kawaiiunicorn | 51863f0492b2b864c68c32ffd2c106afcd97b1aac10b13d3f146d343b43fc5f7

Analysis

max time kernel
109s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 17:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_a6631d567d1629696cb6751db0f08e1f_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Size 12.9MB
Sample260723-vztenstdmf
SHA256 51863f0492b2b864c68c32ffd2c106afcd97b1aac10b13d3f146d343b43fc5f7
MD5 a6631d567d1629696cb6751db0f08e1f
SHA1 912ddf656b1d4f96753651c0a0609d016c901ff2
SHA512 c233369be70542b6ef0bbad393d5fc8e76e92c6c1f4ea46072ae230af17dd644b0d2287860e9d021343e2e9e9f90217ee8e82ef1ff687f5b39f3f43b9e05ef82
SSDEEP 196608:E+efi/Mn/R15fmmpLOHgWKL6qw5LTK+ZmsSBQtTdgn5njBxcO4C8V2VNgbPJ1m+z:ENf4Mn/R1FtcXEOTMvS6XG2NwJs+
TLSH
T176D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery kawaiiunicorn trojan

Malware Config

Signatures

Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
trojan kawaiiunicorn

Detects KawaiiUnicorn 47 IoCs

resource	yara_rule
behavioral2/memory/3168-0-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2660-16-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2388-64-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1984-329-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2844-332-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1340-331-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1952-330-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3052-344-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5840-361-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5964-385-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4160-384-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/432-546-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6068-547-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3192-545-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3604-780-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2460-893-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3236-850-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6040-849-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1292-848-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4228-844-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2636-894-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4264-960-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3156-962-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6472-951-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2972-950-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6528-948-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1156-946-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6380-945-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6168-944-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5176-889-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4100-842-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2312-778-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6792-1073-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3184-777-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4324-774-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1456-771-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4244-766-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3016-1082-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6436-1076-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1964-1072-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6780-1175-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3380-1236-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5008-1352-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6852-1643-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6788-1753-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6312-1921-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2444-2014-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 27 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c5df-6.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c5e0-11.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5e3-21.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5e5-30.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5e6-34.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5ec-54.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5eb-53.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5e7-62.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5ea-67.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5e9-79.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5e8-73.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5ee-85.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5ed-83.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5f1-117.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5f3-124.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5f0-125.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5ef-138.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5f2-141.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5f8-168.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5f6-194.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5fc-173.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5ff-201.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5fb-220.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5fe-219.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5fa-228.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5f9-222.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c5fd-206.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

UPX dump on OEP (original entry point) 27 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c5df-6.dat	UPX
behavioral2/files/0x000d00000001c5e0-11.dat	UPX
behavioral2/files/0x000c00000001c5e3-21.dat	UPX
behavioral2/files/0x000c00000001c5e5-30.dat	UPX
behavioral2/files/0x000c00000001c5e6-34.dat	UPX
behavioral2/files/0x000c00000001c5ec-54.dat	UPX
behavioral2/files/0x000c00000001c5eb-53.dat	UPX
behavioral2/files/0x000c00000001c5e7-62.dat	UPX
behavioral2/files/0x000c00000001c5ea-67.dat	UPX
behavioral2/files/0x000c00000001c5e9-79.dat	UPX
behavioral2/files/0x000c00000001c5e8-73.dat	UPX
behavioral2/files/0x000c00000001c5ee-85.dat	UPX
behavioral2/files/0x000c00000001c5ed-83.dat	UPX
behavioral2/files/0x000c00000001c5f1-117.dat	UPX
behavioral2/files/0x000c00000001c5f3-124.dat	UPX
behavioral2/files/0x000c00000001c5f0-125.dat	UPX
behavioral2/files/0x000c00000001c5ef-138.dat	UPX
behavioral2/files/0x000c00000001c5f2-141.dat	UPX
behavioral2/files/0x000c00000001c5f8-168.dat	UPX
behavioral2/files/0x000c00000001c5f6-194.dat	UPX
behavioral2/files/0x000c00000001c5fc-173.dat	UPX
behavioral2/files/0x000c00000001c5ff-201.dat	UPX
behavioral2/files/0x000c00000001c5fb-220.dat	UPX
behavioral2/files/0x000c00000001c5fe-219.dat	UPX
behavioral2/files/0x000c00000001c5fa-228.dat	UPX
behavioral2/files/0x000c00000001c5f9-222.dat	UPX
behavioral2/files/0x000c00000001c5fd-206.dat	UPX

Executes dropped EXE 8 IoCs

pid	Process
3472	Unicorn-40006.exe
2660	Unicorn-34443.exe
2480	Unicorn-43056.exe
4684	Unicorn-61936.exe
3496	Unicorn-19512.exe
2832	Unicorn-9274.exe
5912	Unicorn-61490.exe
2388	Unicorn-41624.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7208	6068	WerFault.exe	163

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_a6631d567d1629696cb6751db0f08e1f_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34443.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61936.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19512.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9274.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40006.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61490.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3168	2026-07-23_a6631d567d1629696cb6751db0f08e1f_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
3472	Unicorn-40006.exe
2660	Unicorn-34443.exe
2480	Unicorn-43056.exe
4684	Unicorn-61936.exe
3496	Unicorn-19512.exe
2832	Unicorn-9274.exe
5912	Unicorn-61490.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 3472	3168	2026-07-23_a6631d567d1629696cb6751db0f08e1f_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe	89
PID 3472 wrote to memory of 2660	3472	Unicorn-40006.exe	90
PID 3168 wrote to memory of 2480	3168	2026-07-23_a6631d567d1629696cb6751db0f08e1f_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe	91
PID 2660 wrote to memory of 4684	2660	Unicorn-34443.exe	92
PID 3472 wrote to memory of 3496	3472	Unicorn-40006.exe	93
PID 4684 wrote to memory of 2832	4684	Unicorn-61936.exe	94
PID 3496 wrote to memory of 5912	3496	Unicorn-19512.exe	95
PID 2660 wrote to memory of 2388	2660	Unicorn-34443.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-07-23_a6631d567d1629696cb6751db0f08e1f_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_a6631d567d1629696cb6751db0f08e1f_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40006.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40006.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34443.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34443.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61936.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9274.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23373.exe
        6⤵
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62668.exe
        7⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47238.exe
        8⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8125.exe
        9⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6921.exe
        10⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31255.exe
        11⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29116.exe
        11⤵
        
        PID:10776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33646.exe
        10⤵
        
        PID:8520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38955.exe
        10⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30034.exe
        9⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16070.exe
        10⤵
        
        PID:10316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39764.exe
        9⤵
        
        PID:9032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40475.exe
        8⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6068 -s 708
        9⤵
        Program crash
        
        PID:7208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39193.exe
        8⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16014.exe
        9⤵
        
        PID:852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6366.exe
        8⤵
        
        PID:10628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7257.exe
        7⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56314.exe
        8⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26152.exe
        9⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42390.exe
        8⤵
        
        PID:8436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27269.exe
        7⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57399.exe
        8⤵
        
        PID:9652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33585.exe
        7⤵
        
        PID:10184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37024.exe
        6⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60040.exe
        7⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59075.exe
        8⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29116.exe
        8⤵
        
        PID:10928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15281.exe
        7⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30983.exe
        7⤵
        
        PID:6964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41301.exe
        6⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52469.exe
        7⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10772.exe
        8⤵
        
        PID:11208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25146.exe
        7⤵
        
        PID:9788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55106.exe
        6⤵
        
        PID:7904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39167.exe
        6⤵
        
        PID:6484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27566.exe
        5⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18135.exe
        6⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24462.exe
        7⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34825.exe
        8⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34431.exe
        9⤵
        
        PID:9668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-154.exe
        8⤵
        
        PID:9660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27211.exe
        7⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39963.exe
        8⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43485.exe
        7⤵
        
        PID:8600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34667.exe
        6⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16097.exe
        7⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32568.exe
        8⤵
        
        PID:9308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3356.exe
        7⤵
        
        PID:8336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        6⤵
        
        PID:7332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37913.exe
        6⤵
        
        PID:10828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27949.exe
        5⤵
        
        PID:4996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47238.exe
        6⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63740.exe
        7⤵
        
        PID:268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51950.exe
        8⤵
        
        PID:8472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28731.exe
        7⤵
        
        PID:7160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33651.exe
        6⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4228.exe
        7⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55256.exe
        8⤵
        
        PID:9464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52002.exe
        7⤵
        
        PID:10792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45161.exe
        6⤵
        
        PID:7388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10974.exe
        6⤵
        
        PID:8312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42889.exe
        5⤵
        
        PID:1340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14155.exe
        6⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37155.exe
        7⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50362.exe
        8⤵
        
        PID:9132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38363.exe
        7⤵
        
        PID:9124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37024.exe
        6⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62038.exe
        7⤵
        
        PID:8588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33349.exe
        6⤵
        
        PID:9244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44120.exe
        5⤵
        
        PID:4484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5982.exe
        6⤵
        
        PID:7504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32520.exe
        6⤵
        
        PID:10980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37200.exe
        5⤵
        
        PID:7928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18578.exe
        6⤵
        
        PID:10652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60509.exe
        5⤵
        
        PID:1872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41624.exe
      4⤵
      Executes dropped EXE
      PID:2388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43239.exe
        5⤵
        
        PID:3356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25912.exe
        6⤵
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-175.exe
        7⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16979.exe
        8⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62261.exe
        9⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59729.exe
        10⤵
        
        PID:9628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25457.exe
        8⤵
        
        PID:7720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63808.exe
        9⤵
        
        PID:10820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64751.exe
        8⤵
        
        PID:11052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe
        7⤵
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53325.exe
        8⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4721.exe
        9⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54166.exe
        10⤵
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28955.exe
        9⤵
        
        PID:8736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40169.exe
        8⤵
        
        PID:8376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8747.exe
        8⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2654.exe
        7⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23144.exe
        8⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8872.exe
        7⤵
        
        PID:8000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46728.exe
        6⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19475.exe
        7⤵
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16915.exe
        8⤵
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25633.exe
        7⤵
        
        PID:3120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8903.exe
        6⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48333.exe
        7⤵
        
        PID:8496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6538.exe
        6⤵
        
        PID:7236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4165.exe
        6⤵
        
        PID:10204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29732.exe
        5⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19200.exe
        6⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19496.exe
        7⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53019.exe
        7⤵
        
        PID:10640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64866.exe
        6⤵
        
        PID:8188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19600.exe
        7⤵
        
        PID:10300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12509.exe
        6⤵
        
        PID:10716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58706.exe
        5⤵
        
        PID:2636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41831.exe
        6⤵
        
        PID:9236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27809.exe
        5⤵
        
        PID:8292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37109.exe
      4⤵
      PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60229.exe
        5⤵
        
        PID:2140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64404.exe
        6⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60040.exe
        7⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56205.exe
        8⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55069.exe
        9⤵
        
        PID:9048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6397.exe
        8⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4352.exe
        7⤵
        
        PID:7968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27685.exe
        8⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48389.exe
        7⤵
        
        PID:10864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9862.exe
        6⤵
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39532.exe
        7⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29553.exe
        8⤵
        
        PID:9636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36905.exe
        7⤵
        
        PID:10600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34498.exe
        6⤵
        
        PID:7792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43227.exe
        7⤵
        
        PID:10004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47151.exe
        6⤵
        
        PID:11216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54015.exe
        5⤵
        
        PID:1952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21338.exe
        6⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23497.exe
        7⤵
        
        PID:6852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64015.exe
        6⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38894.exe
        7⤵
        
        PID:11004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46334.exe
        6⤵
        
        PID:10444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58186.exe
        5⤵
        
        PID:4244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10507.exe
        6⤵
        
        PID:8508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15203.exe
        5⤵
        
        PID:9344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57087.exe
      4⤵
      PID:760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-725.exe
        5⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49516.exe
        6⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58354.exe
        7⤵
        
        PID:10516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16619.exe
        6⤵
        
        PID:11024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26189.exe
        5⤵
        
        PID:7920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38083.exe
        5⤵
        
        PID:8348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28551.exe
      4⤵
      PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55816.exe
        5⤵
        
        PID:9056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27719.exe
      4⤵
      PID:9332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19512.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19512.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61490.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47432.exe
        5⤵
        
        PID:3956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46724.exe
        6⤵
        
        PID:252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39345.exe
        7⤵
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59630.exe
        8⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-497.exe
        9⤵
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48192.exe
        8⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17206.exe
        7⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34218.exe
        8⤵
        
        PID:9432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34693.exe
        7⤵
        
        PID:8544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54403.exe
        6⤵
        
        PID:432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34934.exe
        7⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43310.exe
        8⤵
        
        PID:9592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20429.exe
        7⤵
        
        PID:9944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33683.exe
        6⤵
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1161.exe
        7⤵
        
        PID:8900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57576.exe
        6⤵
        
        PID:9372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62346.exe
        5⤵
        
        PID:3616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4897.exe
        6⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53709.exe
        7⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33284.exe
        8⤵
        
        PID:8352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5058.exe
        7⤵
        
        PID:8488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51663.exe
        6⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24322.exe
        7⤵
        
        PID:8528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46600.exe
        7⤵
        
        PID:6668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35515.exe
        6⤵
        
        PID:9364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41108.exe
        5⤵
        
        PID:1312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10263.exe
        6⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33097.exe
        7⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7352.exe
        8⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13169.exe
        9⤵
        
        PID:10348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7741.exe
        8⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56039.exe
        7⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25106.exe
        8⤵
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11445.exe
        7⤵
        
        PID:10612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24113.exe
        6⤵
        
        PID:6368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9338.exe
        6⤵
        
        PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4845.exe
        5⤵
        
        PID:2348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59713.exe
        6⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60668.exe
        7⤵
        
        PID:9068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60.exe
        6⤵
        
        PID:10548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28224.exe
        5⤵
        
        PID:7980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52105.exe
        5⤵
        
        PID:3316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37109.exe
      4⤵
      PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14235.exe
        5⤵
        
        PID:1696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43154.exe
        6⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37098.exe
        7⤵
        
        PID:124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28110.exe
        8⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24322.exe
        9⤵
        
        PID:8536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62785.exe
        8⤵
        
        PID:9156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7143.exe
        7⤵
        
        PID:7896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54519.exe
        8⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39864.exe
        7⤵
        
        PID:4080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6926.exe
        6⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48634.exe
        7⤵
        
        PID:7096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64460.exe
        6⤵
        
        PID:9096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31460.exe
        5⤵
        
        PID:1704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6921.exe
        6⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4145.exe
        7⤵
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38898.exe
        6⤵
        
        PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15016.exe
        5⤵
        
        PID:6968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63621.exe
        6⤵
        
        PID:9644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64203.exe
        5⤵
        
        PID:5684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24415.exe
      4⤵
      PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57134.exe
        5⤵
        
        PID:2184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24218.exe
        6⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47752.exe
        7⤵
        
        PID:9980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54529.exe
        6⤵
        
        PID:10196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21228.exe
        5⤵
        
        PID:7864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5410.exe
        5⤵
        
        PID:10728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-72.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-72.exe
      4⤵
      PID:4148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28110.exe
        5⤵
        
        PID:6928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-907.exe
        6⤵
        
        PID:6724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31939.exe
        6⤵
        
        PID:10104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23636.exe
        5⤵
        
        PID:8456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24180.exe
      4⤵
      PID:7252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10476.exe
        5⤵
        
        PID:10332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62159.exe
      4⤵
      PID:1736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55360.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55360.exe
    3⤵
    PID:2796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43239.exe
      4⤵
      PID:2868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3353.exe
        5⤵
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17725.exe
        6⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32220.exe
        7⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51483.exe
        8⤵
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47830.exe
        9⤵
        
        PID:10812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45763.exe
        8⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44763.exe
        7⤵
        
        PID:6628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64984.exe
        6⤵
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7321.exe
        7⤵
        
        PID:700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63117.exe
        6⤵
        
        PID:9696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40693.exe
        5⤵
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
        6⤵
        
        PID:1456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51483.exe
        7⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49314.exe
        8⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54529.exe
        7⤵
        
        PID:10176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53107.exe
        6⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17104.exe
        7⤵
        
        PID:11060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19691.exe
        6⤵
        
        PID:3916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18030.exe
        5⤵
        
        PID:4100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48634.exe
        6⤵
        
        PID:10552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9143.exe
        5⤵
        
        PID:9424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19367.exe
      4⤵
      PID:1428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47238.exe
        5⤵
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11332.exe
        6⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60398.exe
        7⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64752.exe
        8⤵
        
        PID:8248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28597.exe
        7⤵
        
        PID:10164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46070.exe
        6⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57098.exe
        7⤵
        
        PID:9688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46775.exe
        6⤵
        
        PID:8384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18986.exe
        5⤵
        
        PID:5048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10922.exe
        6⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64254.exe
        7⤵
        
        PID:8864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31024.exe
        5⤵
        
        PID:7960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22470.exe
        6⤵
        
        PID:10020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55816.exe
        5⤵
        
        PID:9584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3885.exe
      4⤵
      PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14705.exe
        5⤵
        
        PID:6380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61140.exe
        5⤵
        
        PID:7848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30279.exe
      4⤵
      PID:5044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37425.exe
        5⤵
        
        PID:9108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56931.exe
      4⤵
      PID:9928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42974.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42974.exe
    3⤵
    PID:4576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31779.exe
      4⤵
      PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18323.exe
        5⤵
        
        PID:2372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13527.exe
        6⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61291.exe
        7⤵
        
        PID:9896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54446.exe
        6⤵
        
        PID:9912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1830.exe
        5⤵
        
        PID:3380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33087.exe
        6⤵
        
        PID:10008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20049.exe
        5⤵
        
        PID:10268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54072.exe
      4⤵
      PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20648.exe
        5⤵
        
        PID:6776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29116.exe
        5⤵
        
        PID:10756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33567.exe
      4⤵
      PID:8444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32018.exe
      4⤵
      PID:1536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35100.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35100.exe
    3⤵
    PID:5484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55271.exe
      4⤵
      PID:6040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29501.exe
        5⤵
        
        PID:5760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52665.exe
      4⤵
      PID:2076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6754.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6754.exe
    3⤵
    PID:3344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65380.exe
      4⤵
      PID:364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe
        5⤵
        
        PID:9520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59957.exe
      4⤵
      PID:10212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38480.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38480.exe
    3⤵
    PID:8388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32009.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32009.exe
    3⤵
    PID:4376
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43056.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43056.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30764.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30764.exe
    3⤵
    PID:3300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60459.exe
      4⤵
      PID:2820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58971.exe
        5⤵
        
        PID:2548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33995.exe
        6⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53066.exe
        7⤵
        
        PID:10368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40631.exe
        6⤵
        
        PID:9704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17227.exe
        5⤵
        
        PID:7396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1025.exe
        5⤵
        
        PID:10996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36148.exe
      4⤵
      PID:1156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17799.exe
        5⤵
        
        PID:8580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6538.exe
      4⤵
      PID:7216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52962.exe
        5⤵
        
        PID:9956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12769.exe
      4⤵
      PID:9604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44863.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44863.exe
    3⤵
    PID:2724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51322.exe
      4⤵
      PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52365.exe
        5⤵
        
        PID:2608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64098.exe
        6⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7601.exe
        7⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2111.exe
        8⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52827.exe
        7⤵
        
        PID:10648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61140.exe
        6⤵
        
        PID:7988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28773.exe
        5⤵
        
        PID:2972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38929.exe
        6⤵
        
        PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50781.exe
        5⤵
        
        PID:4240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49869.exe
        5⤵
        
        PID:6828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36583.exe
      4⤵
      PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62728.exe
        5⤵
        
        PID:6804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8966.exe
        6⤵
        
        PID:8772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21472.exe
        5⤵
        
        PID:10620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49883.exe
      4⤵
      PID:6284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60684.exe
        5⤵
        
        PID:11012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22957.exe
      4⤵
      PID:10340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22360.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22360.exe
    3⤵
    PID:5784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47570.exe
      4⤵
      PID:6916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28188.exe
        5⤵
        
        PID:8064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7637.exe
      4⤵
      PID:8204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35131.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35131.exe
    3⤵
    PID:6316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37342.exe
      4⤵
      PID:7528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16070.exe
      4⤵
      PID:6548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56199.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56199.exe
    3⤵
    PID:7768
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37955.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37955.exe
  2⤵
  PID:6136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43239.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43239.exe
    3⤵
    PID:2552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39233.exe
      4⤵
      PID:2816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47238.exe
        5⤵
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24462.exe
        6⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32687.exe
        7⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8369.exe
        7⤵
        
        PID:9352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17289.exe
        6⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2142.exe
        7⤵
        
        PID:9284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22353.exe
        6⤵
        
        PID:9752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43490.exe
        5⤵
        
        PID:3192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21805.exe
        6⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59293.exe
        7⤵
        
        PID:9836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7108.exe
        6⤵
        
        PID:9292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53500.exe
        5⤵
        
        PID:6376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39174.exe
        6⤵
        
        PID:2436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-341.exe
        5⤵
        
        PID:8744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23288.exe
      4⤵
      PID:5964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63055.exe
        5⤵
        
        PID:1292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36792.exe
        6⤵
        
        PID:8552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36277.exe
        5⤵
        
        PID:6604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32545.exe
        5⤵
        
        PID:10564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43303.exe
      4⤵
      PID:4264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        5⤵
        
        PID:4516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15120.exe
      4⤵
      PID:9024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47138.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47138.exe
    3⤵
    PID:3972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26107.exe
      4⤵
      PID:4236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8182.exe
        5⤵
        
        PID:6152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10772.exe
        6⤵
        
        PID:11200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28680.exe
        5⤵
        
        PID:3196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24548.exe
      4⤵
      PID:7880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11275.exe
      4⤵
      PID:10684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24773.exe
    3⤵
    PID:3200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57575.exe
      4⤵
      PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32738.exe
        5⤵
        
        PID:9920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59407.exe
      4⤵
      PID:1016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19719.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19719.exe
    3⤵
    PID:7888
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30302.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30302.exe
  2⤵
  PID:3668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13496.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13496.exe
    3⤵
    PID:2980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5110.exe
      4⤵
      PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6921.exe
        5⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13823.exe
        6⤵
        
        PID:8368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61140.exe
        5⤵
        
        PID:8924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15114.exe
        5⤵
        
        PID:3436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63584.exe
      4⤵
      PID:1776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21795.exe
        5⤵
        
        PID:9904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20132.exe
      4⤵
      PID:9532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24139.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24139.exe
    3⤵
    PID:3020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20544.exe
      4⤵
      PID:6472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32406.exe
        5⤵
        
        PID:5388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33463.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33463.exe
    3⤵
    PID:2044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8644.exe
      4⤵
      PID:9008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62048.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62048.exe
    3⤵
    PID:8804
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13604.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13604.exe
  2⤵
  PID:4216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18323.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18323.exe
    3⤵
    PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21696.exe
      4⤵
      PID:6792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61592.exe
        5⤵
        
        PID:8572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9220.exe
      4⤵
      PID:3272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62982.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62982.exe
    3⤵
    PID:5008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12090.exe
      4⤵
      PID:8360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10772.exe
      4⤵
      PID:9844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6728.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6728.exe
    3⤵
    PID:9412
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23819.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23819.exe
  2⤵
  PID:6404
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2232.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2232.exe
  2⤵
  PID:6552

C:\Users\Admin\AppData\Local\Temp\Unicorn-45858.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-45858.exe
1⤵
PID:9016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-14235.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-14235.exe
Size 12.9MB
SHA256 b6057878af666a4b3462b9b022a477277205fbc553ee154facd4dd496f26d4d2
MD5 007d09cd52a0904c5754a51b43d35e0a
SHA1 ad6bbdf817c3eda47c002a6f6573ab7fa6fb9d6a
SHA512 c19523853be24c46a94e4e5b48775ff37bfa23a58caea9788051e99aaa44114c1958719eb27d959bc8cf8d3b9f076338a433803f4079e19ab6b80c37bcacb222
SSDEEP 196608:E+efi/Mn/R1afmmpLOHgWKL6qw6LTK+umsIBQtTdgn5njBxcO4C8V2VNgbPJ1m+z:ENf4Mn/R14tcXElTz9S6XG2NwJs+
TLSH
T1DED6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-19367.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-19367.exe
Size 12.9MB
SHA256 d845ad2faf9eb9e0204bd4b2d80139bb9a5c83028215f23cb2cf31d618c3db9c
MD5 c5f045350a170935ca6f3877a3636da9
SHA1 4dfb9646853c6f4fb0ac0a07cbf2d2b5ffbc2fc7
SHA512 6b9388b8e3b3eee178fbfb60488334479cb916c29ce074bd80688f04c2387f428a00f1d2a43cece29beeb160a01bf95c66ad433850eb646a0bf5afa332756104
SSDEEP 196608:E+efi/Mn/R15fmmpLBHgWKL6qwrLTK+ZmsSBQtTdgn5njBxcO4C8V2VNgbPJ1m+z:ENf4Mn/R1Ft9XEUTMvS6XG2NwJs+
TLSH
T112D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-19512.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-19512.exe
Size 12.9MB
SHA256 81edd394a68cf87738af75ad80ec9899097cb13e105665aedc99d253835cb1be
MD5 c90ebaca02f1157ed63c23ee1a040417
SHA1 2f2f1888d9cf2dfcaf797e59db7bbabc60efcb27
SHA512 7c7fe99429db24337995b5e1c151ac6f69fbb27fb2c677542cdf8da307d02a491b6554b73569e53b08a9619695b167b7666fa0b9eca82d378c3360edb1b20b59
SSDEEP 196608:E+efi/Mn/R15fmmpLOHgWKL6qw5LTK+ZmsIBQtTdgn5gjBxcO4C8V2VNgbPJ1m+z:ENf4Mn/R1FtcXEOTM9S6kG2NwJs+
TLSH
T1D4D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-23373.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-23373.exe
Size 12.9MB
SHA256 26c9be14264cf7adc1bc5c3951d6af5140445ceff485cc463009b0879a3bcb7b
MD5 d5f7c34b93bb407a7d28dc0f6b4cd831
SHA1 1a3afbf1528c8e6f12fd34a13041ef39f71048c7
SHA512 e72280d783b4e257507b5543d867c669326239bdb1ee462d0f3d7bba5b9b68e1684cdcc28f4506e85314fff43a2fc590485e6b3c45a21a95c3e910d2d6894b4c
SSDEEP 196608:E+efi/Mn/N15fmmpLOHgWKL6qw5LTK+umsIBQtTdgn5njBxcO4m8V2VNgcPJ1m+z:ENf4Mn/N1FtcXEOTz9S6XC2NXJs+
TLSH
T133D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-25912.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-25912.exe
Size 12.9MB
SHA256 7bb0f0ae2e2746bb61fda827bc56f807651b793f345892764bb64db125600bc7
MD5 bb9d9cfeef7be1b890541331825adc37
SHA1 781891f36bf6054f9ede33b656f407cc78403d7a
SHA512 0aae1fa243c7913c720c04b2df3aaf6ac6af1dba878b89342acbf7ae0a8a5e3a3bcc19910315121fe67a62ed1be84c87009e4ea6e565b51eb3aac78143ade7fc
SSDEEP 196608:E+efi/Mn/R15fmmjLOHgWKLaqw5LTK+umsIBQtTdgn5njBxcO4C8V2VNgcPJ1m+z:ENf4Mn/R1FPcXEuTz9S6XG2NXJs+
TLSH
T11ED6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-27566.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-27566.exe
Size 12.9MB
SHA256 b0274e00d5ab7407d08e36c7a959b263a84b2ff91c749d60a0cc108b51311511
MD5 9a5bc69d0147fa23d96d72c02fab9900
SHA1 83d14196728c4eb6023e5c22957e8279693d78f5
SHA512 1c432867e9541d1cdf2599084727b33740db65862754388ba652813d14d28e7e987cb60144aeff31520bd3a091a8df898b91b27e7b94a64c6d6c50ae89f646ae
SSDEEP 196608:E+efi/Mn/R15fmmpLOHgWKLaqw5LTK+umsIBQtTdgn5njBxcO4C8V2VNgcPJ1m+z:ENf4Mn/R1FtcXEuTz9S6XG2NXJs+
TLSH
T145D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-27949.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-27949.exe
Size 12.9MB
SHA256 1cd796a130dc04c4fa6caca498d0b38eea9ea6b9acba7f40d4557091b44157e7
MD5 c8231bd4fefbaf5d3eb87e6259433526
SHA1 6743255fd99c0a92bd4ad327dc8e469705dd1a28
SHA512 6859555a551662de098dc8673daf51521f5e411204d1d1d0511a63bbbd67b2ea5a38373910b92a2e9ea5a100f0aca049e9058fd5ff1b936f592cf3a54a0cbc61
SSDEEP 196608:E+efi/Mn/R15fmmpLrHgWKL6qw5LTK+umsIBQtTdgn5njBxcO4C8V2VNgcPJ1m+z:ENf4Mn/R1Ft/XEOTz9S6XG2NXJs+
TLSH
T1EED6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-30302.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-30302.exe
Size 12.9MB
SHA256 07cd655362ad90f1202b56515901a314be4983e46bad0875f7095a9b640dd4fb
MD5 7fed706a1bc72bc613f89078ce7dbe83
SHA1 c654ed828e2001e178a77679cf3ca3c382d628aa
SHA512 01f8b2f2adc1a67cd20a29e361447898f38d77b4f1ceb5f3aca932eac33d4ecdf7275c3a1b61cf2fe541fbeb49e732af47127efda36e439c617e0fa90759b2fd
SSDEEP 196608:E+efi/Mn/R15fmmpLOHgWKL6qw5LTK+ZmsSBQtTdgn5njBxcO4C8V2VNgbPJ1m+z:ENf4Mn/R1FtcXEOTMvS6XG2NwJs+
TLSH
T117D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-30764.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-30764.exe
Size 12.9MB
SHA256 715e3254e18c990e6fadc69af9cec237e75054356c2c621dc18c5bc8f34e5ebb
MD5 9c9bfb4ade7dd1a8a0b4e5b68bf2b436
SHA1 03dfcb067c0100815ccaf9efb9e5e294930bd471
SHA512 a29a532bce02db53492fe45fdbfdf626316f5fe308066660e790997a9fc533b6dc09dfa7ce7d520ac628fb372059a5e24211645275c1011d2505c9ee3f46e7da
SSDEEP 196608:E+efi/Mn/R15fmmpLOHgWKL6qwULTK+ZmsSBQtTdgn5njBxcO4C8m2VNgbPJ1m+z:ENf4Mn/R1FtcXEfTMvS6X12NwJs+
TLSH
T1AAD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-3353.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-3353.exe
Size 12.9MB
SHA256 7bd1b76442f973be49b49872b4e3dffad63dd184ba991162e494ec798ee2df8b
MD5 e2344eb8587e85798f5e1346664686a1
SHA1 307136ee0a16e7723c744c685c370da1a8c0c073
SHA512 09ec0e013a7242fbf7d1624b53a3f1eb6922a6c65dc9760574c216c4f0896b755b3a4e184f053fa425b91ad56c1f566c4db2263a091a9eaabd7842f4c769dea0
SSDEEP 196608:E+efi/Mn/R15fmmpLOHgWKL6qw5LTK+ZmsSBQtTdgX5njBxcO4C8V2VNgbAJ1mgz:ENf4Mn/R1FtcXEOTMvSqXG2NfJsg
TLSH
T119D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-34443.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-34443.exe
Size 12.9MB
SHA256 daaf9a482c13aa17e0e9a071edd8cbdf49882f67ef9a0b5e0a03c4b32130f8c3
MD5 4d39f39c11df5770334e5102b75f4f7d
SHA1 835975e41857b8447e565458ba4be14ab05b7254
SHA512 3ecd589cd5c537afa8ed8681a1212d7d918dde12d5be0875694df2f7dbb4885c52ed6c417d7bc3eb1aee5a52bc018b12b57ff09e0718be82b8efef227089198b
SSDEEP 196608:E+efi/Mn/R15fmmpLOHgWKL6qw5LTK+umsIBQtTdgn5njBxcO4C8V2VNgbPJ1m+z:ENf4Mn/R1FtcXEOTz9S6XG2NwJs+
TLSH
T115D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-37109.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-37109.exe
Size 12.9MB
SHA256 820b748a6205982be1bb00da24731560c0460744a60edf5258bfa08ca4e6cf02
MD5 78fcc30a8ad1576eb03bdef338ec8429
SHA1 eff92886587ef197408c281f82362a1c22fc778c
SHA512 aa941cfe3a0b5bbbf7e1c5c34581744547649909f6a64153d8b5e3eee2c7fae3afb3729e8ab0aaa105a755793d55f09354a41450fd085c204db8fd05d40ee8b8
SSDEEP 196608:E+efi/Mn/R15fmmpLOHgWKL6qw6LTK+umsIBQtTdgn5njBxcO4C8V2VNgbPJ1m+z:ENf4Mn/R1FtcXElTz9S6XG2NwJs+
TLSH
T12CD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-37955.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-37955.exe
Size 12.9MB
SHA256 c02c4be7bd236a9617b31ec1e1c3d4f95e746dab07d96debd5b0d04f48347690
MD5 a10e9aaea2a53716a635cd23150df4ea
SHA1 9566e0ab8422dea1517f545a219765a06702a855
SHA512 085ec21cf41ff5706f239ce12c0c2cd7db6c13a7e38683b2cc76dc7fca2bbe2b7f6f836659bc59b40af4f68aeb598048db7ac14e38b1c0a638a1bbdc61f92aef
SSDEEP 196608:E+efi/Mn/R15fmmpLOHgWKL6qwrLTK+ZmsSBQtTdgn5njBxcO4C8V2VNgbPJ1m+z:ENf4Mn/R1FtcXEUTMvS6XG2NwJs+
TLSH
T15BD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-39233.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-39233.exe
Size 12.9MB
SHA256 753139418c5d66ab56070abab0ad9040d4af0d016586e1c40f1b013ccc7ba43f
MD5 ccb44ae5f8eaeb880985c85db1dc4c60
SHA1 c3745102e1623ba9072be064475c26640e4e52b2
SHA512 aa3ab6689ee716705186ef4d68a0aa6a8be3ff123c2bbcad89af64db3f4b2a0c7a13049fd5abda697147efd6864db7ea1e1033193cb60068ad53091d5e3b6673
SSDEEP 196608:E+efi/Mn/R15fmmpLOHgWKL6qw5LTK+ZmsSBQtTd4X5njBxcO4C8V2VNgbAJ1m+z:ENf4Mn/R1FtcXEOTMvSiXG2NfJs+
TLSH
T19BD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-40006.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-40006.exe
Size 12.9MB
SHA256 5723c19c241bddbefa04a33d64020f71a230ca21000c31529b4a15680e9cffd8
MD5 16d5103b359497ba59ca235ee63bbf7a
SHA1 7c0ba957537a595a0f5f878ce0b208af066535e7
SHA512 b4595f1826739561ed4a06b68d8b69a6fa6c4c6242d1d457cec120e95c60d4b899487809234369c989f15ee49d6ca5db7ae453e53a0a2ce2b20bac7676d25a82
SSDEEP 196608:E+efi/Mn/R15fmmpLOHgWKL6qw5LTK+ZmsIBQtTdgn5njBxcO4C8V2VNgbPJ1m+z:ENf4Mn/R1FtcXEOTM9S6XG2NwJs+
TLSH
T1E8D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-41624.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-41624.exe
Size 12.9MB
SHA256 ce990c5ed1fc1a6c5f323ea9faf8b04857e65cfd21eb9af6f66eff8717fc5a15
MD5 2edf2487e4dc2540d9e9cf93edac4278
SHA1 8b8e8aca4b469e4506833cdd0badf52ca6508353
SHA512 96781ef88eb83732329289ad8ff22c9286c95a37a5dcbaf9c60de8c829493d2eafb6fe00199010c5b1274d1f0e037d3bf900931314c127c32a2c5cbdf51b68f4
SSDEEP 196608:E+Gfi/Mn/R15fmmpLOHgWKL6qw5LTK+umsIBQtTdgn5njBxcO4C8V2VNgbPJ1m+z:Elf4Mn/R1FtcXEOTz9S6XG2NwJs+
TLSH
T1E2D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-42974.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42974.exe
Size 12.9MB
SHA256 700475951ded1984e8b734338b4760612cf7f3d82dbf70ee3aec18fe4f9c99a8
MD5 30b47ca844f1d9417c71c35d3cf4ad4a
SHA1 fc0727c62712709676a42e9e70be05161672ffdb
SHA512 152d7cf6fb88c9e1c75c67e67071f7975b02d425e946af767761519b571518b8a849898dd23c873f58f7f629c728b4b0757e15ef293b4557226482f37eabab47
SSDEEP 196608:E+efi/Mn/R15fmmpLOHgWKL6qw5LTK+ZmsSBQtTdgn5njBxcO4C8V2VNgKPJ1m+z:ENf4Mn/R1FtcXEOTMvS6XG2NZJs+
TLSH
T19AD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-43056.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-43056.exe
Size 12.9MB
SHA256 26407d66caef3cb474b58cf532705887557c56eff4183144dc625e6654ab41d7
MD5 5aca179a58951360920c6c4872aa3983
SHA1 034ff0ce34dd393830cb8ded869416fcb63c4e0f
SHA512 7c17e90779a25669af3d03fa44d09d91faa6a3a5197f6652d4eda60615daaa90d7aa680c7dff1b19a6801da5b5ae60c3b3e306a26c21249194b60aa94fd08a1c
SSDEEP 196608:E+efi/Mn/R15fmmpLOHgWKL6qw5LTK+ZmsSBQtTdgn5njBxcO4C8m2VNgbPJ1m+z:ENf4Mn/R1FtcXEOTMvS6X12NwJs+
TLSH
T104D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-43239.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-43239.exe
Size 12.9MB
SHA256 19be14689a70a98e38cfe52000cd1025d98a1f6845b3cbb25c7afba4af89b1c6
MD5 ab9e04f53996455e26ad887f6ae5e99c
SHA1 fa630ac0cbd10d7cd7e39a87eef110fbebddde53
SHA512 62dfda11f7c1e5559792979db028b328ebe9a4a9320528ea98b6867eb368c163eaad408351beace4ba526fa1dc473952f9d178fdd2513c6d76dedff80645237e
SSDEEP 196608:E+efi/Mn/R15fmmpLOHgWKL6qw5LTK+ZmsSBQtTdgX5njBxcO4C8V2VNgbAJ1m+z:ENf4Mn/R1FtcXEOTMvSqXG2NfJs+
TLSH
T117D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-44863.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-44863.exe
Size 12.9MB
SHA256 1bdd05132f9a7c304833788f68971ee54714cc3ac6b41a9726cc5a231a0cffdd
MD5 5927934d5a34fb643021590b318bcbbb
SHA1 01919ed211bb24a0246b1d188212cf698a580b83
SHA512 cf2d3ef5cfcef2f65ca9afd4632798bc98d59a333a23addfb9cc7d62651b397978126e29420f77c06ceeafb4c1f7fc10c5ef158148229e6a3cf6c12498a7a81b
SSDEEP 196608:E+efigMn/R15fmmpLOHgWKL6qw5LTK+ZmsSBQtTdgn5njBxcO4C8m2VNgbPJ1m+z:ENfXMn/R1FtcXEOTMvS6X12NwJs+
TLSH
T1EFD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-47432.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-47432.exe
Size 12.9MB
SHA256 618580b50b859493e71d8e60380ee1abfd3c2d007f78836b51f0bb04b412d2a4
MD5 f7e011f8b06bade55c926ea9d4a9edd3
SHA1 7339e3ad65192f456256c3b8428184e48cf5d1d4
SHA512 a731c65762b361926acb30efac129673144d987cbc9ab98896b79f45c72b1e2a7d56ec2bfb29cdbd8b86aa899f5e6e364a69007b29ce83b358e0624643467b62
SSDEEP 196608:E+efi/Mn/N15fmmpLOHgWKL6qw5LTK+ZmsIBQtTdgn5gjBxcO4C8V2VNgbXJ1m+z:ENf4Mn/N1FtcXEOTM9S6kG2NYJs+
TLSH
T1DDD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-55360.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-55360.exe
Size 12.9MB
SHA256 24952b5abbcd638de1e60d02f0a926895d054ffffaa02e01e1f6e731baaa516f
MD5 373976ee66debf371b1ba38400c5b6a2
SHA1 290a1fc9abb6c5d35a00b352dd85411e1c1f294d
SHA512 2cb67d6d585b3dad57f5bcfcf17ad8a01e4fd09a387c0e5c60a0050449f74b93b2d5b35d13a8f27c9c476bcdeba37a9da13a64e60ab6e2e5f772ac9365158c8f
SSDEEP 196608:E+efi/Mn/R15fmmpLOHgWKL6qw5LTK+ZmsIBQtTdgX5njBxcO4C8V2VNgbPJ1m+z:ENf4Mn/R1FtcXEOTM9SqXG2NwJs+
TLSH
T14DD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-61490.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-61490.exe
Size 12.9MB
SHA256 8d2dc0ddd7fcb77a48b9ec4a9ed8e24558a1e216593e2f7dbc4acbb9677e970a
MD5 94a05e2e2d25342d58a8976772ff321b
SHA1 d5a34cdc3da02288c3ae8e793396bfa3a8ba91c7
SHA512 c443ac89a2b1d10bf38f077350c0b85ae7d50a7500ee40b3779bb851cdfb380e2bd26af6ee47a11d79bdcd113cabe585c3f516f64665c9619a4284105c8a6d53
SSDEEP 196608:E+efi/Mn/N15fmmpLOHgWKL6qw5LTK+ZmsIBQtTdgn5gjBxcO4C8V2VNgbPJ1m+z:ENf4Mn/N1FtcXEOTM9S6kG2NwJs+
TLSH
T185D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-61936.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-61936.exe
Size 12.9MB
SHA256 1e4268c58d30f2997ec752905ee72f5c8acf7c909f7202b475230816503ecd39
MD5 e0768f2a2c3f7b6ef190fbe9af686f96
SHA1 3766f7ed122d4c34fddf6239790b5dff2267b3b2
SHA512 660a7f77c7a611658c4e638821cc48baf070f30e20ef15d7c282e4983dabd1cd2f51a16f6acc3c2867afd86b2db8720ad70f20043f06fc97d34029a29c9b1844
SSDEEP 196608:E+efi/Mn/R15fmmpLOHgWKL6qw5LTK+umsIBQtTdgn5njBxcO4C8V2VNgcPJ1m+z:ENf4Mn/R1FtcXEOTz9S6XG2NXJs+
TLSH
T1EED6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-62346.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-62346.exe
Size 12.9MB
SHA256 8b7a0f181616a86a1fdffe5469ba3e122035c9c5fd16dc0b6a9fcf3df949b9f9
MD5 edacb0751c3654e7377036a735f4a6cf
SHA1 ab765044c76730b17d214e33f5900d01f7ce9803
SHA512 3a44245b47f2573c27314a536f02a1ca95f40b638c631c1b588fd58849062f5908b5f13320e03d3af7ff33fd606c19e2a38ba68f724dc97da0052da06719fefc
SSDEEP 196608:E+efi/Mn/N15fmmpLOHgWKLBqw5LTK+ZmsIBQtTdgn5gjBxcO4C8V2VNgbPJ1m+z:ENf4Mn/N1FtcXEXTM9S6kG2NwJs+
TLSH
T179D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-62668.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-62668.exe
Size 12.9MB
SHA256 d510d2b945f0efbd3d816af783dea7b4d1e0a717254c7b3c63ed7615716a0ffe
MD5 ccb0f5494ad2e9b5120a018ab2fcc496
SHA1 0f0c5839be39ef9310729ad673aaf2d6e1ac228b
SHA512 e8fc9e8c8bedccd86e3334cf462b288d003f59d6a71a2ae5e312bd88ccd7615bedf66b316dbf29c49e9125d4f9fe588d49847a41c0e2e294f8d7c31538109663
SSDEEP 196608:E+efi/Mn/N15fmmpLOHgWKL6qw5LTK+umsIBQtTdgn5njBxcO4m8V2VNgJPJ1m+z:ENf4Mn/N1FtcXEOTz9S6XC2NCJs+
TLSH
T14BD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-9274.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-9274.exe
Size 12.9MB
SHA256 4c0bd964e6368159e219bb94ffc2d7f048142efe8bfa50b079450d5ede96c7f3
MD5 b284a93c7a3116b506b76e4eecb9f6b2
SHA1 cf216d02b4f1f0cc7c3c871c0ec1ae20e95c6cda
SHA512 0eea5b7390bda6d3e97f4035c3d44760eea20e18643f4351367a01e022b0fa0c5f791cc6f77ec5c54aae17a97642dc5af3b86f0a36dc94a9d470365e751646f3
SSDEEP 196608:E+efi/Mn/N15fmmpLOHgWKL6qw5LTK+umsIBQtTdgn5njBxcO4C8V2VNgcPJ1m+z:ENf4Mn/N1FtcXEOTz9S6XG2NXJs+
TLSH
T151D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/432-546-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1156-946-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1292-848-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1340-331-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1456-771-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1952-330-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1964-1072-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1984-329-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2312-778-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2388-64-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2444-2014-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2460-893-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2636-894-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2660-16-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2844-332-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2972-950-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3016-1082-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3052-344-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3156-962-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3168-0-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3184-777-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3192-545-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3236-850-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3380-1236-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3604-780-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4100-842-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4160-384-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4228-844-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4244-766-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4264-960-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4324-774-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5008-1352-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5176-889-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5840-361-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5964-385-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6040-849-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6068-547-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6168-944-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6312-1921-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6380-945-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6436-1076-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6472-951-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6528-948-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6780-1175-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6788-1753-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6792-1073-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6852-1643-0x0000000000400000-0x0000000000475000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads