kawaiiunicorn | 275ae7109882d7d0e7ffe3bc1a1d2d68ef1609a3ad1cc5e28df22cb6d4143315

Analysis

max time kernel
22s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 02:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_a252c01e82b208b008e4b1c32ed72d57_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe
Size 13.3MB
Sample260705-c7lexscv3q
SHA256 275ae7109882d7d0e7ffe3bc1a1d2d68ef1609a3ad1cc5e28df22cb6d4143315
MD5 a252c01e82b208b008e4b1c32ed72d57
SHA1 27354ed2914ff1172b4162b03416342fafc14d25
SHA512 84750a5b01c2856372b5f99721ec363148ba460dc27a3674b94c010cc8cab9e9103a037b8809ca70edf8d95889f5e66b01ebc0862febd37554bb1e439840935a
SSDEEP 393216:/GSTJEKUxqnNNbnFd78vDM4/R1AtmTEnT:egtUxgNhL7SMQLgmTw
TLSH
T11DE6AEF68C705652FE3A4C35DEA1AAA48D3578291F90CBCB2915718F63736F7603D288
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery kawaiiunicorn trojan

Malware Config

Signatures

Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
trojan kawaiiunicorn

Detects KawaiiUnicorn 41 IoCs

resource	yara_rule
behavioral2/memory/3396-0-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1352-62-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2924-256-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3856-257-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3432-262-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/616-281-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6108-291-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4544-398-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2628-397-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2084-482-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3888-483-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2688-547-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4524-590-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2204-551-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6472-823-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6412-787-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6220-926-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6356-1006-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6712-990-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6736-984-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7160-981-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6920-979-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6616-824-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5764-1057-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1000-1124-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7200-1185-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3396-1231-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7180-1159-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6952-1158-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6464-1156-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6444-1157-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5148-1122-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6288-1121-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6872-1083-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6784-1059-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2844-1081-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3332-1033-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6116-1345-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6088-1699-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2940-1876-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2200-2306-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 29 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c4a2-6.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000e00000001c4a4-11.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000e00000001c4a6-20.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4a7-29.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4a8-35.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4aa-44.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4a9-46.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4ac-61.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4ab-60.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4b2-82.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4b0-85.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4af-97.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4ae-88.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4b3-95.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4b1-94.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4b8-121.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4b5-127.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4b6-131.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4b4-125.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4c3-163.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4c6-150.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4ca-179.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4bb-189.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4c7-188.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4c8-196.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4c9-203.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4c4-210.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4c5-205.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4d5-238.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

UPX dump on OEP (original entry point) 29 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c4a2-6.dat	UPX
behavioral2/files/0x000e00000001c4a4-11.dat	UPX
behavioral2/files/0x000e00000001c4a6-20.dat	UPX
behavioral2/files/0x000d00000001c4a7-29.dat	UPX
behavioral2/files/0x000d00000001c4a8-35.dat	UPX
behavioral2/files/0x000d00000001c4aa-44.dat	UPX
behavioral2/files/0x000d00000001c4a9-46.dat	UPX
behavioral2/files/0x000d00000001c4ac-61.dat	UPX
behavioral2/files/0x000d00000001c4ab-60.dat	UPX
behavioral2/files/0x000d00000001c4b2-82.dat	UPX
behavioral2/files/0x000d00000001c4b0-85.dat	UPX
behavioral2/files/0x000d00000001c4af-97.dat	UPX
behavioral2/files/0x000d00000001c4ae-88.dat	UPX
behavioral2/files/0x000d00000001c4b3-95.dat	UPX
behavioral2/files/0x000d00000001c4b1-94.dat	UPX
behavioral2/files/0x000d00000001c4b8-121.dat	UPX
behavioral2/files/0x000d00000001c4b5-127.dat	UPX
behavioral2/files/0x000d00000001c4b6-131.dat	UPX
behavioral2/files/0x000d00000001c4b4-125.dat	UPX
behavioral2/files/0x000d00000001c4c3-163.dat	UPX
behavioral2/files/0x000d00000001c4c6-150.dat	UPX
behavioral2/files/0x000d00000001c4ca-179.dat	UPX
behavioral2/files/0x000d00000001c4bb-189.dat	UPX
behavioral2/files/0x000d00000001c4c7-188.dat	UPX
behavioral2/files/0x000d00000001c4c8-196.dat	UPX
behavioral2/files/0x000d00000001c4c9-203.dat	UPX
behavioral2/files/0x000d00000001c4c4-210.dat	UPX
behavioral2/files/0x000d00000001c4c5-205.dat	UPX
behavioral2/files/0x000d00000001c4d5-238.dat	UPX

Executes dropped EXE 13 IoCs

pid	Process
6116	Unicorn-49690.exe
6088	Unicorn-61138.exe
2940	Unicorn-45840.exe
2200	Unicorn-21601.exe
3112	Unicorn-4942.exe
4220	Unicorn-63095.exe
2452	Unicorn-22154.exe
1352	Unicorn-64390.exe
2492	Unicorn-29750.exe
6012	Unicorn-51666.exe
5592	Unicorn-44759.exe
1320	Unicorn-56554.exe
4468	Unicorn-2143.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49690.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61138.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21601.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4942.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63095.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29750.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-05_a252c01e82b208b008e4b1c32ed72d57_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45840.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22154.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44759.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
3396	2026-07-05_a252c01e82b208b008e4b1c32ed72d57_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe
6116	Unicorn-49690.exe
6088	Unicorn-61138.exe
2940	Unicorn-45840.exe
2200	Unicorn-21601.exe
3112	Unicorn-4942.exe
4220	Unicorn-63095.exe
2452	Unicorn-22154.exe
1352	Unicorn-64390.exe
2492	Unicorn-29750.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3396 wrote to memory of 6116	3396	2026-07-05_a252c01e82b208b008e4b1c32ed72d57_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe	88
PID 6116 wrote to memory of 6088	6116	Unicorn-49690.exe	89
PID 3396 wrote to memory of 2940	3396	2026-07-05_a252c01e82b208b008e4b1c32ed72d57_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe	90
PID 6088 wrote to memory of 2200	6088	Unicorn-61138.exe	91
PID 6116 wrote to memory of 3112	6116	Unicorn-49690.exe	92
PID 2940 wrote to memory of 4220	2940	Unicorn-45840.exe	93
PID 3396 wrote to memory of 2452	3396	2026-07-05_a252c01e82b208b008e4b1c32ed72d57_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe	94
PID 2200 wrote to memory of 1352	2200	Unicorn-21601.exe	96
PID 6088 wrote to memory of 2492	6088	Unicorn-61138.exe	95
PID 2452 wrote to memory of 6012	2452	Unicorn-22154.exe	97
PID 3112 wrote to memory of 5592	3112	Unicorn-4942.exe	98
PID 3396 wrote to memory of 1320	3396	2026-07-05_a252c01e82b208b008e4b1c32ed72d57_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe	99
PID 2940 wrote to memory of 4468	2940	Unicorn-45840.exe	100
PID 6116 wrote to memory of 5356	6116	Unicorn-49690.exe	101
PID 4220 wrote to memory of 4780	4220	Unicorn-63095.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-07-05_a252c01e82b208b008e4b1c32ed72d57_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_a252c01e82b208b008e4b1c32ed72d57_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49690.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49690.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61138.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61138.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:6088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21601.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64390.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45969.exe
        6⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48441.exe
        7⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48182.exe
        8⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54288.exe
        9⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49474.exe
        10⤵
        
        PID:11072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19777.exe
        9⤵
        
        PID:9172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6659.exe
        9⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22803.exe
        8⤵
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24828.exe
        8⤵
        
        PID:9456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49285.exe
        8⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65504.exe
        7⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49203.exe
        8⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49163.exe
        8⤵
        
        PID:9920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38434.exe
        7⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8836.exe
        7⤵
        
        PID:10012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10147.exe
        7⤵
        
        PID:11512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55218.exe
        6⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41410.exe
        7⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22773.exe
        8⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35877.exe
        9⤵
        
        PID:7684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50533.exe
        9⤵
        
        PID:9628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32731.exe
        8⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6906.exe
        9⤵
        
        PID:9704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35914.exe
        8⤵
        
        PID:10548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38184.exe
        7⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48290.exe
        7⤵
        
        PID:8568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47744.exe
        7⤵
        
        PID:6776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63292.exe
        6⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43546.exe
        7⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26423.exe
        8⤵
        
        PID:11268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33752.exe
        7⤵
        
        PID:8308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47905.exe
        7⤵
        
        PID:260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53779.exe
        6⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23206.exe
        6⤵
        
        PID:9396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26103.exe
        5⤵
        
        PID:1296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24976.exe
        6⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19297.exe
        7⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9981.exe
        8⤵
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52344.exe
        8⤵
        
        PID:9616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40582.exe
        7⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6562.exe
        8⤵
        
        PID:10852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34768.exe
        7⤵
        
        PID:10312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        7⤵
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1046.exe
        6⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10349.exe
        7⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29318.exe
        8⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17369.exe
        7⤵
        
        PID:8712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27079.exe
        7⤵
        
        PID:10104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        6⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45613.exe
        7⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25842.exe
        6⤵
        
        PID:9384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33043.exe
        5⤵
        
        PID:3856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45909.exe
        6⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39991.exe
        7⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8705.exe
        8⤵
        
        PID:11116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27114.exe
        7⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39016.exe
        8⤵
        
        PID:11944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63011.exe
        7⤵
        
        PID:1916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14666.exe
        6⤵
        
        PID:6828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60139.exe
        6⤵
        
        PID:3188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34730.exe
        6⤵
        
        PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30735.exe
        5⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59249.exe
        6⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17854.exe
        7⤵
        
        PID:6580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14105.exe
        6⤵
        
        PID:8472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1911.exe
        7⤵
        
        PID:600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36853.exe
        6⤵
        
        PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4351.exe
        5⤵
        
        PID:6348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28902.exe
        5⤵
        
        PID:9512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1923.exe
        5⤵
        
        PID:11332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29750.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15242.exe
        5⤵
        
        PID:2644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9625.exe
        6⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48441.exe
        7⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38504.exe
        8⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8403.exe
        9⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1265.exe
        10⤵
        
        PID:9272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19943.exe
        9⤵
        
        PID:9068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45606.exe
        9⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31739.exe
        8⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8966.exe
        9⤵
        
        PID:9852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54569.exe
        8⤵
        
        PID:9428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15440.exe
        8⤵
        
        PID:12060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8882.exe
        7⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14252.exe
        8⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34932.exe
        9⤵
        
        PID:7920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10024.exe
        8⤵
        
        PID:9948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41563.exe
        7⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63195.exe
        7⤵
        
        PID:10204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28575.exe
        6⤵
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55473.exe
        7⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1823.exe
        8⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56916.exe
        8⤵
        
        PID:9868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38288.exe
        8⤵
        
        PID:11764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36586.exe
        7⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52374.exe
        7⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22131.exe
        8⤵
        
        PID:11352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55035.exe
        7⤵
        
        PID:7808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53619.exe
        6⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5995.exe
        7⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37234.exe
        7⤵
        
        PID:8252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35248.exe
        7⤵
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52487.exe
        6⤵
        
        PID:6760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22028.exe
        6⤵
        
        PID:9860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14155.exe
        5⤵
        
        PID:4672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
        6⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57505.exe
        7⤵
        
        PID:1356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56360.exe
        8⤵
        
        PID:10572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25952.exe
        7⤵
        
        PID:8376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16716.exe
        7⤵
        
        PID:10604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44651.exe
        6⤵
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7409.exe
        6⤵
        
        PID:3380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6302.exe
        6⤵
        
        PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64475.exe
        5⤵
        
        PID:2628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52736.exe
        6⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3920.exe
        7⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49490.exe
        7⤵
        
        PID:9160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54719.exe
        6⤵
        
        PID:7892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1601.exe
        6⤵
        
        PID:10000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57240.exe
        5⤵
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60817.exe
        6⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13936.exe
        7⤵
        
        PID:11300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55878.exe
        6⤵
        
        PID:9988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3947.exe
        5⤵
        
        PID:7860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18290.exe
        5⤵
        
        PID:9408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39557.exe
        5⤵
        
        PID:11996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39839.exe
      4⤵
      PID:2112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48441.exe
        5⤵
        
        PID:2804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3885.exe
        6⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26546.exe
        7⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36876.exe
        7⤵
        
        PID:1208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18875.exe
        6⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1453.exe
        7⤵
        
        PID:8072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22934.exe
        6⤵
        
        PID:9600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4824.exe
        5⤵
        
        PID:2256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42509.exe
        6⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48232.exe
        7⤵
        
        PID:7664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38280.exe
        6⤵
        
        PID:9452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7056.exe
        5⤵
        
        PID:5924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29058.exe
        5⤵
        
        PID:3744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25618.exe
      4⤵
      PID:1520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51005.exe
        5⤵
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16136.exe
        6⤵
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46617.exe
        6⤵
        
        PID:8980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52845.exe
        6⤵
        
        PID:6772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        5⤵
        
        PID:6940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6764.exe
        5⤵
        
        PID:10120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42020.exe
        5⤵
        
        PID:1292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-378.exe
      4⤵
      PID:404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5876.exe
        5⤵
        
        PID:6784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4736.exe
        6⤵
        
        PID:11312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6734.exe
        5⤵
        
        PID:9660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31194.exe
      4⤵
      PID:7564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64050.exe
        5⤵
        
        PID:4408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44754.exe
      4⤵
      PID:8704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4942.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4942.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44759.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43258.exe
        5⤵
        
        PID:2004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30870.exe
        6⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-403.exe
        7⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13447.exe
        8⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64577.exe
        8⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49996.exe
        8⤵
        
        PID:11180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52321.exe
        7⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40232.exe
        8⤵
        
        PID:10468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-459.exe
        7⤵
        
        PID:9144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17816.exe
        7⤵
        
        PID:11716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62411.exe
        6⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31886.exe
        7⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50754.exe
        8⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6319.exe
        7⤵
        
        PID:9376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42092.exe
        6⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62997.exe
        7⤵
        
        PID:10964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31872.exe
        6⤵
        
        PID:8640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        6⤵
        
        PID:12188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46692.exe
        5⤵
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5940.exe
        6⤵
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56296.exe
        7⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2120.exe
        8⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43846.exe
        7⤵
        
        PID:8692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52850.exe
        7⤵
        
        PID:3532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17318.exe
        6⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36869.exe
        7⤵
        
        PID:11208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6071.exe
        6⤵
        
        PID:8968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8829.exe
        5⤵
        
        PID:2204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63722.exe
        6⤵
        
        PID:6872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46339.exe
        6⤵
        
        PID:9816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-110.exe
        5⤵
        
        PID:4284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54530.exe
        5⤵
        
        PID:10096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58153.exe
        5⤵
        
        PID:12272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23392.exe
      4⤵
      PID:4488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59588.exe
        5⤵
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60925.exe
        6⤵
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53695.exe
        6⤵
        
        PID:6912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33140.exe
        6⤵
        
        PID:5084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24147.exe
        5⤵
        
        PID:6492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28337.exe
        6⤵
        
        PID:7172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42255.exe
        6⤵
        
        PID:9904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54687.exe
        5⤵
        
        PID:7868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33341.exe
        5⤵
        
        PID:2824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65145.exe
        5⤵
        
        PID:1404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10479.exe
      4⤵
      PID:2084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46037.exe
        5⤵
        
        PID:7084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64354.exe
        5⤵
        
        PID:8368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62959.exe
        5⤵
        
        PID:3080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42404.exe
      4⤵
      PID:6972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29698.exe
      4⤵
      PID:9692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17139.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17139.exe
    3⤵
    PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43258.exe
      4⤵
      PID:2108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48441.exe
        5⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22827.exe
        6⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48637.exe
        7⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21571.exe
        8⤵
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7912.exe
        7⤵
        
        PID:9224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5860.exe
        6⤵
        
        PID:7208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9198.exe
        6⤵
        
        PID:9636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19105.exe
        5⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13831.exe
        6⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36009.exe
        7⤵
        
        PID:10328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63753.exe
        7⤵
        
        PID:6648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1453.exe
        6⤵
        
        PID:8500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17221.exe
        6⤵
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26938.exe
        5⤵
        
        PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44721.exe
        5⤵
        
        PID:9668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34439.exe
      4⤵
      PID:616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5940.exe
        5⤵
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55253.exe
        6⤵
        
        PID:7160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28267.exe
        6⤵
        
        PID:9060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45367.exe
        5⤵
        
        PID:6164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-316.exe
        5⤵
        
        PID:8484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16411.exe
        5⤵
        
        PID:5376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59810.exe
      4⤵
      PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2212.exe
        5⤵
        
        PID:6984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37161.exe
        5⤵
        
        PID:8204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17746.exe
        6⤵
        
        PID:10868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14225.exe
        5⤵
        
        PID:12224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33214.exe
      4⤵
      PID:7884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6559.exe
      4⤵
      PID:9880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42993.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42993.exe
    3⤵
    PID:3412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31467.exe
      4⤵
      PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22991.exe
        5⤵
        
        PID:6412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63453.exe
        6⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49903.exe
        7⤵
        
        PID:11424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43080.exe
        6⤵
        
        PID:10244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5186.exe
        5⤵
        
        PID:7336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29187.exe
        5⤵
        
        PID:10044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45554.exe
        5⤵
        
        PID:7908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19456.exe
      4⤵
      PID:6356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7052.exe
        5⤵
        
        PID:7472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4701.exe
      4⤵
      PID:8708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50985.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50985.exe
    3⤵
    PID:2340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51200.exe
      4⤵
      PID:424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12267.exe
      4⤵
      PID:8720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64740.exe
      4⤵
      PID:10876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41375.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41375.exe
    3⤵
    PID:5748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43231.exe
      4⤵
      PID:256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6928.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6928.exe
    3⤵
    PID:9364
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45840.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45840.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63095.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63095.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23270.exe
      4⤵
      PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60663.exe
        5⤵
        
        PID:4484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38436.exe
        6⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10470.exe
        7⤵
        
        PID:248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52949.exe
        8⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59921.exe
        9⤵
        
        PID:8624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4808.exe
        9⤵
        
        PID:11320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43772.exe
        8⤵
        
        PID:7384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40827.exe
        9⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27328.exe
        8⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52300.exe
        7⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64986.exe
        7⤵
        
        PID:8524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51559.exe
        7⤵
        
        PID:11188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7133.exe
        6⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33406.exe
        7⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56463.exe
        8⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35618.exe
        8⤵
        
        PID:10160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13878.exe
        7⤵
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39204.exe
        7⤵
        
        PID:9572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34623.exe
        6⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64413.exe
        7⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50948.exe
        7⤵
        
        PID:9248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28072.exe
        6⤵
        
        PID:8036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22314.exe
        6⤵
        
        PID:8920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30345.exe
        5⤵
        
        PID:1468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28224.exe
        6⤵
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14781.exe
        7⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29266.exe
        7⤵
        
        PID:572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31895.exe
        6⤵
        
        PID:7228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43303.exe
        6⤵
        
        PID:10216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31548.exe
        6⤵
        
        PID:8100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43884.exe
        5⤵
        
        PID:3256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51180.exe
        6⤵
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15260.exe
        6⤵
        
        PID:9232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6492.exe
        6⤵
        
        PID:7816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51216.exe
        5⤵
        
        PID:7556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6261.exe
        6⤵
        
        PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42916.exe
        5⤵
        
        PID:9424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21614.exe
        5⤵
        
        PID:5684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23392.exe
      4⤵
      PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59588.exe
        5⤵
        
        PID:2100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46405.exe
        6⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61564.exe
        7⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65063.exe
        7⤵
        
        PID:9900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62010.exe
        6⤵
        
        PID:8144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32882.exe
        6⤵
        
        PID:9476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45554.exe
        6⤵
        
        PID:7836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35387.exe
        5⤵
        
        PID:6964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5863.exe
        5⤵
        
        PID:8392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43251.exe
        5⤵
        
        PID:11284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47153.exe
      4⤵
      PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28315.exe
        5⤵
        
        PID:6192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53977.exe
        6⤵
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1086.exe
        7⤵
        
        PID:11400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12271.exe
        6⤵
        
        PID:9444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34303.exe
        5⤵
        
        PID:7200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27511.exe
        5⤵
        
        PID:9612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9150.exe
        5⤵
        
        PID:12052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23712.exe
      4⤵
      PID:7004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13234.exe
      4⤵
      PID:8540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20017.exe
      4⤵
      PID:1460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2143.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2143.exe
    3⤵
    - Executes dropped EXE
    PID:4468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38331.exe
      4⤵
      PID:1740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24690.exe
        5⤵
        
        PID:3104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42124.exe
        6⤵
        
        PID:6572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26284.exe
        6⤵
        
        PID:7276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-577.exe
        6⤵
        
        PID:10576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44490.exe
        5⤵
        
        PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13637.exe
        5⤵
        
        PID:8456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2031.exe
      4⤵
      PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50469.exe
        5⤵
        
        PID:6980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38441.exe
        5⤵
        
        PID:9520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10240.exe
      4⤵
      PID:1676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20481.exe
        5⤵
        
        PID:6604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8707.exe
      4⤵
      PID:10024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37128.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37128.exe
    3⤵
    PID:988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18416.exe
      4⤵
      PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20064.exe
        5⤵
        
        PID:5300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55296.exe
        6⤵
        
        PID:10676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57888.exe
        5⤵
        
        PID:8232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44428.exe
        5⤵
        
        PID:4412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22180.exe
      4⤵
      PID:6388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11045.exe
        5⤵
        
        PID:7648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26251.exe
        5⤵
        
        PID:9468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24811.exe
      4⤵
      PID:7608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58042.exe
      4⤵
      PID:8576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23598.exe
      4⤵
      PID:11772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59157.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59157.exe
    3⤵
    PID:5776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32913.exe
      4⤵
      PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50615.exe
        5⤵
        
        PID:1508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10332.exe
      4⤵
      PID:8340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13758.exe
      4⤵
      PID:11612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59478.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59478.exe
    3⤵
    PID:6564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43708.exe
      4⤵
      PID:1864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2869.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2869.exe
    3⤵
    PID:8212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21846.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21846.exe
    3⤵
    PID:5500
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22154.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22154.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51666.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51666.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43258.exe
      4⤵
      PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37828.exe
        5⤵
        
        PID:2684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52928.exe
        6⤵
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33381.exe
        7⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3464.exe
        8⤵
        
        PID:10696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43594.exe
        7⤵
        
        PID:10196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21800.exe
        6⤵
        
        PID:7456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36340.exe
        6⤵
        
        PID:10428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58543.exe
        6⤵
        
        PID:12192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13741.exe
        5⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exe
        6⤵
        
        PID:11852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7052.exe
        5⤵
        
        PID:7364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21264.exe
        5⤵
        
        PID:4792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8866.exe
      4⤵
      PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54757.exe
        5⤵
        
        PID:4444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29047.exe
        6⤵
        
        PID:6748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14679.exe
        6⤵
        
        PID:10224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11951.exe
        6⤵
        
        PID:6652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23618.exe
        5⤵
        
        PID:7072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5368.exe
        5⤵
        
        PID:9604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30645.exe
      4⤵
      PID:1884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-863.exe
        5⤵
        
        PID:7020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9468.exe
        6⤵
        
        PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34338.exe
        5⤵
        
        PID:8288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-437.exe
        5⤵
        
        PID:6180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61418.exe
      4⤵
      PID:7320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4483.exe
      4⤵
      PID:9896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42311.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42311.exe
    3⤵
    PID:5824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25645.exe
      4⤵
      PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46847.exe
        5⤵
        
        PID:7052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63392.exe
        5⤵
        
        PID:9416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25521.exe
        5⤵
        
        PID:11832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47267.exe
      4⤵
      PID:7180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48835.exe
      4⤵
      PID:9828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39685.exe
      4⤵
      PID:11700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59287.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59287.exe
    3⤵
    PID:4620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33075.exe
      4⤵
      PID:11100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1283.exe
      4⤵
      PID:10388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53291.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53291.exe
    3⤵
    PID:7360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25577.exe
      4⤵
      PID:1860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24367.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24367.exe
    3⤵
    PID:9328
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56554.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56554.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43258.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43258.exe
    3⤵
    PID:2060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52167.exe
      4⤵
      PID:3432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3781.exe
        5⤵
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21242.exe
        6⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45586.exe
        7⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43594.exe
        7⤵
        
        PID:9412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23390.exe
        6⤵
        
        PID:7520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33733.exe
        6⤵
        
        PID:10192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21220.exe
        5⤵
        
        PID:3536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30973.exe
        6⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52338.exe
        7⤵
        
        PID:6312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12847.exe
        6⤵
        
        PID:1540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5870.exe
        5⤵
        
        PID:7624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17040.exe
        5⤵
        
        PID:10076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59951.exe
      4⤵
      PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20748.exe
        5⤵
        
        PID:1088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9779.exe
        5⤵
        
        PID:8468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37004.exe
        6⤵
        
        PID:3036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46243.exe
      4⤵
      PID:6864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5807.exe
      4⤵
      PID:8348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31814.exe
      4⤵
      PID:10900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18103.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18103.exe
    3⤵
    PID:5864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36776.exe
      4⤵
      PID:6044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54734.exe
        5⤵
        
        PID:6584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38038.exe
        5⤵
        
        PID:8300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33052.exe
        5⤵
        
        PID:10912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24671.exe
      4⤵
      PID:6696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8326.exe
      4⤵
      PID:8552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48953.exe
      4⤵
      PID:11496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29960.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29960.exe
    3⤵
    PID:5704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45394.exe
      4⤵
      PID:6288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64268.exe
        5⤵
        
        PID:11160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61192.exe
      4⤵
      PID:10320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3975.exe
      4⤵
      PID:7012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62207.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62207.exe
    3⤵
    PID:7264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43539.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43539.exe
    3⤵
    PID:9348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5086.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5086.exe
    3⤵
    PID:7380
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34327.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34327.exe
  2⤵
  PID:2364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52515.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52515.exe
    3⤵
    PID:3548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58595.exe
      4⤵
      PID:7124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58153.exe
      4⤵
      PID:8736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58927.exe
      4⤵
      PID:10348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18859.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18859.exe
    3⤵
    PID:6676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39211.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39211.exe
    3⤵
    PID:9200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55035.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55035.exe
    3⤵
    PID:12180
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60106.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60106.exe
  2⤵
  PID:6024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44669.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44669.exe
    3⤵
    PID:5548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63157.exe
      4⤵
      PID:1164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10288.exe
        5⤵
        
        PID:11364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47679.exe
      4⤵
      PID:9912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27067.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27067.exe
    3⤵
    PID:7712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4061.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4061.exe
    3⤵
    PID:10432
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8290.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8290.exe
  2⤵
  PID:3328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6753.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6753.exe
    3⤵
    PID:6712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57990.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57990.exe
    3⤵
    PID:9164
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26729.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26729.exe
  2⤵
  PID:7572
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41961.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41961.exe
  2⤵
  PID:10064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-14155.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-14155.exe
Size 13.3MB
SHA256 05d828202570dbb608810fd0c9dab976b792c579a80dab0f4494488ab16993d7
MD5 d447758785ba8e36a5028a8e38e451f2
SHA1 89e5d8ad56bf79c9348d4dcc7b20035147422801
SHA512 60831a418694bc017dde873413f9b68181aec16b265178e881b4dca10558d4dadf1f1d4b866c3bbafcda5b02fc7dcebd0f6de653f782491540bb4628aab3be1c
SSDEEP 393216:/GSTJEKUxqnNNbnFd78vDM4nR1AtmXEnT:egtUxgNhL7SMoLgmXw
TLSH
T135E6AEF68C705652FE3A4C35DEA1AAA48D3578291F90CBCB2915718F63736F7603D288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-15242.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-15242.exe
Size 13.3MB
SHA256 0dd928b06a7a461b91dddb82fcc003bd7298fdff0243f72c84282f68a747c0f0
MD5 d5c8341dc9f18fcb7827bfcbfe42aaf2
SHA1 b088b35f14d7b5e01d6054789c74a003bfaa80eb
SHA512 89452518e04abf4cdf61fd715d6e079b3aefbd575f244e2d320bce28ea1d08c32b29420a2057df804a32395788b67b791b79d5f3197c8fe878ffd4c59f10dd5b
SSDEEP 393216:/GSTJEKUxqnNNbnFd78v2M4nR1AtmXEnT:egtUxgNhL7/MoLgmXw
TLSH
T169E6AEF68C705652FE3A4C35DEA1AAA48D3578291F90CBCB2915718F63736F7603D288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-17139.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-17139.exe
Size 13.3MB
SHA256 fc748b4686841f2e5927dfd778f3e0bb3a5622c8f1cd8acdc279db3dc450d589
MD5 0b1077acbef117937ade8e1001396156
SHA1 5effcb96524ad11ec91cd8460156f6ad3b4383b4
SHA512 f8528bcdff22a47fe8d5bef706de6915f3376b4727bebf715fb6038fd42b17e467f537cbc9f6ba370db64990d0eefbcbbed25cbba8eedf5baf732ef2974bfcd6
SSDEEP 393216:/mSTJEKUxqnNNbnFd78vDM4nR1AtmTEnT:+gtUxgNhL7SMoLgmTw
TLSH
T1D9E6AEF68C705652FE3A4C35DEA1AAA48D3578291F90CBCB2915718F63736F7603D288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-2143.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-2143.exe
Size 13.3MB
SHA256 960432de7e271b2389d7361049fb3ced6a36323ba4aa9f5cc2f405997de22480
MD5 789ecb4b75fa8e934e66d0129b50b587
SHA1 a3139b677910c0512785b3705b31464f12954888
SHA512 5f48e6b9460d420677183117d0616ed906b4de3dfc348a82febc053446b40e1f4770f9a746383a0c8298f4ff0a109a880b80fa27be45dfd76e5a77e5584f0eba
SSDEEP 393216:/GSTJEKUxqnNNbngd78vDM4/R1AtmTERT:egtUxgNhg7SMQLgmTa
TLSH
T1A2E6AEF68C705652FE3A4C35DEA1AAA48D3578291F90CBCB2915718F63736F7603D288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-21601.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-21601.exe
Size 13.3MB
SHA256 c248d44602d20dd37905f2d8482e353d57390968ca90a60d58d822cd79763c96
MD5 e6789720ba18ffabf8d0e4f664607434
SHA1 ed92ee3fca385fe1ba98fbbf26d069eeba1a3974
SHA512 55cecb19465cb6439fee29ca8e811b24fffec0b65b3d877ae5458659d37a0c4ee99a71eca606f70b141108c3e3192d87ee43ed56bf373fd5da8d30a21d0f1866
SSDEEP 393216:/GSWJEKUxqnNNbnFd78vDM4nR1AtmPEnT:edtUxgNhL7SMoLgmPw
TLSH
T1E1E6AEF68C705652FE3A4C35DEA1AAA48D3578291F90CBCB2915718F63736F7603D288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-22154.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-22154.exe
Size 13.3MB
SHA256 7c22a2e40a77d640fb652d7a07dc3381d38c81652e69e17c673058f431174688
MD5 e83a0d35f57b072d22a601236a6461c6
SHA1 b6de3d22fa9bf803bb02e36d7f0e546f7d198e6a
SHA512 69e681c34ade487e49315e3c87157533929d9d92f9fe1daf5a180166b5d2868285348884f7102db4fbd3961afe130e8b0218da8f18a1526fe297b302c0caba48
SSDEEP 393216:/GSTJEKUxqnNNbnFd78vDM4/d1AtmTEnT:egtUxgNhL7SMQ3gmTw
TLSH
T1C6E6AEF68C705652FE3A4C35DEA1AAA48D3578291F90CBCB2915718F63736F7603D288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-23270.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-23270.exe
Size 13.3MB
SHA256 2b914a7052de73ad6c5abe6bf2dd542a0dd21c6e4a8cdafb0e9a81e57a1426aa
MD5 21e33f02ebedadf2a2c56bad7a9b8af1
SHA1 70a7883e263ba48b094dad8dbbe66543f12cec9e
SHA512 802da1d04f8d43c5c4a41e9ad2b011f3be0371b2dc7826867f73af779e8e571894ef8cf88e8394d5ca5551322a9a1793fc61d9bfaeae6407ced18fd9196ac2dc
SSDEEP 393216:/GSTJEKUxqnNNbnFd7MvDM4/R1AtmTEvT:egtUxgNhL7CMQLgmTI
TLSH
T1BBE6AEF68C705652FE3A4C35DEA1AAA48D3578291F90CBCB2915718F63736F7603D288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-23392.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-23392.exe
Size 13.3MB
SHA256 70360ca1d15664638a682ed95c89677e32f11705238715d9f5f99f5d68d0610f
MD5 c7d06f4abaa233785e99092079de1502
SHA1 ad8b6633bdb392e2fe625ef216b5914e55d7bf3c
SHA512 fd8a915529c8878cef5b100829fbd0b248815c3ebe5ca615e31225e6f901ee4735da9bf8b886096625e7e64f8f91fe7135c1ef72784bf6bb38f66633c0dca1af
SSDEEP 393216:/BSTJEKUxqnNNbnFd78vDM4/d1AtmTEnT:pgtUxgNhL7SMQ3gmTw
TLSH
T166E6AEF68C705652FE3A4C35DEA1AAA48D3578291F90CBCB2915718F63736F7603D288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-24976.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-24976.exe
Size 13.3MB
SHA256 04f69ae4e95505d1f1c02343e5505983ef765e4b14477d33f0c71cf83d0a157c
MD5 ff82f10142200160583c4081d89dc650
SHA1 75436651b9795c7286a53eb9717add60c4aa5e6f
SHA512 064fdc524599e9c1aebc843b4da641d92fa73c0b44fab33818de99f4bc57de7729e1f72cef39c261ed9df5475c79c6f25e6018b9e35ef8e415f6ee0825fd0253
SSDEEP 393216:/GSWJKKUxqnpNbnFd78vDM4nR1AtmPEnT:edjUxgphL7SMoLgmPw
TLSH
T13DE6AEF68C705652FE3A4C35DEA1AAA48D3578291F90CBCB2915718F63736F7603D288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-26103.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-26103.exe
Size 13.3MB
SHA256 8eb64d9ade1f63d47744d14ee817e5fd56dd11b26cd48ec9e6a7e36d4dee4dba
MD5 c899a801cd21e21864f796cb3f038d37
SHA1 5524740e75ec4ba1b4ce787b40f1748016cda843
SHA512 3ef6420177ab3576b46ed02266846cd47dd3b4447bfb444f651eb8741825298ad1e01ba119002b467539bc2873e236be3592eccb92e1e8886d094c6ff59c17e7
SSDEEP 393216:/GSWJEKUxqnpNbnFd78vDM4nR1AtmPEnT:edtUxgphL7SMoLgmPw
TLSH
T138E6AEF68C705652FE3A4C35DEA1AAA48D3578291F90CBCB2915718F63736F7603D288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-29750.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-29750.exe
Size 13.3MB
SHA256 9a9ad264ae9de34785b84a9c5ccef72fb4bc77436b4b928a564017dca65ce794
MD5 c4f62d8a1e45a4422e3d25e48c992297
SHA1 e7428af33bb06ab916337f87df35619c8b5d5cec
SHA512 7b90ff29f9d5c6687fb9b7c600752320ff001027b4dca327feb5e0d6e1e0649f727693716ed76170f9a96e038e79fa7178b4e9bda774876c7b63dfe697b10494
SSDEEP 393216:/GSTJEKUxqnNNbnFd78vDM4nR1AtmXEnT:egtUxgNhL7SMoLgmXw
TLSH
T15FE6AEF68C705652FE3A4C35DEA1AAA48D3578291F90CBCB2915718F63736F7603D288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-34327.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-34327.exe
Size 13.3MB
SHA256 a0a8f2644379289e026de55fecfccbf630ed16f42378a03bc0c4394befe25f0e
MD5 6e53e9c5b81b7f3a18b4121ec2940447
SHA1 fe6859fd37f4a4dbef8f5cce84c1be4e0dadefe2
SHA512 93d43ff09f528244ab5d32e496af16848feefbf453e72c2fe803edae7f8e96a82219540e4d62a7685e4920be6ca06069c99b3497e9d4693ae4c5525d6dedeabd
SSDEEP 393216:/GSxJEKUxqnNNbnFd78vDM4/R1AtmTEnT:eWtUxgNhL7SMQLgmTw
TLSH
T169E6AEF68C705652FE3A4C35DEA1AAA48D3578291F90CBCB2915718F63736F7603D288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-37128.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-37128.exe
Size 13.3MB
SHA256 c1369047b2af5449ba191719f98665f804c930f48803764655d2ed7319e49af8
MD5 bb3290cdee16578f11737936167d69c0
SHA1 33cdc5f8c5480d6a942f50432e9aba5cff3cdb78
SHA512 83a595a482eb9c9741faa11bbe283e0f3861a3ede85e3322f15ee27eccbaa08bec4923339dbc717439f1be69aaaee6fe267e05e43dcd5a3e4fd1aa13362bda22
SSDEEP 393216:/GSTJEKUxqnNNbnFd78vDM4/R1AtmTERT:egtUxgNhL7SMQLgmTa
TLSH
T1E5E6AEF68C705652FE3A4C35DEA1AAA48D3578291F90CBCB2915718F63736F7603D288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-39839.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-39839.exe
Size 13.3MB
SHA256 37c7b79382d5fccdc6ee42c835900fe7b6e2f7bef061bea13ae0f948ee66dfa9
MD5 290e3ca6d28187173f7325136a707701
SHA1 25a8f5953462a75d42393c169e6c534a363661fc
SHA512 a5f7b7fd69fa5f905903c7146ac8dd83326f92b8b02966da418c192335d0967736a4fe73d090669fbdf0a31fb1c0d035237b63a15f4ab46f1b43c0a51a94eadf
SSDEEP 393216:/GSTJEKUxqnNNbnFd78vDM4nR1AtmPERT:egtUxgNhL7SMoLgmP6
TLSH
T1F8E6AEF68C705652FE3A4C35DEA1AAA48D3578291F90CBCB2915718F63736F7603D288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-42993.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42993.exe
Size 13.3MB
SHA256 04bfa6a7ba0820bed84b22ecf5f15e793161fdf4af681aa463a995638e9ecca7
MD5 4203e35968f54b5fcd0d7741bb5c1823
SHA1 39ea0e1b8db370c50978a054f4eb987f2c8d177a
SHA512 24fa71ac1905aa8617841de6fa285cbba8002c51ef297be8fd787f128d499ed64d0737cc686c44b04a9262c8a27358c7214bcdb1199906f313918a74edd4c138
SSDEEP 393216:/GSTJEKUxqnNNbnFd78vDM4nR1A1mTEnT:egtUxgNhL7SMoL4mTw
TLSH
T199E6AEF68C705652FE3A4C35DEA1AAA48D3578291F90CBCB2915718F63736F7603D288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-43258.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-43258.exe
Size 13.3MB
SHA256 0d62dbf65482e59c7490504d4a67330bb2f1457bc5e4ecdcca1769ad5d012f44
MD5 467ec0498dbea3554f81357e063de1f7
SHA1 7413fa3b82b0560c34c5a7f75d59f149d6ab8fd1
SHA512 21fc4db0612b8c06cf9fd0fc16a924546f68ab94837a6e66ac927eb6338d5dd72afac0eae44427c37658fa3dff701f7bf019c13f2fbfbcc9e86164db306db655
SSDEEP 393216:/GSTwEKUxqnNNbnFd78vDM4/d1AtmTEnT:egAUxgNhL7SMQ3gmTw
TLSH
T155E6AEF68C705652FE3A4C35DEA1AAA48D3578291F90CBCB2915718F63736F7603D288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-44759.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-44759.exe
Size 13.3MB
SHA256 44f5f06d43bacc5e4fd54b57b0fdf529c347ef2b564436a90cfd21a25068470e
MD5 279606f1f965d5312599413a8522693b
SHA1 afbde7060796fb0555ba28a11f66bb35ad09f628
SHA512 9909c0ec708fc8c072fc0107ae1b54cd9e3ed1cd2dc24006ceb994de110ef174df6180ce34217dad0f6e8c340f49443a02ff1db9f7ad345142c5193e381db923
SSDEEP 393216:/GSTJEKUxqnNNbnBd7MvDM4nR1AtmTEnT:egtUxgNh/7CMoLgmTw
TLSH
T118E6AEF68C705652FE3A4C35DEA1AAA48D3578291F90CBCB2915718F63736F7603D288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-45840.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-45840.exe
Size 13.3MB
SHA256 6c6516aabfe05e5dbe218451cd368228a278149f84cec90e2e8546b0edb4b975
MD5 fd34fa8f57c9332bcd758b3cefc3f157
SHA1 1746ebd8626a568fa38f0bd0d07fa597216b03f5
SHA512 75300e86e29d5d63d6340d7e8b01f89cb9a1e93a3089b1b29dc44bd0469c8bf1761f0dfee6d201ef20dfc084d3a7344c66712e69fd550b32d50f5ce210cef5ac
SSDEEP 393216:/GSTJEKUxqnNNbnFd78vDM4/R1AtmTERT:egtUxgNhL7SMQLgmTa
TLSH
T1E0E6AEF68C705652FE3A4C35DEA1AAA48D3578291F90CBCB2915718F63736F7603D288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-45969.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-45969.exe
Size 13.3MB
SHA256 bf9dd6c1e97cda93382c90a4cd81e950c7c20293933f78e07209378f77d80d7f
MD5 8ca3c09c4c9d9efcdfb5e70eb444d38e
SHA1 a27c9529e0e8ca1ef35b4a88a364be97e61f0466
SHA512 31a1a812cd4c3e962f413907814b918d6b9e15b61ad48a9cba47f72d1be28b0079519c182622c99724f63f66ede0eab6e429c7426599aed85b91b5e390efbe55
SSDEEP 393216:/GSWJEKUxqnNNbnBd78v8M4nR1AtmPEnT:edtUxgNh/7xMoLgmPw
TLSH
T19EE6AEF68C705652FE3A4C35DEA1AAA48D3578291F90CBCB2915718F63736F7603D288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-4942.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-4942.exe
Size 13.3MB
SHA256 6fdace4dc428d09c16b59c43004f31b3d734b0ebe23d4c773e82f4660f5af316
MD5 9a252d6105fa3502be753b65c33ae959
SHA1 c2131fe7fadb5d5046ad50167df81d08a4f90a2c
SHA512 3225d93455b09c32c5718a03a2151c8bedffc72e09679f5930962184100e8080f3823462930690645bad3edc2ba094b3a690a80fb3bf9bf509f200d9245ed8d4
SSDEEP 393216:/GSTJEKUxqnNNbnBd78vDM4nR1AtmTEnT:egtUxgNh/7SMoLgmTw
TLSH
T1D5E6AEF68C705652FE3A4C35DEA1AAA48D3578291F90CBCB2915718F63736F7603D288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-49690.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-49690.exe
Size 13.3MB
SHA256 4c8dca557355ffd1a44361e258e0ec00dcc2b522ad63aad05610e6c097122343
MD5 aec1bb77f2d570ab08888ffc917147e5
SHA1 b7c77d4055395651102ac2269e3e83768718b0b5
SHA512 373b265781ee48fcfae6e058d4dc64e6be9793d9869f131207914ea1aa90790354302a3da5de47f10abd930985ccb9de8d2aba9a12fa2511351d8a177a8766f3
SSDEEP 393216:/GSTJEKUxqnNNbnFd78vDM4nR1AtmTEnT:egtUxgNhL7SMoLgmTw
TLSH
T1BCE6AEF68C705652FE3A4C35DEA1AAA48D3578291F90CBCB2915718F63736F7603D288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-51666.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-51666.exe
Size 13.3MB
SHA256 f61ad6de2ec9955784505a776f97da05542eac5af8a72eb5eeeea5ebf7784de7
MD5 07bed98cedff7c9094faef0a4be0ede5
SHA1 4682fd91d3524d6d140df6195f0aedb712bb76f6
SHA512 238949f4a743d34760e3e3b2969c93f5f942823cea80019d69f6aa29b24de4599d3b99bfece59d62360d75fdbeb4713db835594171bfd6c30c02268d873e0a46
SSDEEP 393216:/GSTrEKUxqnNNbnFd78vDM4/d1AtmTEnT:egDUxgNhL7SMQ3gmTw
TLSH
T18BE6AEF68C705652FE3A4C35DEA1AAA48D3578291F90CBCB2915718F63736F7603D288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-56554.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-56554.exe
Size 13.3MB
SHA256 679251a75f3e7becb35db05ed2e7488b84ce09242ba8bcde2e70c50826754fc3
MD5 d381931315a36f22a11b819903c12108
SHA1 c6081198e60e0ad0546d2a2209971e927c0401cf
SHA512 088d1b706ed7f4e45f32d56c2b84a45785b898d7d86a8f3c2b96dd237a1305386eb61c24f93ac77c2a5c26073b4baa1572d46ae80fdd8fb35c7ac7057e424731
SSDEEP 393216:/xSTJEKUxqnNNbnFd78vDM4/R1AtmTEnT:JgtUxgNhL7SMQLgmTw
TLSH
T1B1E6AEF68C705652FE3A4C35DEA1AAA48D3578291F90CBCB2915718F63736F7603D288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-60663.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-60663.exe
Size 13.3MB
SHA256 d4960069e0c6ebe9891357ea42044a4d4bc4beee9d215b0acf6b9da1f59276db
MD5 8d0e69c5e94ec71e6fa313d69fc670bd
SHA1 3b5a6091ca9ad6f78e9d12d24a693337e40301d3
SHA512 c33ea1784a850f3b537541d5de274bf4a5fbd5b611877b075653d47da6e3e316763bb1d66a00afae70ad38c5b795e91e7358c6beef3c9ef7229f36543bf3bafc
SSDEEP 393216:/8STJEKUxqnNNbnFd7MvDM4/R1AtmTEvT:EgtUxgNhL7CMQLgmTI
TLSH
T1DDE6AEF68C705652FE3A4C35DEA1AAA48D3578291F90CBCB2915718F63736F7603D288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-61138.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-61138.exe
Size 13.3MB
SHA256 bb62cb05036ef9c9142554dbdad3c59ea4519b46978f4ca38c0b9fa43ded9e33
MD5 1fcb41c7525cec54292a77a759780b00
SHA1 2d937c71d593a4bf53b118f75b1a12ad56900b9e
SHA512 e3cc43de35e6e4b6c7082716feaa12d0f835d6060dc2aeb9aa991db34775be7ed6041ae1a61bea7c1686816e4251d1b49461f4f71bdc29bb8a4df5a90d1d3efc
SSDEEP 393216:/GSTJEKUxqnNNbnFd78vDM4nR1AtmPEnT:egtUxgNhL7SMoLgmPw
TLSH
T1E7E6AEF68C705652FE3A4C35DEA1AAA48D3578291F90CBCB2915718F63736F7603D288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-63095.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-63095.exe
Size 13.3MB
SHA256 f51ed8ed91c5f847f7637f01277458018dfd5b7727e7069b8ea593e0fdc39dcf
MD5 07eaa286cd4fc405cad9267f8e8dd2d1
SHA1 07ab899bf15416f6b9237964b1a4064a27079bb2
SHA512 9084e04461f915d7e90bac3a2c712b36535fc091b1aa0ac828c55b5561494aa21188c35185fc159db707dfada11445fda6c04bb918229c5cfab5d38240e11823
SSDEEP 393216:/GSTJEKUxqnNNbnFd78vDM4/R1AtmTEvT:egtUxgNhL7SMQLgmTI
TLSH
T1DDE6AEF68C705652FE3A4C35DEA1AAA48D3578291F90CBCB2915718F63736F7603D288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-64390.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-64390.exe
Size 13.3MB
SHA256 e429cd2994c8b6e261f86eda5a1cf3f68b965b2ad49493902c5af39ac48cbaeb
MD5 aaff9391f7d238deae7e17b6e0c00dee
SHA1 2cf6422c77f5943a7f20f58a8d7d903336dac612
SHA512 ef1637b1d559d84c4246f0b6c4dcbd01f51098ad609eb0d6433fa5a7033d9cf016a308363c704673d9fc0098e0e012a993a40255dddfb1289cead44f83873369
SSDEEP 393216:/GSWJEKUxqnNNbnBd78vDM4nR1AtmPEnT:edtUxgNh/7SMoLgmPw
TLSH
T12FE6AEF68C705652FE3A4C35DEA1AAA48D3578291F90CBCB2915718F63736F7603D288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-9625.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-9625.exe
Size 13.3MB
SHA256 9b9bcc2c12c98e5dba851e69189fa830f746cca4191ea84a32aebc86b4f08014
MD5 8a21af289c6d11cbba319cee81f0a8ad
SHA1 53bfaa451a546bc3c52ffbdf55d76451181d8279
SHA512 89cd9fac3067cf58d09103a0bd42ae3f97ff0dfff3374b22e44ec68ae5c6d1e883b4c7658c50da3f0cde15d6d391773707d773c404662cb2bd8505bc02bec1fb
SSDEEP 393216:/GhTJEKUxqnNNbnFd78v2M4nR1AtmXEnT:eNtUxgNhL7/MoLgmXw
TLSH
T190E6AEF68C705652FE3A4C35DEA1AAA48D3578291F90CBCB2915718F63736F7603D288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-48441.exe

Path \??\Volume{0c051f61-0000-0000-0000-d08302000000}\Users\Admin\AppData\Local\Temp\Unicorn-48441.exe
Size 13.3MB
SHA256 9b31e1fbdf534fed6f329eba04fc9a9b823b7e67b1cee28d4d401efa05558f46
MD5 f70d3b268a7a59e56e368d9a725600ae
SHA1 faa128cc98faead221c54a25239ee561dc9cc41e
SHA512 93f03be25021d6236c9fdba596ea1a33f6776cb0b9e031d9deb4a23a60c11e5c2c282b4d9b28872363da1071d0167ae2a0ecf8e717af635784c96515bdcb2f59
SSDEEP 393216:/GSTJEKUxqnNNbnFd78vDM4nR1At+PERT:egtUxgNhL7SMoLg+P6
TLSH
T179E6AEF68C705652FE3A4C35DEA1AAA48D3578291F90CBCB2915718F63736F7603D288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/616-281-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1000-1124-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1352-62-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2084-482-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2200-2306-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2204-551-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2628-397-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2688-547-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2844-1081-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2924-256-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2940-1876-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3332-1033-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3396-1231-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3396-0-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3432-262-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3856-257-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3888-483-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4524-590-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4544-398-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5148-1122-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5764-1057-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6088-1699-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6108-291-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6116-1345-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6220-926-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6288-1121-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6356-1006-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6412-787-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6444-1157-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6464-1156-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6472-823-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6616-824-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6712-990-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6736-984-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6784-1059-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6872-1083-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6920-979-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6952-1158-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7160-981-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7180-1159-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7200-1185-0x0000000000400000-0x0000000000475000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads