kawaiiunicorn | e9f7eddee606b91974fce75b1a77253c92651fb4c3acd7cfd74ea2ee4baf6131

Analysis

max time kernel
147s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_9b5b27bbc8a59fc37981920789f61dac_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe
Size 7.7MB
Sample260717-sd2stady9p
SHA256 e9f7eddee606b91974fce75b1a77253c92651fb4c3acd7cfd74ea2ee4baf6131
MD5 9b5b27bbc8a59fc37981920789f61dac
SHA1 9319725bc485631ed13f0737adce475a9c20765a
SHA512 f8e71e22e9d6b90829dd28559630dc4bfdbff0c94d06e2b9adecea5deef1519b019e4a4cfb32895ad6d569951db4f1dd6c472cd5b539fd115fa2797cb49f60a3
SSDEEP 196608:C2bnLDjz6pqZP0vi/Mn/R15fmmpLDHgWKL6qw:pbnzzV8v4Mn/R1FtnXE
TLSH
T15786F0369AA01F95F433913403E6C551EA2E7C3A232047CF7798F6962BB32E1547E62D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery kawaiiunicorn trojan

Malware Config

Signatures

Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
trojan kawaiiunicorn

Detects KawaiiUnicorn 64 IoCs

resource	yara_rule
behavioral2/memory/5684-0-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5680-52-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5884-96-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5560-112-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4428-214-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/700-172-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1988-265-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3920-266-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5096-264-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2540-274-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2808-489-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1460-454-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4136-434-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/976-433-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1016-432-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6068-404-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5136-403-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5532-402-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3904-510-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6196-768-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1928-700-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5836-647-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3684-648-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6024-649-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/980-623-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/428-401-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1020-357-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1364-316-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3640-781-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1996-780-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6608-862-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6952-996-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5804-994-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6880-993-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7104-991-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6928-1075-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6888-1185-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6864-1311-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7596-1310-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7196-1260-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6476-1258-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6832-1312-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6316-1308-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6960-1307-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6840-1256-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6812-1254-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6912-1253-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7460-1306-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6936-1183-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6652-1406-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6444-1405-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6824-1435-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7908-1431-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7880-1430-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7864-1429-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7852-1428-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6736-1353-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7388-1604-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6504-1502-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6596-1501-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6296-1500-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7548-1499-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7944-1498-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6556-1497-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 31 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c526-6.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000e00000001c527-11.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c52a-19.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c52b-29.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c52d-35.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c52c-43.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c52e-48.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c532-73.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c533-76.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c534-93.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c535-91.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c530-78.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c531-77.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c537-106.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c536-113.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c538-124.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c539-129.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c53b-148.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c53a-163.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c540-192.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c542-195.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c53e-215.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c53d-204.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c544-200.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c53c-199.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c541-208.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c53f-196.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c543-177.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c546-176.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c545-171.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c54e-227.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Executes dropped EXE 11 IoCs

pid	Process
3600	Unicorn-53764.exe
2904	Unicorn-34662.exe
4232	Unicorn-21319.exe
4412	Unicorn-666.exe
3896	Unicorn-38684.exe
2932	Unicorn-31947.exe
5680	Unicorn-61033.exe
464	Unicorn-16052.exe
2188	Unicorn-5191.exe
4404	Unicorn-31834.exe
5528	Unicorn-18247.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16052.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53764.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21319.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31947.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31834.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5191.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18247.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_9b5b27bbc8a59fc37981920789f61dac_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34662.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38684.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
5684	2026-07-17_9b5b27bbc8a59fc37981920789f61dac_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe
3600	Unicorn-53764.exe
2904	Unicorn-34662.exe
4232	Unicorn-21319.exe
4412	Unicorn-666.exe
3896	Unicorn-38684.exe
2932	Unicorn-31947.exe
5680	Unicorn-61033.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5684 wrote to memory of 3600	5684	2026-07-17_9b5b27bbc8a59fc37981920789f61dac_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe	89
PID 3600 wrote to memory of 2904	3600	Unicorn-53764.exe	90
PID 5684 wrote to memory of 4232	5684	2026-07-17_9b5b27bbc8a59fc37981920789f61dac_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe	91
PID 2904 wrote to memory of 4412	2904	Unicorn-34662.exe	92
PID 4232 wrote to memory of 3896	4232	Unicorn-21319.exe	93
PID 3600 wrote to memory of 2932	3600	Unicorn-53764.exe	94
PID 5684 wrote to memory of 5680	5684	2026-07-17_9b5b27bbc8a59fc37981920789f61dac_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe	95
PID 2904 wrote to memory of 464	2904	Unicorn-34662.exe	96
PID 4412 wrote to memory of 2188	4412	Unicorn-666.exe	97
PID 2932 wrote to memory of 4404	2932	Unicorn-31947.exe	98
PID 5684 wrote to memory of 5528	5684	2026-07-17_9b5b27bbc8a59fc37981920789f61dac_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe	99
PID 4232 wrote to memory of 6128	4232	Unicorn-21319.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-07-17_9b5b27bbc8a59fc37981920789f61dac_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_9b5b27bbc8a59fc37981920789f61dac_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5684
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53764.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53764.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34662.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34662.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-666.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5191.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11922.exe
        6⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42469.exe
        7⤵
        
        PID:1364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34380.exe
        8⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62408.exe
        9⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29700.exe
        10⤵
        
        PID:8516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8997.exe
        11⤵
        
        PID:7284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36033.exe
        10⤵
        
        PID:7496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46482.exe
        9⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27210.exe
        9⤵
        
        PID:11636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63923.exe
        8⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35588.exe
        7⤵
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9647.exe
        8⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45183.exe
        9⤵
        
        PID:10444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7878.exe
        8⤵
        
        PID:11620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16481.exe
        7⤵
        
        PID:9172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51590.exe
        6⤵
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13876.exe
        7⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14385.exe
        8⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65314.exe
        8⤵
        
        PID:9688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8544.exe
        8⤵
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3430.exe
        7⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20081.exe
        6⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44567.exe
        7⤵
        
        PID:8940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56576.exe
        8⤵
        
        PID:10872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31147.exe
        7⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18645.exe
        8⤵
        
        PID:12124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40849.exe
        7⤵
        
        PID:11704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28241.exe
        6⤵
        
        PID:8976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15061.exe
        6⤵
        
        PID:8788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43203.exe
        5⤵
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-690.exe
        6⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34427.exe
        7⤵
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41604.exe
        8⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21812.exe
        9⤵
        
        PID:9220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59267.exe
        10⤵
        
        PID:11936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49817.exe
        9⤵
        
        PID:11468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34400.exe
        8⤵
        
        PID:9604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24711.exe
        8⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14940.exe
        7⤵
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24329.exe
        7⤵
        
        PID:9876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59979.exe
        6⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44484.exe
        7⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2697.exe
        8⤵
        
        PID:10984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60912.exe
        6⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36929.exe
        7⤵
        
        PID:8424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21095.exe
        6⤵
        
        PID:10972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45214.exe
        5⤵
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57561.exe
        6⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8495.exe
        7⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44303.exe
        8⤵
        
        PID:10844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24016.exe
        6⤵
        
        PID:7900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5656.exe
        5⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43197.exe
        6⤵
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39145.exe
        7⤵
        
        PID:10820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57420.exe
        7⤵
        
        PID:13200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64038.exe
        6⤵
        
        PID:10384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49664.exe
        5⤵
        
        PID:9204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4614.exe
        6⤵
        
        PID:10372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58551.exe
        6⤵
        
        PID:13128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6497.exe
        5⤵
        
        PID:10736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11386.exe
        5⤵
        
        PID:13144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16052.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26614.exe
        5⤵
        
        PID:4428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10311.exe
        6⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41910.exe
        7⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29492.exe
        8⤵
        
        PID:9416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60237.exe
        8⤵
        
        PID:10880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43305.exe
        7⤵
        
        PID:9796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30064.exe
        7⤵
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40113.exe
        6⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36586.exe
        7⤵
        
        PID:8736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64430.exe
        7⤵
        
        PID:4916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21951.exe
        6⤵
        
        PID:7364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64306.exe
        7⤵
        
        PID:7216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42763.exe
        6⤵
        
        PID:5896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50254.exe
        5⤵
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4551.exe
        6⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55527.exe
        7⤵
        
        PID:9640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16323.exe
        7⤵
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17810.exe
        6⤵
        
        PID:9544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52784.exe
        6⤵
        
        PID:7376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11825.exe
        5⤵
        
        PID:6840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60908.exe
        5⤵
        
        PID:8080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57154.exe
        5⤵
        
        PID:11840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32735.exe
      4⤵
      PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43560.exe
        5⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1899.exe
        6⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62408.exe
        7⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45024.exe
        8⤵
        
        PID:9944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe
        7⤵
        
        PID:10184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6598.exe
        7⤵
        
        PID:12740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41364.exe
        6⤵
        
        PID:7972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12533.exe
        7⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15577.exe
        7⤵
        
        PID:12360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59823.exe
        5⤵
        
        PID:4184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19591.exe
        6⤵
        
        PID:8760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63439.exe
        7⤵
        
        PID:11396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44441.exe
        6⤵
        
        PID:10724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49231.exe
        5⤵
        
        PID:812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37374.exe
      4⤵
      PID:4848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13596.exe
        5⤵
        
        PID:6608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59258.exe
        6⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56358.exe
        7⤵
        
        PID:11072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44437.exe
        5⤵
        
        PID:6216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60364.exe
      4⤵
      PID:3220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31947.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31947.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31834.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60931.exe
        5⤵
        
        PID:1860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5918.exe
        6⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11764.exe
        7⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38376.exe
        8⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5807.exe
        8⤵
        
        PID:9816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52915.exe
        8⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28240.exe
        7⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52346.exe
        8⤵
        
        PID:9592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8129.exe
        8⤵
        
        PID:11568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26537.exe
        7⤵
        
        PID:9472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58649.exe
        7⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1027.exe
        6⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16716.exe
        7⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22004.exe
        8⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6205.exe
        9⤵
        
        PID:11088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12802.exe
        7⤵
        
        PID:9368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39834.exe
        6⤵
        
        PID:8220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14339.exe
        7⤵
        
        PID:5812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62015.exe
        6⤵
        
        PID:10228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23407.exe
        6⤵
        
        PID:12924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51590.exe
        5⤵
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48002.exe
        6⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4551.exe
        7⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21018.exe
        8⤵
        
        PID:8804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47835.exe
        9⤵
        
        PID:11440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13963.exe
        8⤵
        
        PID:12244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56788.exe
        7⤵
        
        PID:10164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6598.exe
        7⤵
        
        PID:7180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55459.exe
        6⤵
        
        PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17559.exe
        5⤵
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51303.exe
        6⤵
        
        PID:9644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59267.exe
        7⤵
        
        PID:11492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16329.exe
        6⤵
        
        PID:10520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14919.exe
        5⤵
        
        PID:9008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49646.exe
        6⤵
        
        PID:10928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45150.exe
      4⤵
      PID:700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62218.exe
        5⤵
        
        PID:2540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50467.exe
        6⤵
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30592.exe
        7⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3503.exe
        8⤵
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28685.exe
        8⤵
        
        PID:11876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21510.exe
        7⤵
        
        PID:9860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40212.exe
        6⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56446.exe
        7⤵
        
        PID:6508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1027.exe
        5⤵
        
        PID:5104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15901.exe
        6⤵
        
        PID:7164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65314.exe
        6⤵
        
        PID:10200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10682.exe
        6⤵
        
        PID:7472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47295.exe
        5⤵
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41822.exe
        6⤵
        
        PID:10128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32184.exe
        7⤵
        
        PID:12344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26142.exe
        6⤵
        
        PID:236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37385.exe
        5⤵
        
        PID:9760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61046.exe
        5⤵
        
        PID:12104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65325.exe
      4⤵
      PID:5816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2501.exe
        5⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38568.exe
        6⤵
        
        PID:6812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9315.exe
        6⤵
        
        PID:8632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-507.exe
        6⤵
        
        PID:6540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3435.exe
        5⤵
        
        PID:7112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58589.exe
        6⤵
        
        PID:10172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45609.exe
        5⤵
        
        PID:8924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12463.exe
        5⤵
        
        PID:11528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13611.exe
      4⤵
      PID:5552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24282.exe
        5⤵
        
        PID:7596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59792.exe
        5⤵
        
        PID:10888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23798.exe
        5⤵
        
        PID:12756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11350.exe
      4⤵
      PID:7072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65242.exe
        5⤵
        
        PID:10304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64598.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64598.exe
    3⤵
    PID:5884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30890.exe
      4⤵
      PID:1700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27299.exe
        5⤵
        
        PID:1324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60171.exe
        6⤵
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52875.exe
        7⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29923.exe
        8⤵
        
        PID:8668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42552.exe
        9⤵
        
        PID:11548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6669.exe
        8⤵
        
        PID:10288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18939.exe
        8⤵
        
        PID:12800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30534.exe
        7⤵
        
        PID:9976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12628.exe
        7⤵
        
        PID:12264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60913.exe
        6⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-924.exe
        7⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26675.exe
        8⤵
        
        PID:11128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37151.exe
        7⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45064.exe
        6⤵
        
        PID:9116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15260.exe
        6⤵
        
        PID:11956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65002.exe
        5⤵
        
        PID:1412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21547.exe
        6⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49928.exe
        7⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27615.exe
        7⤵
        
        PID:8008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17893.exe
        6⤵
        
        PID:2520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35510.exe
        6⤵
        
        PID:7956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54996.exe
        5⤵
        
        PID:6952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62543.exe
        6⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22874.exe
        7⤵
        
        PID:11352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26059.exe
        6⤵
        
        PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16860.exe
        5⤵
        
        PID:6164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58536.exe
        5⤵
        
        PID:7256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31478.exe
      4⤵
      PID:428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46378.exe
        5⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46155.exe
        6⤵
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42885.exe
        6⤵
        
        PID:10908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-415.exe
        5⤵
        
        PID:6696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56005.exe
        6⤵
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21431.exe
        6⤵
        
        PID:13104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65328.exe
      4⤵
      PID:6308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43130.exe
        5⤵
        
        PID:8876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43617.exe
        5⤵
        
        PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19377.exe
      4⤵
      PID:9736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15551.exe
        5⤵
        
        PID:11792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27264.exe
      4⤵
      PID:6848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16234.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16234.exe
    3⤵
    PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
      4⤵
      PID:1328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54800.exe
        5⤵
        
        PID:1848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49964.exe
        6⤵
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48475.exe
        7⤵
        
        PID:4692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43887.exe
        5⤵
        
        PID:2140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
        6⤵
        
        PID:5052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15438.exe
      4⤵
      PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28558.exe
        5⤵
        
        PID:7560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56361.exe
      4⤵
      PID:8044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-883.exe
        5⤵
        
        PID:10280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42030.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42030.exe
    3⤵
    PID:1296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27577.exe
      4⤵
      PID:6660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63062.exe
        5⤵
        
        PID:9152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14728.exe
        5⤵
        
        PID:9904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54354.exe
      4⤵
      PID:8748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7971.exe
      4⤵
      PID:13024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60632.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60632.exe
    3⤵
    PID:3400
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21319.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21319.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38684.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38684.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5191.exe
      4⤵
      PID:4168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10277.exe
        5⤵
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
        6⤵
        
        PID:1228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58692.exe
        7⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59533.exe
        8⤵
        
        PID:8752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62938.exe
        9⤵
        
        PID:10468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42682.exe
        7⤵
        
        PID:8368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43779.exe
        8⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20357.exe
        7⤵
        
        PID:10272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27690.exe
        6⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59149.exe
        7⤵
        
        PID:8740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33311.exe
        7⤵
        
        PID:10348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61270.exe
        6⤵
        
        PID:8896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63348.exe
        7⤵
        
        PID:10260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48500.exe
        5⤵
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42678.exe
        6⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25647.exe
        7⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20785.exe
        8⤵
        
        PID:10396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51080.exe
        7⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12416.exe
        7⤵
        
        PID:13076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3892.exe
        6⤵
        
        PID:788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4565.exe
        6⤵
        
        PID:11808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32354.exe
        5⤵
        
        PID:6268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49741.exe
        6⤵
        
        PID:844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24514.exe
        7⤵
        
        PID:12132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38464.exe
        6⤵
        
        PID:11920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2688.exe
        5⤵
        
        PID:9404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5635.exe
        5⤵
        
        PID:10768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46712.exe
      4⤵
      PID:972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-581.exe
        5⤵
        
        PID:1016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32865.exe
        6⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49964.exe
        7⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56015.exe
        7⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48275.exe
        7⤵
        
        PID:13068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45043.exe
        6⤵
        
        PID:8272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58774.exe
        7⤵
        
        PID:10176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21095.exe
        6⤵
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37695.exe
        5⤵
        
        PID:1864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18418.exe
        6⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19249.exe
        7⤵
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17083.exe
        8⤵
        
        PID:11824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33091.exe
        7⤵
        
        PID:12392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49653.exe
        6⤵
        
        PID:11144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14123.exe
        6⤵
        
        PID:13060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58172.exe
        5⤵
        
        PID:8320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21095.exe
        5⤵
        
        PID:1528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6201.exe
        5⤵
        
        PID:12676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48914.exe
      4⤵
      PID:4136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5921.exe
        5⤵
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52294.exe
        6⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56103.exe
        7⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18188.exe
        8⤵
        
        PID:10940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28685.exe
        7⤵
        
        PID:11888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43466.exe
        6⤵
        
        PID:9448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27210.exe
        6⤵
        
        PID:10640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11131.exe
        5⤵
        
        PID:7644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38220.exe
      4⤵
      PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48018.exe
        5⤵
        
        PID:7800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47546.exe
        5⤵
        
        PID:10856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45310.exe
      4⤵
      PID:7944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1542.exe
        5⤵
        
        PID:2024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50863.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50863.exe
    3⤵
    PID:6128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63624.exe
      4⤵
      PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59670.exe
        5⤵
        
        PID:120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27408.exe
        6⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5542.exe
        7⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47447.exe
        8⤵
        
        PID:980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49533.exe
        9⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64068.exe
        9⤵
        
        PID:11112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26149.exe
        9⤵
        
        PID:12592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15469.exe
        8⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26771.exe
        8⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19714.exe
        9⤵
        
        PID:12092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24758.exe
        8⤵
        
        PID:12808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51593.exe
        7⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51941.exe
        8⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30269.exe
        9⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34141.exe
        8⤵
        
        PID:10420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22914.exe
        8⤵
        
        PID:13096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        7⤵
        
        PID:7840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7743.exe
        7⤵
        
        PID:10548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11826.exe
        6⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20369.exe
        7⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61531.exe
        7⤵
        
        PID:9260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37709.exe
        7⤵
        
        PID:11784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59547.exe
        6⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3550.exe
        7⤵
        
        PID:9616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42774.exe
        7⤵
        
        PID:7264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19019.exe
        6⤵
        
        PID:8476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49984.exe
        6⤵
        
        PID:11752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3458.exe
        5⤵
        
        PID:4140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51702.exe
        6⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28153.exe
        7⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47520.exe
        8⤵
        
        PID:8952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53286.exe
        9⤵
        
        PID:10316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12097.exe
        8⤵
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16362.exe
        7⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16260.exe
        8⤵
        
        PID:10556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24763.exe
        7⤵
        
        PID:9748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3849.exe
        7⤵
        
        PID:2532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20539.exe
        6⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29197.exe
        7⤵
        
        PID:11740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48587.exe
        5⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60078.exe
        6⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5408.exe
        7⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53336.exe
        7⤵
        
        PID:12932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20015.exe
        5⤵
        
        PID:6264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60800.exe
        6⤵
        
        PID:12084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46748.exe
        5⤵
        
        PID:5252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52057.exe
      4⤵
      PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14854.exe
        5⤵
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44136.exe
        6⤵
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34868.exe
        7⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63524.exe
        8⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-803.exe
        9⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28685.exe
        8⤵
        
        PID:10936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43913.exe
        6⤵
        
        PID:6824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25230.exe
        5⤵
        
        PID:2128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33689.exe
        6⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32829.exe
        7⤵
        
        PID:8640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44656.exe
        8⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61163.exe
        7⤵
        
        PID:5988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48956.exe
        6⤵
        
        PID:10032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39397.exe
        7⤵
        
        PID:11604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14876.exe
        6⤵
        
        PID:6500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39703.exe
        5⤵
        
        PID:6412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35746.exe
        6⤵
        
        PID:11096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30177.exe
        5⤵
        
        PID:9776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21281.exe
        6⤵
        
        PID:7488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3798.exe
        5⤵
        
        PID:6492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10019.exe
      4⤵
      PID:976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6113.exe
        5⤵
        
        PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-576.exe
        5⤵
        
        PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33481.exe
        5⤵
        
        PID:7344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38220.exe
      4⤵
      PID:1996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7727.exe
        5⤵
        
        PID:7852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56756.exe
        5⤵
        
        PID:10408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42210.exe
        5⤵
        
        PID:13088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32154.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32154.exe
      4⤵
      PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48797.exe
        5⤵
        
        PID:2064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2256.exe
        5⤵
        
        PID:12668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53949.exe
      4⤵
      PID:5304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21059.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21059.exe
    3⤵
    PID:6064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5918.exe
      4⤵
      PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37421.exe
        5⤵
        
        PID:4320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46305.exe
        6⤵
        
        PID:7064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50773.exe
        5⤵
        
        PID:7132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36221.exe
      4⤵
      PID:3644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8739.exe
        5⤵
        
        PID:7124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1858.exe
        6⤵
        
        PID:3704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23973.exe
        6⤵
        
        PID:7580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12802.exe
        5⤵
        
        PID:8484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42412.exe
        6⤵
        
        PID:11424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36741.exe
        5⤵
        
        PID:10360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53948.exe
      4⤵
      PID:8060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64640.exe
        5⤵
        
        PID:9480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5653.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5653.exe
    3⤵
    PID:1824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23799.exe
      4⤵
      PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37603.exe
        5⤵
        
        PID:6556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24480.exe
        6⤵
        
        PID:9996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49807.exe
        6⤵
        
        PID:13120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24016.exe
      4⤵
      PID:7908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22652.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22652.exe
    3⤵
    PID:5984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49040.exe
      4⤵
      PID:6904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35216.exe
        5⤵
        
        PID:9536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37102.exe
        5⤵
        
        PID:11596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10773.exe
      4⤵
      PID:7528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64159.exe
      4⤵
      PID:8040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14638.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14638.exe
    3⤵
    PID:3572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29762.exe
      4⤵
      PID:8116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12360.exe
        5⤵
        
        PID:11404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31887.exe
      4⤵
      PID:11676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28892.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28892.exe
    3⤵
    PID:9088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50280.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50280.exe
    3⤵
    PID:3552
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61033.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61033.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39674.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39674.exe
    3⤵
    PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47994.exe
      4⤵
      PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49782.exe
        5⤵
        
        PID:248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55724.exe
        6⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62361.exe
        7⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14027.exe
        8⤵
        
        PID:8948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37834.exe
        8⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26149.exe
        7⤵
        
        PID:10004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64664.exe
        8⤵
        
        PID:8068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42421.exe
        7⤵
        
        PID:11904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49019.exe
        6⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56197.exe
        7⤵
        
        PID:10432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8489.exe
        6⤵
        
        PID:10328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42210.exe
        6⤵
        
        PID:12868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47426.exe
        5⤵
        
        PID:2424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35439.exe
        6⤵
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34084.exe
        6⤵
        
        PID:2356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46413.exe
        5⤵
        
        PID:8208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37033.exe
        6⤵
        
        PID:11160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55413.exe
        5⤵
        
        PID:4564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24763.exe
      4⤵
      PID:6068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14198.exe
        5⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63560.exe
        6⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33950.exe
        7⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
        8⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54124.exe
        7⤵
        
        PID:7516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65314.exe
        6⤵
        
        PID:10120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50222.exe
        6⤵
        
        PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60223.exe
        5⤵
        
        PID:8408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32499.exe
        6⤵
        
        PID:11948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4322.exe
        5⤵
        
        PID:10336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10289.exe
      4⤵
      PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59559.exe
        5⤵
        
        PID:7864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6129.exe
        6⤵
        
        PID:9956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37696.exe
      4⤵
      PID:8604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-800.exe
        5⤵
        
        PID:7056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65352.exe
      4⤵
      PID:3320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5909.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5909.exe
      4⤵
      PID:13188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3872.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3872.exe
    3⤵
    PID:2812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35776.exe
      4⤵
      PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13077.exe
        5⤵
        
        PID:6912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45460.exe
        6⤵
        
        PID:8492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34418.exe
        6⤵
        
        PID:2736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2351.exe
        5⤵
        
        PID:8140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51816.exe
        5⤵
        
        PID:11460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7047.exe
      4⤵
      PID:6732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38387.exe
        5⤵
        
        PID:10644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50970.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50970.exe
    3⤵
    PID:5088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-166.exe
      4⤵
      PID:6448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23099.exe
        5⤵
        
        PID:9820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14607.exe
        6⤵
        
        PID:11436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16329.exe
        5⤵
        
        PID:10488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30534.exe
      4⤵
      PID:9960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16480.exe
      4⤵
      PID:12208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41205.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41205.exe
    3⤵
    PID:3252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4235.exe
      4⤵
      PID:9628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39048.exe
      4⤵
      PID:7744
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18247.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18247.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
    3⤵
    PID:4676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4582.exe
      4⤵
      PID:1020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36866.exe
        5⤵
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49533.exe
        6⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59279.exe
        7⤵
        
        PID:9108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16329.exe
        8⤵
        
        PID:10476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23672.exe
        7⤵
        
        PID:10952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55942.exe
        6⤵
        
        PID:9160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10037.exe
        7⤵
        
        PID:9868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8435.exe
        6⤵
        
        PID:10864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36128.exe
        5⤵
        
        PID:7460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22575.exe
        6⤵
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63237.exe
        7⤵
        
        PID:11328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10970.exe
      4⤵
      PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15922.exe
        5⤵
        
        PID:7428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18481.exe
        6⤵
        
        PID:10628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12697.exe
      4⤵
      PID:7096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57545.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57545.exe
    3⤵
    PID:424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31002.exe
      4⤵
      PID:6196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40400.exe
        5⤵
        
        PID:7548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14531.exe
        6⤵
        
        PID:11588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28303.exe
        5⤵
        
        PID:11580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53399.exe
      4⤵
      PID:7392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45009.exe
        5⤵
        
        PID:3160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63725.exe
        5⤵
        
        PID:13152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22925.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22925.exe
    3⤵
    PID:6880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5667.exe
      4⤵
      PID:1076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8997.exe
        5⤵
        
        PID:11476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48527.exe
      4⤵
      PID:1120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61100.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61100.exe
    3⤵
    PID:8524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61359.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61359.exe
    3⤵
    PID:12248
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62800.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62800.exe
  2⤵
  PID:1368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15080.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15080.exe
    3⤵
    PID:5820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14198.exe
      4⤵
      PID:5836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12112.exe
        5⤵
        
        PID:6728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36903.exe
        6⤵
        
        PID:8400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44437.exe
      4⤵
      PID:7880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30875.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30875.exe
    3⤵
    PID:7148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19377.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19377.exe
    3⤵
    PID:7088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6044.exe
      4⤵
      PID:10744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5028.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5028.exe
    3⤵
    PID:11896
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42899.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42899.exe
  2⤵
  PID:1164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52958.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52958.exe
    3⤵
    PID:6888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48729.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48729.exe
    3⤵
    PID:7812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61336.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61336.exe
    3⤵
    PID:5764
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45601.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45601.exe
  2⤵
  PID:4056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-10277.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-10277.exe
Size 7.7MB
SHA256 e43e85e4c0a8919904f631cb3db26b24d00cd52734427c74886ad2c9d3236a33
MD5 ed14c7ab83063b82b6f6a318c24a4f87
SHA1 6d149908f7efe39fdb377c3e8fd26eaae67d882b
SHA512 c8deca1450a07dd6be0a8869d492161fb0b0172b9de8e7462459ecb7645c92b424a1265ddf91792afff388ef4968e16e3db7665dc06263566ae2d1b7d3d96722
SSDEEP 196608:C0bnLDjz6pqZP01i/Mn/R15fmmpLtHgjKL6qw:zbnzzV814Mn/R1FtpiE
TLSH
T1D486F0369AA01F95F433913403E6C551EA2E7C3A232047CF7798F6962BB32E1547E62D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-11922.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-11922.exe
Size 7.7MB
SHA256 a4720151de6fdfa8a383fbac56c74acfb45a478baccbe2d9ccfb058d04de758a
MD5 c3376a45e27d329319d8c21d57e1b6a3
SHA1 62d7fbdfca8cc64fa7a21b355e7f7f200934558e
SHA512 1ef0a0e9bf54fb25af1df6231a37747570cb7214a44458228535a0203b4815521a530e0e0fd1b8bb39c676bfb52fc0ce792dee965b2899ed657847c7e5fa8c9a
SSDEEP 196608:C2jnLDjz6pqZP01i/Mn/R15fmmpLtHgjKL6qw:pjnzzV814Mn/R1FtpiE
TLSH
T19D86F0369AA01F95F433913403E6C551EA2E7C3A232047CF7798F6962BB32E1547E62D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-16052.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-16052.exe
Size 7.7MB
SHA256 ce73eabdc634f498e98e797f59bc9a3b7edfbf6652502823bd9e52001d16a8dc
MD5 9bb1d1debd2589136a874421efa311b3
SHA1 c211085e7bf6fc89b294ff60e7ee4c7a05bd4c99
SHA512 7a986117c9eda417a596764b5dd75fea4c8d857e5504fd75a465129a9cb5de619a77a8e5d8bbecef20a6262f716356b4aeddb7d09b9d68e4470a2faf88fbd3a2
SSDEEP 196608:C2bnLDjz6pqZP01i/Mn/R15fm7pLtHgWKL6qw:pbnzzV814Mn/R1FcpXE
TLSH
T1FA86F0369AA01F95F433913403E6C551EA2E7C3A232047CF7798F6962BB32E1547E62D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-16234.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-16234.exe
Size 7.7MB
SHA256 029874ab5df0b7dd445868cc69c3f6d57ff6a1fd2348e211a2c60cc6d01f71c1
MD5 e49a4989460e3e0d4a3d45b633fffc4b
SHA1 45329e469a2884c874024fd69fb910f25d0eb7f9
SHA512 fe0f433bfe416dacebd86cdc6126c99a650f2dd32ef4965dc2230e458f4bc2fd368c7a9dfc883d61c6923d0b52edebe070b98019b5d81cacbe6b64b5eaacfce1
SSDEEP 196608:C2bnLDjz6pqZP0ei/Mn/R15fmmpLtHgWKL6qw:pbnzzV8e4Mn/R1FtpXE
TLSH
T1EE86F0369AA01F95F433913403E6C551EA2E7C3A232047CF7798F6962BB32E1547E62D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-18247.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-18247.exe
Size 7.7MB
SHA256 425fa9f73c769b183f5b372d2784b6bfdd38989beb2bc2276e61b1162bcc32d5
MD5 673a9ed06b6ecde5ca744f174f8e68a0
SHA1 65702e2a07a00ba0bce3b7a5d8234d808165010d
SHA512 6eaafd231749e0ab55d1ac3caad188900616e491b4515fda59b045a8dcd369e6854ef7ab1f375f00a1d50f28d2b33c15b2ec7ed792ff74579597829d4137a6ac
SSDEEP 196608:C2bnLDjz6pqZP0vi/Mn/o15fmmpLDHgWKL6qw:pbnzzV8v4Mn/o1FtnXE
TLSH
T15686F0369AA01F95F433913403E6C551EA2E7C3A232047CF7798F6962BB32E1547E62D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-21059.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-21059.exe
Size 7.7MB
SHA256 368e490af1eb7f849da21dd1581cd36f89259df7e51f48ac94bbe0c4cce8fe92
MD5 7391ec1aa19ff19516e7146011bf610e
SHA1 c2dafb2afb02b478a056f4e7e1e6c30746c10948
SHA512 89b3100beb37befb5ae3c53b07043317d7d389d7665598271e9e6543f417c78b779a6788d072c3ee222ff682756f029b459f5471c31953761a9b3798c665cdd3
SSDEEP 196608:C2bnLD8z6pqZP0vi/Mn/R15fmmpLDHgWKL6qw:pbnMzV8v4Mn/R1FtnXE
TLSH
T10286F0369AA01F95F433913403E6C551EA2E7C3A232047CF7798F6962BB32E1547E62D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-21319.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-21319.exe
Size 7.7MB
SHA256 54958e905fd74beb92065ba9c2512981445595b948ca4ecaf5637525984227b0
MD5 bf9d4fd74511bfc86f0c62ba14a30f7a
SHA1 a9963ca9ab3809f18a8746f684d2940afc154b26
SHA512 b713f6667b3a242049821461c4a7c8739ee7c6303e244c9e5aa5329ba7d9df67c4b4651c6b28d8b77cd5bd37689735e75f7bf68ad66876c105ffc4cb26645baa
SSDEEP 196608:C2bnLDjz6pqZP0vi/Mn/R15fmmpLDHgWKL6qw:pbnzzV8v4Mn/R1FtnXE
TLSH
T18886F0369AA01F95F433913403E6C551EA2E7C3A232047CF7798F6962BB32E1547E62D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-26614.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-26614.exe
Size 7.7MB
SHA256 beba992f67da81e22daa223577cb7d9eb69e4bcc47033b1094929ba4e4f9173e
MD5 c46642d80a502ea9403211c5277e611b
SHA1 f6a1ef4cf15ae31dbf327851f01db919839c286b
SHA512 2ddf0bbd7fa76ec1d61f9ed14a5c08e62e823c3f4cda22d0ad54f5c24a65bef3543cf2f6056e2b32c5f6097fbec7765d09659f99895b8e756f4ac52c7c9d920b
SSDEEP 196608:C2bnLDjz6p+ZP01i/Mn/R15fm7pLtHgWKL6qw:pbnzzJ814Mn/R1FcpXE
TLSH
T11086F0369AA01F95F433913403E6C551EA2E7C3A232047CF7798F6962BB32E1547E62D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-30890.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-30890.exe
Size 7.7MB
SHA256 c890ca7c41796eb2263eb802e01f776ac564922582fa5cb34bd34fcb19d7b597
MD5 0b72643982f5ed0ae1f84537796a7cc1
SHA1 2a17c1a7179140f10c88891568f5686f310b0a49
SHA512 d074ec08b6154760bd4bb708e45e3c8b624303f4290b9a7b96c8fc9f6577a023bf5a5eab22ccee825656d33fca4991de4c40d72c1507da78e2d6639c435e8543
SSDEEP 196608:C2bnLMjz6pqZP0vi/Mn/R15fmmpLtHgWKL6qw:pbnUzV8v4Mn/R1FtpXE
TLSH
T1E886F0369AA01F95F433913403E6C551EA2E7C3A232047CF7798F6962BB32E1547E62D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-31834.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-31834.exe
Size 7.7MB
SHA256 01a6104039b956890d9709c2a955e5bdc5c86f6677fe1db012cd588e6a7f0cdb
MD5 44706b477ed7a44a4286c6ade8e8c0be
SHA1 46038e7d62a27f14c3e765391c0b9d2c42621787
SHA512 20b80a74455805ffe21bad938a9bfe4e17a85094f23136253f1cc61bcfeb978e9a4e267c6238eb03660e0c15d80152ea3dc41cc115634c112cbc392c7c33b222
SSDEEP 196608:C2bnLDjz6pqZPhvi/Mn/R15fmmpLtHgWKLwqw:pbnzzVpv4Mn/R1FtpXE
TLSH
T1C786F0369AA01F95F433913403E6C551EA2E7C3A232047CF7798F6962BB32E1547E62D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-31947.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-31947.exe
Size 7.7MB
SHA256 6a6b3d8736f6761ddf282285539df11a61fcc2d14461c739cbd8f58c98e7bae5
MD5 a980e5cd4ae8c13203862c5c0276af6a
SHA1 b6aeae7bb8ecebf5a1b493f73718b641e2b62675
SHA512 8b94dc4dcd85b9046d248af2b59367d7ffccfab855b2def428b15271a7b164d6b4dca6f152623b280fa9851b93d64a1ec4c8095b03a0cb8f42a43ea34275e0f6
SSDEEP 196608:C2bnLDjz6pqZP0vi/Mn/R15fmmpLtHgWKLwqw:pbnzzV8v4Mn/R1FtpXE
TLSH
T18786F0369AA01F95F433913403E6C551EA2E7C3A232047CF7798F6962BB32E1547E62D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-32735.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-32735.exe
Size 7.7MB
SHA256 0a3633e99ea466880ba5413bca349c0989fcccd76768249623ec7c2a526a1974
MD5 60bac1b41eaa8ae1f55ad8ec5cce347b
SHA1 249694330b59de4c9f28a287bb84a6151c14b412
SHA512 3d2ae39194ed0f1df3d8d37cd6b1f0490c71e735075a0b71e706a191af1ecc7a2c69a13f6c213c5c7062435dce60d6f6691b43815e73e1b30778b619963b4779
SSDEEP 196608:C2bnLDjz6pFZP01i/Mn/R15fmmpLtHgWKL6qw:pbnzzQ814Mn/R1FtpXE
TLSH
T19F86F0369AA01F95F433913403E6C551EA2E7C3A232047CF7798F6962BB32E1547E62D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-34662.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-34662.exe
Size 7.7MB
SHA256 afc74fa43913c95ff1f6b80620bb70143e26bb0cc7a27842f59da9312e7d814e
MD5 a6e79ee5f4f8c3f3866cfabd1352702a
SHA1 66a33c388e96464939f2a3040a13821181097985
SHA512 1223d6f71e4b26aa412692056edf1be6d7beb0fe912cf937600e6b05fa9bd89e0cd939ab5a3b65b920495a910196c225d00d5b982779f767c5b161370682aa90
SSDEEP 196608:C2bnLDjz6pqZP01i/Mn/R15fmmpLtHgWKL6qw:pbnzzV814Mn/R1FtpXE
TLSH
T1D586F0369AA01F95F433913403E6C551EA2E7C3A232047CF7798F6962BB32E1547E62D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-37797.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
Size 7.7MB
SHA256 785f6495ec2994aca661ee6e7c50d722292f7efb07bc1f6c9fa2d4addb5e17d5
MD5 e52b1a85f4f086f76277600cd15b70f8
SHA1 77fc4f138024b3f1e6cb03db70f44fecdd307909
SHA512 d7ddaa2443216e0df03e7d6c846adb3d088d7b4e84c935af09979f40aa801dbe3d21cf93f0f07d7c7c3363351c24c895d54f9e06c02cb821c04636deeb31f077
SSDEEP 196608:C2bnLDjz6FqZP0vi/Mn/o15fmmpLDHgWKL6qw:pbnzzh8v4Mn/o1FtnXE
TLSH
T1B586F0369AA01F95F433913403E6C551EA2E7C3A232047CF7798F6962BB32E1547E62D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-38684.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-38684.exe
Size 7.7MB
SHA256 b91f04fb75ef642ba2f9d9e16d4ad7bb2ddc08755d01868ada18c54d5966dcab
MD5 fab8bdfb0db1bdeaabad9c9fa36a00f6
SHA1 a18fb6269114aabbbb2349a198bb385eba2cdaea
SHA512 68dfcfcd4c483be6026d5da635a5ee986e702d7d0703d441818638a57ebbd2a448cbee6de89a747a0d621bf8f5bd861b652795c1424ecd934e4f614486169b11
SSDEEP 196608:C2bnLDjz6pqZP0vi/En/R15fmmpLDHgWKL6qw:pbnzzV8v4En/R1FtnXE
TLSH
T15986F0369AA01F95F433913403E6C551EA2E7C3A232047CF7798F6962BB32E1547E62D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-39674.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-39674.exe
Size 7.7MB
SHA256 4e0abc440894cb98bd2645e583c018721b4df835bea286f2b0cda659d3afe89f
MD5 8937d12870cfa1e2fcb86ea40da9bd5d
SHA1 16ada3934c2a1249e07042dae4782afb469b5310
SHA512 64cbc691059027fa852679f0593ae4ded840b0852f214fb263590385588a53180dc65e8b0b11fed019e4f26f2c6db340f0ff09c51bf5c65c131955f7ffb95ae9
SSDEEP 196608:x2bnLDjz6pqZP0vi/Mn/R15fmmpLlHgWKL6qw:cbnzzV8v4Mn/R1FtZXE
TLSH
T13F86F0369AA01F95F433913403E6C551EA2E7C3A232047CF7798F6962BB32E1547E62D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-43203.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-43203.exe
Size 7.7MB
SHA256 b04e8b48679c29bb2abd7da9e906ab0b176a8f63902efeff2bee02973d86ab4b
MD5 db97de10cf5f589d09ac5e9e6333d79d
SHA1 580f6e5c709c97f87e79b75d911293ac5c4e79f9
SHA512 443fddfd8097527ab83c955466d4180f0fe0bfc781eed277e7036bdddcd17520f9368a188482b101455be12a67a75e93ddea993d12cb7237c78b7f858f1190e0
SSDEEP 196608:C2bnLDjz6pqZP01i/Mn/R15fmmpLtHgW6L6qw:pbnzzV814Mn/R1FtpX0
TLSH
T1B786F0369AA01F95F433913403E6C551EA2E7C3A232047CF7798F6962BB32E1547E62D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-45150.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-45150.exe
Size 7.7MB
SHA256 43738278d19382c3a7dc0b09bfd6269de0c24a69ca2fab3c33da9609a4d2acb0
MD5 cd728693f81c518fbc05df41660776c4
SHA1 133d42365392fe0d0507936c0e560759fb4cafa7
SHA512 7d7e7ee1175ec4a5bb74d0c84c568022d24a156b132a83d027b82177415bcd0d1f96b10e785cd0deb8dea9ece28f8c217293647036e8bd41fd2c6e4390e7bffb
SSDEEP 196608:C2InLDjz6pqZP0vi/Mn/R15fmmpLtHgWKLwqw:pInzzV8v4Mn/R1FtpXE
TLSH
T16B86F0369AA01F95F433913403E6C551EA2E7C3A232047CF7798F6962BB32E1547E62D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-46712.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-46712.exe
Size 7.7MB
SHA256 bae19718651e5d6581d1e003e1c900deb5dad7470c332a748eec9d1d4c46b7f1
MD5 8e96ca901f8f45178262d244613c56ea
SHA1 8bf71dfe901eab817a333426078f439ab3b1779c
SHA512 b063d6e40c18a580a77a1d86e39d3a2325fe5a75deb137c743c1c725e430b7f27b1fe258d54fbd247def6da7996b141932548ca2a6327e18f7cc0b8a23ce584b
SSDEEP 196608:C2bngDjz6pqZP0vi/En/R15fmmpLDHgWKL6qw:pbnszV8v4En/R1FtnXE
TLSH
T1AF86F0369AA01F95F433913403E6C551EA2E7C3A232047CF7798F6962BB32E1547E62D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-50863.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-50863.exe
Size 7.7MB
SHA256 36a0040aa9fd0368d44ccf5ce61be41588d23757d338e9ecfa1d7f37514c227a
MD5 4fe729b41c64db64b52982ff08e0a6f3
SHA1 079fa03a92303de4260e80199755c9cea03ade0d
SHA512 823caa835ef1b1f504e7f5b3b0ba0a88103e281f0347c4721b3d989736999faddfc8063db9403ec434e612217d85f1072988840b8a2f86d84d19a64d9fde38e8
SSDEEP 196608:C2bnLDjzVpqZP0vi/Mn/R15fmmpLDHgWKL6qw:pbnzz+8v4Mn/R1FtnXE
TLSH
T13186F0369AA01F95F433913403E6C551EA2E7C3A232047CF7798F6962BB32E1547E62D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-5191.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-5191.exe
Size 7.7MB
SHA256 a6f82acfb0a64c01d421d724ecee6ddf00838d202dc4b9f19eddc1e6ffd2ce2c
MD5 fbb4fc8da8b467b2fc42d49c0f9deb22
SHA1 697bcd7c41a0d4d6eee82db3a83ef766b077dddf
SHA512 ddadbae3b34054b59d2e9d47628b75de3ca9dfd33d1bb3875b7e3303ba2af8710077a6ede41c35d71080c45bccfe2f161f709eff0d4a984f8762d9dbf6380059
SSDEEP 196608:C2bnLDjz6pqZP01i/Mn/R15fmmpLtHgjKL6qw:pbnzzV814Mn/R1FtpiE
TLSH
T1CD86F0369AA01F95F433913403E6C551EA2E7C3A232047CF7798F6962BB32E1547E62D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-52057.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-52057.exe
Size 7.7MB
SHA256 e1a21cbef40a380c171c2c3db590679caf68d6d8d6f56260b07d5212257f1c34
MD5 52cb3637f2345db0d63561f4da548130
SHA1 5b39e70a510ec352c02f67d5683ff45a1acf3d89
SHA512 dfab4b9409e871dd3b72ba575c9f55314cf77742105d8933ff1f345f2f896e81dbf9bbe6eae486b8e5f16eea5b121fafced140b37220aed5cc2d0a4020180052
SSDEEP 196608:C2bnLDGzVpqZP0vi/Mn/R15fmmpLDHgWKL6qw:pbn2z+8v4Mn/R1FtnXE
TLSH
T1D886F0369AA01F95F433913403E6C551EA2E7C3A232047CF7798F6962BB32E1547E62D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-53764.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-53764.exe
Size 7.7MB
SHA256 5863fc2ae3ed9fe3ee85884f805f2069689da5d47d40df682fb1e265b178a0c5
MD5 c49056970aa255dc95cb31274a8c4b38
SHA1 81dd6cdee00821d45cc9f7ce82d100aa28ca1257
SHA512 c125b3efa5bb030a5273354e6729388b53350626a59a16e66ae18b551f8c5934fab2ab495438a2cdf29988152acd87fa1a4fa67c1867c141781acb254479a324
SSDEEP 196608:C2bnLDjz6pqZP0vi/Mn/R15fmmpLtHgWKL6qw:pbnzzV8v4Mn/R1FtpXE
TLSH
T1B986F0369AA01F95F433913403E6C551EA2E7C3A232047CF7798F6962BB32E1547E62D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-5918.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-5918.exe
Size 7.7MB
SHA256 dbeb4890a56883c477fbafe200fd136ca08936a451f463b83df7bda7b90ab298
MD5 8ab51ef550e09c4fdaf57ed746a6d398
SHA1 a95c5027d1776a981e414269262d1a8ee529814d
SHA512 73e55483f362e278dab38c985c942b408a37c3059f67441d4a1ba196e5ffca55271f99e130c3714d8a08c1fdded690c78a76b934f77e77583eb7323ed684f5d2
SSDEEP 196608:C2bnLD8z6pqZP0vi/Mn/R1ofmmpLDHgWKL6qw:pbnMzV8v4Mn/R1StnXE
TLSH
T1E886F0369AA01F95F433913403E6C551EA2E7C3A232047CF7798F6962BB32E1547E62D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-59670.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-59670.exe
Size 7.7MB
SHA256 8359d228f1fb4a9fddbda57f55bd84c3140b7e73309f1c0d76437a5a3f771a6b
MD5 2aad5cb62d626575afaa42f50ff2d194
SHA1 a0f1f0829775f2dff632655c136fd6286b26244e
SHA512 9f5a0f74d155bfcb5f64f57db35f2467ea4252849d8cdf40809b859a812fb8d95ae37e68af72ce4ebf82bee501f708e50774f8f1cc64ebb6aba9e668ee3e909c
SSDEEP 196608:C2bnLDjzVpqZP0vi/Mn/R15fmmpLDHgyKLhqw:pbnzz+8v4Mn/R1FtnrE
TLSH
T14C86F0369AA01F95F433913403E6C551EA2E7C3A232047CF7798F6962BB32E1547E62D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-60931.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-60931.exe
Size 7.7MB
SHA256 523edf261774d7471c5a06567c3f4c6eacaadfa39258b4e465fb1f7eba91a565
MD5 b28490557c1470fd0fce07f216e654f7
SHA1 d92dbbf1e34c0bb01391854d67fd5cf79f06ceb9
SHA512 d70ac8723b672d14845909da3916853bd9d615e238998ff0a3877ac90b18aa0aec71fa2b2a5527f50c2b2d10032c95ad7cdbd76e251e5cc75690c95b5f6de204
SSDEEP 196608:C2bnLDjz6pqZPhvi/Mn/R15fmmpLtHgNKLwqw:pbnzzVpv4Mn/R1FtpQE
TLSH
T1B186F0369AA01F95F433913403E6C551EA2E7C3A232047CF7798F6962BB32E1547E62D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-61033.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-61033.exe
Size 7.7MB
SHA256 80096e847ee22b6b027f32e3d960f33a0d112842772e839f0eb9b56ffb2f99e1
MD5 ce599e68dbeb3e25e39aeeb5b4cfdef5
SHA1 0a30f02bde74f4399e4f2fe81732e43fa89007b1
SHA512 c967ac87b4c42b81ce9723a25e3c7e6068f7ecfb38aaec41765a4abb66e5ce2e09f264fc0e296e756bd17a9d268891e2e826b7c6bc1b9adb152bb5b7d3c2fa49
SSDEEP 196608:C2bnLDjz6pqZP0vi/Mn/R15fmmpLlHgWKL6qw:pbnzzV8v4Mn/R1FtZXE
TLSH
T1D786F0369AA01F95F433913403E6C551EA2E7C3A232047CF7798F6962BB32E1547E62D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-62800.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-62800.exe
Size 7.7MB
SHA256 cdb226442611c78c907f57259274e6a307e72a8b9778d2a95f7db30b4ed3df28
MD5 4638289e27614e6ed9ffabbd0e6fb3fb
SHA1 4d6e050c86942a16f0f32e0e2fc2bfb227cb8ed6
SHA512 8d0811dc46b308556c40ff76ee3ce81b8ed286547d4f14ba2ed77c016cc0ee44d4e9c7c88536baa8e79adca92befd3cf82d9a71e2712d4643fbea9a01c15a417
SSDEEP 196608:C2bnLDjz6pqZP0vi/Mn/R15fmmpLDHgWKL6Gw:pbnzzV8v4Mn/R1FtnXE
TLSH
T1ED86F0369AA01F95F433913403E6C551EA2E7C3A232047CF7798F6962BB32E1547E62D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-63624.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-63624.exe
Size 7.7MB
SHA256 36cc4a27547ee2f57443e82b88ad084c9f15a0cbb569b1dadb3b9a1ca8d94075
MD5 11246b9ef8592f14a3eb3f7f5c3decdb
SHA1 4f093068977f2dc9c80b9e8780c123e427d82f0d
SHA512 82d5b6b998bf0424d75c5acedd175081df65d436a9079d5c4a3eab62e3311614241707e52afcc46e8bc5f74b5bb3d162997261ea0b5065127675236038dd1489
SSDEEP 196608:C2bnLDjzVpqZP0vi/Mn/R15fmmpLDHgWKLhqw:pbnzz+8v4Mn/R1FtnXE
TLSH
T1A886F0369AA01F95F433913403E6C551EA2E7C3A232047CF7798F6962BB32E1547E62D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-64598.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-64598.exe
Size 7.7MB
SHA256 a888cdec671f601595634bc7148fa3361d6bd465f4a5153c3dceca8ffa1d2de8
MD5 12fdcd708074961a646493e8ef530c6a
SHA1 4981c2a2731e2236f6e7e728e2acfa2efa82bd48
SHA512 abef1fec36adddbf402652270f5654f9ad58fff85f7072dd925d2825f7d34a5294ee1b83a4fb6d89c5c0cef74fdc1d80b0b11ada9b114375ac064052f0874de1
SSDEEP 196608:C2bnL1jz6pqZP0vi/Mn/R15fmmpLtHgWKL6qw:pbnNzV8v4Mn/R1FtpXE
TLSH
T1E386F0369AA01F95F433913403E6C551EA2E7C3A232047CF7798F6962BB32E1547E62D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-666.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-666.exe
Size 7.7MB
SHA256 d11aa687464d2ec4b51480c8f37a69e30dd841136d76518debcdf60fb2dcd3e2
MD5 76f40fd50565bcce646a795191054ec7
SHA1 61c81f6b6be25ca20198f6a47221ce22ed088337
SHA512 d9d974d8e9b3552981c72b62d3d41a06132545032feed26ecb642b5b5bdc4e3e02f865880fd8e209427e7f2895793812a8e752b8de76ec790ca31d413690d8b1
SSDEEP 196608:C2bnLDjz6pqZP01i/Mn/R15fmmpLtHgWKL6qw:pbnzzV814Mn/R1FtpXE
TLSH
T1FE86F0369AA01F95F433913403E6C551EA2E7C3A232047CF7798F6962BB32E1547E62D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/428-401-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/700-172-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/976-433-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/980-623-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1016-432-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1020-357-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1364-316-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1440-1438-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1460-454-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1928-700-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1988-265-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1996-780-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2140-1443-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2540-274-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2808-489-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3328-1765-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3640-781-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3672-1910-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3684-648-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3904-510-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3920-266-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4056-1433-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4136-434-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4428-214-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5096-264-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5136-403-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5532-402-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5560-112-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5680-52-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5684-0-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5804-994-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5836-647-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5884-96-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5948-1491-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6024-649-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6068-404-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6188-1449-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6196-768-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6216-1494-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6296-1500-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6308-894-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6316-1308-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6352-935-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6444-1405-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6476-1258-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6504-1502-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6556-1497-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6596-1501-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6600-892-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6608-862-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6616-891-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6652-1406-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6696-1492-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6728-1442-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6732-1448-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6736-1353-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6740-893-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6776-1432-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6812-1254-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6824-1435-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6832-1312-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6840-1256-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6864-1311-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6880-993-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6888-1185-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6912-1253-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6928-1075-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6936-1183-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6952-996-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6960-1307-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7072-1495-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7096-1496-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7104-991-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7124-936-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7140-992-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7196-1260-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7388-1604-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7392-1493-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7428-1436-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7460-1306-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7548-1499-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7560-1437-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7596-1310-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7644-1451-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7800-1427-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7852-1428-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7864-1429-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7880-1430-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7900-1444-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7908-1431-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7932-1445-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7944-1498-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7972-1446-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/8060-1447-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/8128-1450-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/8208-2010-0x0000000000400000-0x0000000000475000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads