f154a98d54eb97
SHA1 191f0e5ad0c7fbdb20cc3988fb7e99566b37a762
SHA512 acc76f6f5084219ee7b7b8e2bf4dbf62651d35635cb955fbd78e0e55e8bb83efde6d240596ecaddbc1432581c22d67ed819c98ec47dbb2a8fd2803d23b54b677
SSDEEP 196608:7ibnLD9jpvqMP0vi/Mn/R15fmmpLDHxWKL6qwSLTK+ZrXcB3tTd1F5ZjBxcO4Tj0:Wbntjt8v4Mn/R1FtnoE9ThsrzJk2ew
TLSH
T1D4E6F126AAA00FA5F433813407B6C566D63A7C3A572087CF7358F65A2F732D1583E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-11138.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-11138.exe
Size 15.7MB
SHA256 2ea94ed4fb035cc5375926f91c17ff110700cd161bfd06e35b6fd05955230ffa
MD5 ee2a4ca64c4f26ba38e7a814178fce50
SHA1 6256a04d51039fde5c2605d48fe51c5334161e25
SHA512 ff9bd808dba25b15620151214f9f1d6f8bf09a10415779d0925971be982ce0157397b3f5949d25e355525da06db7841c8ff3f80257917555cb35f813d25ff16e
SSDEEP 393216:WbnFjt8v4Mn/R1stnXE9ThortJk2ecJs+:M1tZM/L0nXmGtJk2zZ
TLSH
T112F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-11901.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-11901.exe
Size 15.7MB
SHA256 03ee86ae6c4a2dd6752ed3c1d4753093f93b781470c1acaaac2b6ada52089a4a
MD5 cfb5f600f191f00ee30d2aa8b67749cd
SHA1 6522fb8dce48d192f6b7acf22757d696aa10505a
SHA512 019a13c8e7ec0ea4bb6472fdac8b3299d9fc06527fce3ad532c1dd970fa74496087a9abaa07bb52dd80255e4bf9b8fe6105613b64a136965f34a4036e63df524
SSDEEP 393216:WbnFjt8v4Mn/R1stnWE9ThErtJk2ecJs+:M1tZM/L0nWmqtJk2zZ
TLSH
T16AF6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-12150.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-12150.exe
Size 15.7MB
SHA256 ffcb808fcf2891bc0b21239f8c92f0e0d33bfe16874431c24b686cd7dba44a65
MD5 bbbaa0d3a52be6feebf879ba28d18a6b
SHA1 f46725e7c5dc8a3ea0f2c37984c2dd7ea358cb31
SHA512 b1d640e5651265e8150332d93860165dc35505f2779c6088c4c8f7a768ea7ec4963c1d1f455f6a7753851537cd2c52fe1526145b88967648c86226917e0239dd
SSDEEP 393216:WbnFjt8v4Mn/R1stnXE9ThsrtJk2ecJs+:M1tZM/L0nXmCtJk2zZ
TLSH
T196F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-12415.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-12415.exe
Size 15.7MB
SHA256 c8d2994b1e7349f13ed85fb4f6160eec1aff4a3b69ac732549467196c06e7f15
MD5 8ae2dbfb1243235a1bbc31c5ed25e581
SHA1 8359d6ec5174ca108db439f75125da58925959af
SHA512 ae2001f2e277d4bcd460569349e706ca34686c908ea6794bdc3f2987772d12b5ce08541f03c9c9414e0633ebfbdb75b023758dec4b845b1ad33bf6756bd3b6c7
SSDEEP 393216:WbnNjthv4Mn/R1stnWE9ThsrtJk2ecJs+:M9tKM/L0nWmCtJk2zZ
TLSH
T1B0F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-15985.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-15985.exe
Size 15.7MB
SHA256 8dabccad0997e3ef126fc17eb4de54e3779d26297c05259e158d6d58b6d40915
MD5 19e55b51cf905e5d93661a19c3a3f2e2
SHA1 a1111a88280cc1c63bada6b8777a21273541e462
SHA512 fc2a301954a89b23eb3c4a41cbd439dfe0c6a2ee4e2572c4269c2c5f6e83c0b359e6698fda5cfebd74388fe9a7b3dd6bbdfb3485ddef5c8ac082537622153f46
SSDEEP 393216:Wbntjt8vfMn/R1FtnXE9ThsTtJk2ecJs+:MdtOM/LbnXmatJk2zZ
TLSH
T1DFF6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-16976.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-16976.exe
Size 15.7MB
SHA256 f816cdcd981764eb194bd53cdfb2c5373ca18ff18a7ad39c979168168244a619
MD5 4920bc95be2faf2eea29a5577e78aa60
SHA1 e270b6535cacad002fcca178346b788210613bfa
SHA512 befb84815dc1ae95103596d9e34ff88bebd83158b60b84f28a8c810a25ff48d9ae131d9ebd663a14874e1478c7c7501d86b69b2aa91b74b73ccc3764f535ba6a
SSDEEP 393216:Wbntjt8v4Mn/R1FtnXETThsdtJk2ecJs+:MdtZM/LbnXUYtJk2zZ
TLSH
T197F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-17569.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-17569.exe
Size 15.7MB
SHA256 299c728d8e4e0a5b4f405477a04d01ce02c01f1d1eca6b42a30f6d1dc37e92c2
MD5 90bb8b20dd55b3993ffc96cd8e4011ad
SHA1 f1e317e9bad3b7510b4c3637ed7bcb3d281dd915
SHA512 9bbc0dbde283b2517e044ab61eedef676951456a9e03180d13ee5222372cc4ccad4c6afb24ecc897d2bc3cc94d544fc39c27a3fe4e4cbe959cd87aa33c47af0c
SSDEEP 393216:Wbntjt8vfMn/R1FtnXEHThsrtJk2eHJs+:MdtOM/LbnX4CtJk2QZ
TLSH
T176F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-1844.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-1844.exe
Size 15.7MB
SHA256 45b0f481e8182e9bf0351a8192496c9c341102ceaf14babf62d6631ca05df61f
MD5 56483ab6e2b38c3b01cba28c7f4310e9
SHA1 87be3eb4942106b3af800ed396d7112378f05be7
SHA512 f6c4b79259c917642a0e03092056e7269a670416f809b5ae5e1ce22205050ddc4d7f2ab1faa8af530cf282ab6b8bcf9cc9a3420c5b5ea1f377eec5e80d4527d3
SSDEEP 393216:Wbntjt8o4Mn/R1stnXE9ThsrtJk2ecJs+:MdtKM/L0nXmCtJk2zZ
TLSH
T1DCF6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-18752.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-18752.exe
Size 15.7MB
SHA256 404faf391166dd1ad9e357630aeb1347f6d97f522531259f0067edcb313760be
MD5 304705439db97bb483043c7a0cca7fb8
SHA1 86fd1d7e0b502dddfa7aa92feb81d45f32458175
SHA512 7664d176828e1948a875c07345dfdee01f10c9fe960f2eba22625025bf4d3185136a8b50b4b32dc9c0c61cba3895f7094db14671a97168c0b404319e7940a4db
SSDEEP 393216:WbnFjthv4Mn/R1stnWE9ThsrtJk2ecJs+:M1tKM/L0nWmCtJk2zZ
TLSH
T1C0F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-20760.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-20760.exe
Size 15.7MB
SHA256 e73e4594d4668009149ff3992cd105d2f18874ef88449bd7b1eedc6142f6f8bc
MD5 ee5c91c05253eda2834ed901df8da618
SHA1 33d52004e0f20be0fdadcf4261beb51fbb71ab40
SHA512 0c37ff73d12010fd90f5fb3eb4fbb83e2cc325aa226994fb48eb5bc31ec865e15c8d85f574cf13b6daf97d55dec476c3f4c78897c7cffdf696602089f1344b9a
SSDEEP 393216:Wbntjt8vVMn/R1FtnXETThsrtJk2ecJs+:Mdt8M/LbnXUCtJk2zZ
TLSH
T1DDF6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-21653.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-21653.exe
Size 15.7MB
SHA256 5f331a64bd4aeeaa4b3ffd6cec93635d80c9e672179616e675a60abea632a295
MD5 4319a567a563ca651190c49a95df55f4
SHA1 36c862129edc3cc635c9583ec34e2060e2a4b535
SHA512 8b4fc3c02ce488780251610525452da754f7d7170118a5ded7780803fc9066340860767cc03f91d5e09d2d9066ee983d75f563dbe948e23ed99f8722ed78bf38
SSDEEP 393216:Wbntjt8vDMn/R1FtnXETThsdtJk2ecJs+:MdtKM/LbnXUYtJk2zZ
TLSH
T124F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-24465.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-24465.exe
Size 15.7MB
SHA256 99e89c8599faaffa56fc01e7792961ba2b47cbd35c7009968a727f4e70c3b2c6
MD5 df8ae12fec8f9f6a881396b51d334ca6
SHA1 b9ff1f9a072bebf73b4c9cbdd5d4611f1c6b9307
SHA512 4de3202f152e024d5b510b47dc0156bd939844475bc9d6f7c97ad351db9546ba6529536312fc92e1c05ef4a9f482ee6cc7e90bc9d3825c22e6410e263d65b591
SSDEEP 393216:Wbntjt8v4Mn/R1stnXE9ThsrtJk2ecJs+:MdtZM/L0nXmCtJk2zZ
TLSH
T1C9F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-25636.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-25636.exe
Size 15.7MB
SHA256 27b9310e17753175581e422ebd034888d559b128efc59cad351fad53cbe41fc5
MD5 719c0707c66f7c88c045c70e2869ac7c
SHA1 fffabff36b078b5e96c3e2a357d66130e8a01428
SHA512 b5320ac6bd34c3eace3ab32fc0ff0a81c8cb2b5bbe706a868499a9b3d16436976a61f88011f4a67124dd4c26608938e22973f230ae862eea17f0e17917d5e531
SSDEEP 393216:WbnFjtZv4Mn/R1stnXE9ThsrtJk2ecJs+:M1tSM/L0nXmCtJk2zZ
TLSH
T157F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-26881.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-26881.exe
Size 15.7MB
SHA256 a2c203123d4c41b4bec1d251ffe4c09de63c878e996f782f3a151b4685934845
MD5 1844f8de510317be2d4db10492d1e474
SHA1 f63a0f398a553c1b69748337ddc20503ed08d750
SHA512 494ddd7e57dab3ad5c69f04a64c4deb21704c26faf785fcfae71be6a05dce5193846ff05c73f074708e03a038767cea64332778dde0ce109868531af4b1b7e6f
SSDEEP 393216:Wbntjt8vfMn/R1FtnXE9ThsrtJk2ecJs+:MdtOM/LbnXmCtJk2zZ
TLSH
T173F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-26920.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-26920.exe
Size 15.7MB
SHA256 0e39a73248d23745be0db640e47c86878cc58fbbfb56dfc2cefb395bb8f60851
MD5 ce4242b4274d5bad88229019d7ca9328
SHA1 00ffefcf7d45bb400d8abc92272512eb6c78da3a
SHA512 a64bdfaafe8939d2fab34b1894a59b88d95026e31ef69efc7b5180a1cdeed912c9603257e6ce4975d2597f6d8fa03169b4aa5771a116cb17367963976c4b301b
SSDEEP 393216:Wbntjt8v4Mn/R1Ftn1E9ThsrtJk2ecJs+:MdtZM/Lbn1mCtJk2zZ
TLSH
T158F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-26920.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-26920.exe
Size 13.2MB
SHA256 2fa775bf98664b8a0787e0627422d3b0526b5d52c868d851d1ddea15a3dc0be9
MD5 3ae2e0417fa4e023fe2394dcb9a8f88d
SHA1 bd56f3360bc1145482795fededb51252192b225a
SHA512 b9a8962a56616cbb7ea64fc245edb6eaff73705cb3db53bc66f5ddb3e0fad280a6b08f0b973166e2e678dfc55f801efb07eec7b5affe3f214205726c1fda4f83
SSDEEP 196608:7ibnLD9jpvqMP0vi/Mn/R15fmmpLDHeWKL6qwSLTK+ZrXcB3tTd1n5ZjBxcO4TjT:Wbntjt8v4Mn/R1Ftn1E9ThsrtJk2en
TLSH
T17BD6F126AAA00FA5F433813407B6C566D63A7C3A572087CF7358F65A2F732D1583E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-33390.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-33390.exe
Size 15.7MB
SHA256 3118e619a8319e30b7992a2ba80acfbde4273d93c823723e1a9f92117071e6e3
MD5 f8031a146fac89d115b97b685cacad46
SHA1 40855e4582b320f737c6e91d509de6af323d723f
SHA512 dad11944d10a3e5fa3f004e5102a23bda9293e59c826eab9dc13d59fbafeb99a76dc4e57c8691142577932218cedb3af10c79cd7ee1f83d3a1585d9fc3c7d494
SSDEEP 393216:Wbntjt8vVMn/R1FtnXETThErtJk2ecJs+:Mdt8M/LbnXUqtJk2zZ
TLSH
T1D2F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-33726.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-33726.exe
Size 15.7MB
SHA256 7609bb5fdc8419e3fae52f5b226c1122e83223ebf6fe156f227285fab3ddb4df
MD5 51cd30ec67b75753a2a30900b790b905
SHA1 97a69bea14b16c65caabf0d956f4cca5525fb3f2
SHA512 3294cdf4769b692f423008b7c732b4aecf8a3d8a70a4b5f41e9b90dcc74cb9ffb7f3e32b9c5e739aa088790d69f0072854d7e052ba8eead743ce365a83548564
SSDEEP 393216:Wbnvjt8v4Mn/R1stnXE9ThsrtJk2ecJs+:MrtZM/L0nXmCtJk2zZ
TLSH
T15FF6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-3468.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-3468.exe
Size 15.7MB
SHA256 773b01ceac23ea8a0d16eb7b9ac3fdd76a7732204dbf99a2066fc73453bdadd9
MD5 ca8343bfa1dffbd397160a12d32d71a4
SHA1 22664408b8f76ddfb8a2a0afe6f424343a0f4b53
SHA512 4ad278f6767013266f3cfd866bb09b6bc8a8e23be25ccfe52e855aaee28990a7a05a0de944a644c31e9f5a2bf6358a7c2821db8c04271f723cad54e810b60f5b
SSDEEP 393216:Wbntjt8v4Mn/R1FtnXETThsrtJk2ecJs+:MdtZM/LbnXUCtJk2zZ
TLSH
T1A1F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-34906.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-34906.exe
Size 15.7MB
SHA256 5cf57eb6f8c312b1f97cce96233945ebab4b93795c7bac365590b50f61744eee
MD5 cb1860c891dce80bbc6ea057728ab11d
SHA1 49e32c99e36f8b0260bfc859e1b13b7c6e0d89eb
SHA512 40c3732b9f44c24e618a4aef6a0545557023459ba0b5b5e9d29cda05be642a6efb4992fcea434da91ea19a038c0fa6f4183c608d387d04edc66867bcee306529
SSDEEP 393216:Wbntjt8v4Mn/R1FtnXE9ThsrzJk2ecJs+:MdtZM/LbnXmCzJk2zZ
TLSH
T1D6F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-36240.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-36240.exe
Size 15.7MB
SHA256 59d85e2379640ce61b7482e56140e4eea39c433326fd996c6b91f1a2258e2df6
MD5 2b9d268954a733326efb4dab1eae92e2
SHA1 8e01e414b3865faccc499b687ce7c04b3fb38796
SHA512 ab27084311f2b756678ecf9c193d3e00000e3ef189f51c9074d932bd8aa980734b4418526c60382139da9444e07b931919802b045fede1f006c0ac4cca4c6794
SSDEEP 393216:Wbntjt8vfMn/R1FtnXEHThsrtJk2ecJs+:MdtOM/LbnX4CtJk2zZ
TLSH
T1DEF6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-37745.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-37745.exe
Size 13.9MB
SHA256 5d62b11d1278b67f72d3431dc43876fbaf65bb7c618c47e115f558a22a9b0a6a
MD5 746bb240f07bd62ae73afead9bf1d44e
SHA1 5ab8718e570c960e894867d09a63cfc46cb9d927
SHA512 e074430f3fe1a3e24d6dd075908504b02f5fa881c7940fbf1417baee7be04ff6926f31be6eb29837443c91f54caa2a6a0849568008f4e4a69087dd88ced51444
SSDEEP 196608:7ibnLDnjpvqMP0vi/Mn/R1mfmmpLDHgWKL6qwWLTK+ZrXcB3tTd185ZjBxcO4Tjg:Wbn3jt8v4Mn/R1stnXEpThsrWJk2ec
TLSH
T161E6F226AAA00FA5F433813407B6C566D63A7C3A572087CF7358F65A2F732D1583E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-37911.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-37911.exe
Size 15.7MB
SHA256 68279afc2cb78c1d68fcbf7190f61aa0b9851f9567d2b8e2d768665f65c6ad57
MD5 017d50abd8229320178ca31f153013ae
SHA1 902ddbafb4fc37f615fab7d37088dffec400b005
SHA512 9519dbb59d4ad4790f96c2af5b996d25e2c68e28e5c324ad554ef43602f18c21fd95ecf130db771964cb2738edb30910383e4e00db720f8768025754eae0fc7e
SSDEEP 393216:Wbn3jt8v4Mn/R1stnXE9ThsrtJk2ecjs+:MztZM/L0nXmCtJk2zb
TLSH
T188F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-41506.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-41506.exe
Size 15.7MB
SHA256 5292a53e1846a52f3bef2c5336668a104ec8ae19debf418478add644fa7ad12f
MD5 a2edd230e7699bb604f7a551e5f264dc
SHA1 d8579d6167acdcd10b53071ade8e3700ebfde2fc
SHA512 88d5d0904e7c448aed30a5e874e4934458522982f309e1cddfe18e6232d9e937237fbaea1836bdbac0dcf1a63996f43e147d707aed9533724f3b43a025353f9e
SSDEEP 393216:Wbnvjt8v4Mn/R1stnXE9ThsrtJ52ecJs+:MrtZM/L0nXmCtJ52zZ
TLSH
T190F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-4169.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-4169.exe
Size 15.7MB
SHA256 da7d29eb0059d1247aab6f578761596198b904c99ff4dbb8c5a6e44a42bb8fbb
MD5 d4fa0b762509ab0f714dce9722e12db6
SHA1 732a41a0d1cc34e384301024fd0799fa5f726c27
SHA512 5521ed9ea6c34de6f3183d57c85f3190922d493fdf35417f11c3d173cfec6b010da30d4a9e41a32db790a817d4c51ab3b979d5335ae26c83d773d395d5839d3c
SSDEEP 393216:Wbntjt8vVMn/R1FtnXETThsrXJk2ecJs+:Mdt8M/LbnXUCXJk2zZ
TLSH
T110F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-4247.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-4247.exe
Size 15.7MB
SHA256 8dfe28c39bde38a4e5758a288f33647617b3fc9658566316a807561b46dccf22
MD5 bc9626b81a3de29cf199af61e991e232
SHA1 780e1cf75c85fd6f0eeddd004bdb9c63e27ae180
SHA512 04ed5db44ee38e253c6c2144d5a76a6d19623610d37b3271a8f59b5b978d752586dcb57f8aefbb8aec6d02de0aa2b0d515eb177665407a8910ac30393f72473f
SSDEEP 393216:Wbn3jt8v4Mn/R1stnXE9ThsrWJk2ecjs+:MztZM/L0nXmCWJk2zb
TLSH
T1B4F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-42627.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42627.exe
Size 15.7MB
SHA256 3509566555d5a6aac860fa04efc8dc5ce667b7e26e441905087bdbff6ea9b796
MD5 0dd20d7c8fb7f537004eb6f082c31ac7
SHA1 7bc2a3202b333b6113ed471cc780ec5d08b6ca2f
SHA512 5dcfe39ffecfbd16823bb614222ec640989fea7750d286a7e5d7f71a9ff04c64039f11ea1e267e27b3f8e0faaf84df8f0590a9fc4862a6c26a64e52c113cdee1
SSDEEP 393216:WTn3jt8v4Mn/R1stnXE9ThsrtJk2ecJs+:0ztZM/L0nXmCtJk2zZ
TLSH
T1D5F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-46011.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-46011.exe
Size 15.7MB
SHA256 c934bf13c5e35f5e86956ac0cdb98e040d2d81789beb3b7dac1f268acad7e0be
MD5 2440177dd5e95f2c4c8f16d1573a4a9e
SHA1 27e2f7bfa7d850ed9041619ce123122c0c40b897
SHA512 849e3382b6fe4d6acade0907a3de5633aaf55acc0a7179d01be02702f6346ec1f3e38b4c21ef093f683681a6a529fcd47273f44b8a12ff062b150d731344f18e
SSDEEP 393216:Wbn3jt8v4Mn/R1stnXE9ThsrtJk2ecJs+:MztZM/L0nXmCtJk2zZ
TLSH
T17BF6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-47226.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-47226.exe
Size 15.7MB
SHA256 56ef162863857f6dfada13f7ec55fa49e27875d5326600f2a973e191c85f4724
MD5 8fa23f5c2b18b68cc8e3643d129c39b2
SHA1 d9bf52079259c5aef855a2913fa845370c8e70f4
SHA512 411abb7fbb8696da6ebff851479a700670a97d4229cbe2cbfa5d5a5a78bef9086401507e8d4e8cbb5d85c3b425bed3263990688d6c1f277643f654a191c91669
SSDEEP 393216:WbnFjt8v4Mn/R1stnXE9ThoGtJk2ecJs+:M1tZM/L0nXmrtJk2zZ
TLSH
T190F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-49540.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-49540.exe
Size 15.7MB
SHA256 e884e80add85d9b5e973f32222475d6925ff52e206b0282d6b0278627cc22613
MD5 3d1c46e8cf09be4a42ea30ca20a3706a
SHA1 afac7dedb18ea92233d8690fb4c47f86cfafcc14
SHA512 01b235c4c257f7aa0c40742c6bb6f387eda809e5f29a690dce4624c3953f181d0571836dc7e5fed4e2ec357ef5140aa3ce2b06f76c6cd828eb74177b39662097
SSDEEP 393216:WbnFjt8v4Mn/R1stnWE9ThsrtJk2ecJs+:M1tZM/L0nWmCtJk2zZ
TLSH
T115F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-50241.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-50241.exe
Size 15.7MB
SHA256 12bddc9e68961ebf1f14d86cc020c8de0d35de60a599baabce91b053277638db
MD5 d3bc5360ab3eb280efd9f045e9faf2de
SHA1 cb8a5310f897914e8821d8222abbd9673c03e0c4
SHA512 d342f0871ba3699a93a74d0f9a96e5c3c1afe7ec5410e3aa927b32623b27bd6c89c8ddeb0eaebf6f3a3d91803edfaec124d3431221acc4c892d4c0bf939ad89e
SSDEEP 393216:Wbnvjt8v4Mn/R1stnXE9ThsetJk2ecJs+:MrtZM/L0nXmntJk2zZ
TLSH
T10CF6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-8231.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-8231.exe
Size 15.7MB
SHA256 78eb610f880af296c756557910d19cbf7c800799432225caa5c9a3f87ba4cccb
MD5 374d6d899c2d602bb35d55c7e72060da
SHA1 3d06d7be9ea41cdecc0674eb7e14759ea97220ec
SHA512 a01ea9c1edfa170d3000429133fb1c9f495e888726ce5133d045a1449d49756056061c881562f172622f7ccae551c83e51e9a0c9aa071e724d86f73f0c01d02c
SSDEEP 393216:Wbntjt8v4Mn/R1FtnXETThsrtJk2ec+s+:MdtZM/LbnXUCtJk2zW
TLSH
T130F6F122EAA01FA5F833813407A69566D63A7C3A172047CF7348FA5A3F736D1543E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/684-401-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1168-419-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1412-394-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2112-684-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2168-216-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2188-686-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2628-687-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2668-396-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2672-418-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2820-400-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2868-0-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3152-1364-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3384-683-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3408-1145-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4300-531-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4760-206-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4764-685-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4792-530-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5096-627-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5644-397-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5652-180-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5804-485-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5812-398-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5920-703-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5924-421-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6012-217-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6032-179-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6112-500-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6136-395-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6148-688-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6268-702-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6688-730-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6788-766-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6812-745-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6824-747-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6832-746-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6896-852-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6904-853-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6944-1573-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7028-1456-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7036-1003-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7060-1279-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7068-894-0x0000000000400000-0x0000000000475000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads