kawaiiunicorn | 72ad85c3aa2a58fce81b576d15d85cd687c110b575bdca82e7d704887aaca9af

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 02:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_2beed6e5a6475710a659026dee420ec5_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe
Size 4.9MB
Sample260805-ckrnestwe1
SHA256 72ad85c3aa2a58fce81b576d15d85cd687c110b575bdca82e7d704887aaca9af
MD5 2beed6e5a6475710a659026dee420ec5
SHA1 e553d3d12049e3f84534241e6978602203322d1a
SHA512 ea7769106c9df6a235115398edba794c09cc7bf7b05ba239cb0a836b4618d729d243d53401410bf4152a617584618566b8e4a775c8ebf5243ce45c017bf4ad6f
SSDEEP 98304:E/0isBcCqzCtDWq/Ri6kLfmDKyMv0VgaHgWKuu/8iUdqw:E/0vi/Mn/R1ufmmWVJHgWKLCqw
TLSH
T1D736E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery kawaiiunicorn trojan

Malware Config

Signatures

Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
trojan kawaiiunicorn

Detects KawaiiUnicorn 64 IoCs

resource	yara_rule
behavioral2/memory/3852-0-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5048-23-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4324-22-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4672-172-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5264-165-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3476-138-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2520-134-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5664-283-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6072-304-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4964-323-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3872-326-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2752-322-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2120-259-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5316-411-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2296-440-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3548-442-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5308-473-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/952-483-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/672-476-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2948-527-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5520-550-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5568-549-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2712-668-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2996-610-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/540-655-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1168-752-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2468-751-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5488-680-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6548-777-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6352-840-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6976-838-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4884-843-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5872-906-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6732-1209-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3744-1127-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6496-1120-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6156-1119-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7112-1118-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3068-1117-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7460-1339-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7204-1324-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/8160-1321-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7596-1320-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6580-1317-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7852-1261-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7632-1260-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7604-1259-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7884-1258-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6972-1257-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7796-1256-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7876-1255-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7248-1254-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7436-1253-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6684-1252-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4800-1212-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6512-1211-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6200-1210-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7468-1134-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4288-1128-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/568-1095-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6160-1094-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3896-1093-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2196-1092-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1920-1091-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 35 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c516-6.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000e00000001c517-11.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c51a-16.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c51b-29.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c51d-43.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c51c-39.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c51e-50.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c51f-56.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c520-64.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c521-81.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c523-85.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c524-92.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c522-82.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c529-130.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c528-127.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c527-125.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c526-164.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c52b-160.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c52a-157.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c52c-155.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c52d-152.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c525-133.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c52e-173.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c532-180.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c531-188.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c530-191.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c52f-182.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c539-206.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c549-231.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c535-267.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c536-266.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c533-256.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c537-261.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c53f-260.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c542-252.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Executes dropped EXE 12 IoCs

pid	Process
4136	Unicorn-45017.exe
4324	Unicorn-4036.exe
5048	Unicorn-55012.exe
4204	Unicorn-63580.exe
1852	Unicorn-54108.exe
4340	Unicorn-33404.exe
3532	Unicorn-30419.exe
5956	Unicorn-33648.exe
2152	Unicorn-27730.exe
5484	Unicorn-44751.exe
5656	Unicorn-32176.exe
4072	Unicorn-57942.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2588	4672	WerFault.exe	111

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44751.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32176.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45017.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55012.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63580.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33404.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30419.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33648.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27730.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_2beed6e5a6475710a659026dee420ec5_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54108.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
3852	2026-08-05_2beed6e5a6475710a659026dee420ec5_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe
4136	Unicorn-45017.exe
4324	Unicorn-4036.exe
5048	Unicorn-55012.exe
4204	Unicorn-63580.exe
1852	Unicorn-54108.exe
4340	Unicorn-33404.exe
3532	Unicorn-30419.exe
5956	Unicorn-33648.exe
2152	Unicorn-27730.exe
5484	Unicorn-44751.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3852 wrote to memory of 4136	3852	2026-08-05_2beed6e5a6475710a659026dee420ec5_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe	89
PID 3852 wrote to memory of 4324	3852	2026-08-05_2beed6e5a6475710a659026dee420ec5_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe	90
PID 4136 wrote to memory of 5048	4136	Unicorn-45017.exe	91
PID 4324 wrote to memory of 4204	4324	Unicorn-4036.exe	92
PID 3852 wrote to memory of 1852	3852	2026-08-05_2beed6e5a6475710a659026dee420ec5_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe	93
PID 5048 wrote to memory of 4340	5048	Unicorn-55012.exe	94
PID 4136 wrote to memory of 3532	4136	Unicorn-45017.exe	95
PID 1852 wrote to memory of 5956	1852	Unicorn-54108.exe	96
PID 4340 wrote to memory of 2152	4340	Unicorn-33404.exe	97
PID 4204 wrote to memory of 5484	4204	Unicorn-63580.exe	99
PID 4324 wrote to memory of 5656	4324	Unicorn-4036.exe	100
PID 5048 wrote to memory of 4072	5048	Unicorn-55012.exe	98
PID 3852 wrote to memory of 4484	3852	2026-08-05_2beed6e5a6475710a659026dee420ec5_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-05_2beed6e5a6475710a659026dee420ec5_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_2beed6e5a6475710a659026dee420ec5_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45017.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45017.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55012.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55012.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33404.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27730.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45929.exe
        6⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26034.exe
        7⤵
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59768.exe
        8⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28020.exe
        9⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62626.exe
        10⤵
        
        PID:8848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28499.exe
        10⤵
        
        PID:11092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30737.exe
        10⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9232.exe
        9⤵
        
        PID:9024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20364.exe
        9⤵
        
        PID:12500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42729.exe
        9⤵
        
        PID:15080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13956.exe
        8⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
        9⤵
        
        PID:10780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60313.exe
        9⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49235.exe
        8⤵
        
        PID:11000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32031.exe
        8⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39326.exe
        7⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21713.exe
        8⤵
        
        PID:7852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23173.exe
        9⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62936.exe
        8⤵
        
        PID:10660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33615.exe
        7⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41087.exe
        7⤵
        
        PID:11896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2084.exe
        6⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27226.exe
        7⤵
        
        PID:428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24401.exe
        8⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9926.exe
        8⤵
        
        PID:11324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21308.exe
        8⤵
        
        PID:1416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58609.exe
        7⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5618.exe
        7⤵
        
        PID:10936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26489.exe
        7⤵
        
        PID:14048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54235.exe
        6⤵
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21713.exe
        7⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59050.exe
        8⤵
        
        PID:12264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10694.exe
        7⤵
        
        PID:10732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27208.exe
        7⤵
        
        PID:12932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27836.exe
        6⤵
        
        PID:7916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59834.exe
        6⤵
        
        PID:10920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26063.exe
        5⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24088.exe
        6⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33157.exe
        7⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64724.exe
        8⤵
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65127.exe
        9⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24662.exe
        9⤵
        
        PID:10844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56445.exe
        8⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41498.exe
        8⤵
        
        PID:10668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15943.exe
        8⤵
        
        PID:12688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11802.exe
        7⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7286.exe
        8⤵
        
        PID:8284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30147.exe
        8⤵
        
        PID:13020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48347.exe
        8⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59132.exe
        7⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47309.exe
        7⤵
        
        PID:11908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47564.exe
        7⤵
        
        PID:7576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54132.exe
        6⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5300.exe
        7⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25434.exe
        8⤵
        
        PID:7736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26879.exe
        8⤵
        
        PID:11648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        7⤵
        
        PID:8792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50463.exe
        7⤵
        
        PID:11744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5885.exe
        6⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10773.exe
        7⤵
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33738.exe
        7⤵
        
        PID:3384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6481.exe
        6⤵
        
        PID:7460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38698.exe
        6⤵
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21220.exe
        6⤵
        
        PID:13160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37309.exe
        5⤵
        
        PID:3108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7552.exe
        6⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61289.exe
        7⤵
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55744.exe
        8⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15561.exe
        7⤵
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7983.exe
        6⤵
        
        PID:6496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64289.exe
        6⤵
        
        PID:9956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6841.exe
        6⤵
        
        PID:6264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58927.exe
        5⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19352.exe
        6⤵
        
        PID:7952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23672.exe
        6⤵
        
        PID:11540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32519.exe
        6⤵
        
        PID:13568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56166.exe
        5⤵
        
        PID:8332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38527.exe
        5⤵
        
        PID:12180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57942.exe
      4⤵
      Executes dropped EXE
      PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20273.exe
        5⤵
        
        PID:1832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2598.exe
        6⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19182.exe
        7⤵
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55077.exe
        8⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32014.exe
        9⤵
        
        PID:8364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44974.exe
        9⤵
        
        PID:11600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15003.exe
        9⤵
        
        PID:13576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4695.exe
        8⤵
        
        PID:8372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21517.exe
        8⤵
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43157.exe
        8⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17069.exe
        7⤵
        
        PID:200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29934.exe
        8⤵
        
        PID:9700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37028.exe
        8⤵
        
        PID:9928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46279.exe
        8⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9833.exe
        7⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59862.exe
        7⤵
        
        PID:10700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25024.exe
        6⤵
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8637.exe
        7⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60405.exe
        8⤵
        
        PID:8808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46126.exe
        8⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1666.exe
        7⤵
        
        PID:9000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28942.exe
        7⤵
        
        PID:11552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65195.exe
        7⤵
        
        PID:8552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11360.exe
        6⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62169.exe
        7⤵
        
        PID:7620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45168.exe
        7⤵
        
        PID:11148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55345.exe
        6⤵
        
        PID:8388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44093.exe
        6⤵
        
        PID:12436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34756.exe
        5⤵
        
        PID:6072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43437.exe
        6⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28321.exe
        7⤵
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39040.exe
        8⤵
        
        PID:11520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42255.exe
        7⤵
        
        PID:9988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9803.exe
        7⤵
        
        PID:1344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30306.exe
        7⤵
        
        PID:1836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7023.exe
        6⤵
        
        PID:7112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60075.exe
        6⤵
        
        PID:9612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33058.exe
        6⤵
        
        PID:12740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14686.exe
        5⤵
        
        PID:3548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17491.exe
        6⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46534.exe
        7⤵
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50230.exe
        7⤵
        
        PID:9552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57945.exe
        6⤵
        
        PID:8816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57417.exe
        6⤵
        
        PID:11892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19149.exe
        6⤵
        
        PID:9468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62124.exe
        5⤵
        
        PID:6732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9942.exe
        6⤵
        
        PID:11012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59794.exe
        6⤵
        
        PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14563.exe
        5⤵
        
        PID:10044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9000.exe
        5⤵
        
        PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61397.exe
      4⤵
      PID:5876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57829.exe
        5⤵
        
        PID:2120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11039.exe
        6⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20210.exe
        7⤵
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62223.exe
        8⤵
        
        PID:1136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65491.exe
        9⤵
        
        PID:9732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54766.exe
        9⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38254.exe
        8⤵
        
        PID:10156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8444.exe
        8⤵
        
        PID:11972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15139.exe
        7⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19590.exe
        8⤵
        
        PID:11156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57221.exe
        7⤵
        
        PID:9244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33546.exe
        7⤵
        
        PID:12324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28797.exe
        6⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1531.exe
        7⤵
        
        PID:8292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19281.exe
        7⤵
        
        PID:12444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15401.exe
        6⤵
        
        PID:9160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17864.exe
        6⤵
        
        PID:12420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19096.exe
        6⤵
        
        PID:9376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21900.exe
        5⤵
        
        PID:3780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17491.exe
        6⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65085.exe
        7⤵
        
        PID:10804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11583.exe
        6⤵
        
        PID:9828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9285.exe
        6⤵
        
        PID:11276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56241.exe
        6⤵
        
        PID:6584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3166.exe
        5⤵
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27263.exe
        6⤵
        
        PID:12484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45795.exe
        6⤵
        
        PID:7192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52118.exe
        5⤵
        
        PID:9856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37247.exe
        5⤵
        
        PID:12016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45120.exe
      4⤵
      PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52949.exe
        5⤵
        
        PID:1652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57843.exe
        6⤵
        
        PID:1152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60005.exe
        7⤵
        
        PID:8300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20218.exe
        8⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42487.exe
        7⤵
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40782.exe
        7⤵
        
        PID:4848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54690.exe
        6⤵
        
        PID:8308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6844.exe
        6⤵
        
        PID:11804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57194.exe
        5⤵
        
        PID:1168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59211.exe
        6⤵
        
        PID:7900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16072.exe
        7⤵
        
        PID:11840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-689.exe
        6⤵
        
        PID:10856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11329.exe
        6⤵
        
        PID:7156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36854.exe
        5⤵
        
        PID:7868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38380.exe
        5⤵
        
        PID:10632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12722.exe
        5⤵
        
        PID:13668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39935.exe
      4⤵
      PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62202.exe
        5⤵
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56087.exe
        6⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28516.exe
        7⤵
        
        PID:12100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50360.exe
        7⤵
        
        PID:7828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50741.exe
        6⤵
        
        PID:10092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47058.exe
        6⤵
        
        PID:1236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-171.exe
        5⤵
        
        PID:7380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6356.exe
        5⤵
        
        PID:4168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2227.exe
      4⤵
      PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55807.exe
        5⤵
        
        PID:8020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21486.exe
        5⤵
        
        PID:12044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12565.exe
      4⤵
      PID:7204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13466.exe
        5⤵
        
        PID:12060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17697.exe
      4⤵
      PID:10740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16573.exe
      4⤵
      PID:3140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30419.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30419.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10049.exe
      4⤵
      PID:3472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56760.exe
        5⤵
        
        PID:3872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5004.exe
        6⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54660.exe
        7⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46334.exe
        8⤵
        
        PID:12380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46340.exe
        7⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41035.exe
        8⤵
        
        PID:13780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47441.exe
        8⤵
        
        PID:13372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12127.exe
        6⤵
        
        PID:7476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17932.exe
        6⤵
        
        PID:10752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37023.exe
        6⤵
        
        PID:6320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-151.exe
        6⤵
        
        PID:10188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27479.exe
        5⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe
        6⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25859.exe
        7⤵
        
        PID:10292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60940.exe
        7⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65323.exe
        6⤵
        
        PID:9792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31996.exe
        7⤵
        
        PID:12460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16044.exe
        5⤵
        
        PID:6972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36990.exe
        6⤵
        
        PID:10772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54908.exe
        5⤵
        
        PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21982.exe
        5⤵
        
        PID:8212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15405.exe
      4⤵
      PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39207.exe
        5⤵
        
        PID:6556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10737.exe
        6⤵
        
        PID:8800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11154.exe
        6⤵
        
        PID:12516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63230.exe
        6⤵
        
        PID:7260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15183.exe
        5⤵
        
        PID:9040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31980.exe
        5⤵
        
        PID:12004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54847.exe
        5⤵
        
        PID:13972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35185.exe
      4⤵
      PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11668.exe
        5⤵
        
        PID:8736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63700.exe
      4⤵
      PID:9168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35597.exe
      4⤵
      PID:4392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34645.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34645.exe
    3⤵
    PID:2724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42320.exe
      4⤵
      PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34387.exe
        5⤵
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2633.exe
        6⤵
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33918.exe
        7⤵
        
        PID:11868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21275.exe
        6⤵
        
        PID:9684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20939.exe
        6⤵
        
        PID:12320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20531.exe
        5⤵
        
        PID:4288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49323.exe
        6⤵
        
        PID:12412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61.exe
        5⤵
        
        PID:10984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49131.exe
        5⤵
        
        PID:4528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22356.exe
      4⤵
      PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24235.exe
        5⤵
        
        PID:7436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47019.exe
        6⤵
        
        PID:12388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39595.exe
        6⤵
        
        PID:6744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25382.exe
        5⤵
        
        PID:5848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31728.exe
      4⤵
      PID:6408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21441.exe
        5⤵
        
        PID:12976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46641.exe
        5⤵
        
        PID:12296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38698.exe
      4⤵
      PID:11252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33937.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33937.exe
    3⤵
    PID:4516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14158.exe
      4⤵
      PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63510.exe
        5⤵
        
        PID:3332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19694.exe
        6⤵
        
        PID:10320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63577.exe
        6⤵
        
        PID:13396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16923.exe
        5⤵
        
        PID:10120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47537.exe
      4⤵
      PID:2196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63426.exe
        5⤵
        
        PID:13060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52209.exe
        5⤵
        
        PID:9352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3723.exe
      4⤵
      PID:9624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62160.exe
      4⤵
      PID:12272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64673.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64673.exe
    3⤵
    PID:2372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4468.exe
      4⤵
      PID:7596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15312.exe
      4⤵
      PID:12204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14280.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14280.exe
    3⤵
    PID:7248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13716.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13716.exe
    3⤵
    PID:11124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2365.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2365.exe
    3⤵
    PID:704
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4036.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4036.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63580.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63580.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44751.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52836.exe
        5⤵
        
        PID:1684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60795.exe
        6⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13001.exe
        7⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29632.exe
        8⤵
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57420.exe
        8⤵
        
        PID:11116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32490.exe
        7⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17009.exe
        8⤵
        
        PID:9328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14424.exe
        7⤵
        
        PID:11084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5610.exe
        6⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-573.exe
        7⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34492.exe
        7⤵
        
        PID:9768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42907.exe
        7⤵
        
        PID:7356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19771.exe
        6⤵
        
        PID:7324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56425.exe
        6⤵
        
        PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11321.exe
        5⤵
        
        PID:1468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56945.exe
        6⤵
        
        PID:1408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61860.exe
        7⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49684.exe
        8⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20832.exe
        8⤵
        
        PID:12028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26606.exe
        7⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3561.exe
        7⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9085.exe
        7⤵
        
        PID:14056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57070.exe
        6⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55656.exe
        7⤵
        
        PID:11532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41779.exe
        6⤵
        
        PID:10960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12203.exe
        6⤵
        
        PID:14032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24302.exe
        5⤵
        
        PID:4880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8070.exe
        6⤵
        
        PID:9144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16456.exe
        7⤵
        
        PID:11640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26924.exe
        7⤵
        
        PID:4120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36727.exe
        6⤵
        
        PID:11308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26653.exe
        6⤵
        
        PID:9844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10711.exe
        5⤵
        
        PID:7284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52790.exe
        5⤵
        
        PID:11504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29011.exe
        5⤵
        
        PID:7344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15373.exe
      4⤵
      PID:5572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58898.exe
        5⤵
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21502.exe
        6⤵
        
        PID:672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2638.exe
        7⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41111.exe
        8⤵
        
        PID:8380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33738.exe
        8⤵
        
        PID:9932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45709.exe
        8⤵
        
        PID:13748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6273.exe
        8⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37555.exe
        7⤵
        
        PID:9136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28589.exe
        7⤵
        
        PID:12276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49321.exe
        7⤵
        
        PID:9432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6701.exe
        6⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9372.exe
        7⤵
        
        PID:8324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36727.exe
        7⤵
        
        PID:11292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43590.exe
        6⤵
        
        PID:8616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58406.exe
        6⤵
        
        PID:10828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13504.exe
        5⤵
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27520.exe
        6⤵
        
        PID:7556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27762.exe
        6⤵
        
        PID:9992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65081.exe
        6⤵
        
        PID:13768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25281.exe
        5⤵
        
        PID:6576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16636.exe
        5⤵
        
        PID:10964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58798.exe
      4⤵
      PID:1232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49851.exe
        5⤵
        
        PID:5308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27579.exe
        6⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29378.exe
        7⤵
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33901.exe
        7⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32387.exe
        7⤵
        
        PID:13552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30337.exe
        6⤵
        
        PID:9176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34811.exe
        6⤵
        
        PID:8592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5191.exe
        5⤵
        
        PID:6752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21444.exe
        6⤵
        
        PID:9708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31138.exe
        6⤵
        
        PID:11572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44089.exe
        5⤵
        
        PID:9872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28218.exe
        5⤵
        
        PID:13084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51027.exe
        5⤵
        
        PID:8396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14692.exe
      4⤵
      PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62005.exe
        5⤵
        
        PID:7056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26793.exe
        6⤵
        
        PID:11256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10283.exe
        6⤵
        
        PID:14768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58449.exe
        5⤵
        
        PID:9820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12720.exe
        5⤵
        
        PID:11936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-915.exe
        5⤵
        
        PID:7944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24320.exe
      4⤵
      PID:6452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55670.exe
      4⤵
      PID:8228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24923.exe
      4⤵
      PID:12712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32176.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32176.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26194.exe
      4⤵
      PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54814.exe
        5⤵
        
        PID:4116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17755.exe
        6⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12809.exe
        7⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53285.exe
        8⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35784.exe
        9⤵
        
        PID:11564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1991.exe
        8⤵
        
        PID:12008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2309.exe
        7⤵
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41498.exe
        7⤵
        
        PID:10676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15943.exe
        7⤵
        
        PID:12660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-920.exe
        6⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62330.exe
        7⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43674.exe
        8⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58587.exe
        8⤵
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59505.exe
        7⤵
        
        PID:11220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31342.exe
        6⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13682.exe
        7⤵
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55100.exe
        6⤵
        
        PID:9888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44568.exe
        5⤵
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8315.exe
        6⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47125.exe
        7⤵
        
        PID:7720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23280.exe
        8⤵
        
        PID:10696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8597.exe
        7⤵
        
        PID:11952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38354.exe
        6⤵
        
        PID:7804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35222.exe
        6⤵
        
        PID:9592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43784.exe
        6⤵
        
        PID:8964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42450.exe
        5⤵
        
        PID:6256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13876.exe
        6⤵
        
        PID:6684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35307.exe
        6⤵
        
        PID:10888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48838.exe
        6⤵
        
        PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24380.exe
        5⤵
        
        PID:8276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-787.exe
        5⤵
        
        PID:1132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4030.exe
      4⤵
      PID:1956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41766.exe
        5⤵
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        6⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28020.exe
        7⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7716.exe
        6⤵
        
        PID:9972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41684.exe
        6⤵
        
        PID:12172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1439.exe
        6⤵
        
        PID:6196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38823.exe
        5⤵
        
        PID:6916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20624.exe
        6⤵
        
        PID:7972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39576.exe
        6⤵
        
        PID:12168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6299.exe
        5⤵
        
        PID:7456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5622.exe
        5⤵
        
        PID:11988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22421.exe
        5⤵
        
        PID:14280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35636.exe
      4⤵
      PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41886.exe
        5⤵
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26882.exe
        6⤵
        
        PID:9112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52457.exe
        6⤵
        
        PID:12036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5273.exe
        6⤵
        
        PID:9128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1666.exe
        5⤵
        
        PID:9008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56109.exe
        5⤵
        
        PID:12212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41237.exe
      4⤵
      PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9102.exe
        5⤵
        
        PID:7196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14627.exe
        5⤵
        
        PID:11624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63353.exe
      4⤵
      PID:7408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5554.exe
      4⤵
      PID:12372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13841.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13841.exe
    3⤵
    PID:4672
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 704
      4⤵
      Program crash
      PID:2588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5156.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5156.exe
    3⤵
    PID:1500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34086.exe
      4⤵
      PID:1292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58653.exe
        5⤵
        
        PID:4800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15417.exe
        6⤵
        
        PID:11008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44737.exe
        5⤵
        
        PID:11332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12127.exe
      4⤵
      PID:7468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7834.exe
        5⤵
        
        PID:13044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39100.exe
      4⤵
      PID:9572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22020.exe
      4⤵
      PID:9520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16925.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16925.exe
    3⤵
    PID:3544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49032.exe
      4⤵
      PID:4856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19725.exe
        5⤵
        
        PID:11048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50554.exe
      4⤵
      PID:10064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60675.exe
      4⤵
      PID:1540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50767.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50767.exe
    3⤵
    PID:6668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26078.exe
      4⤵
      PID:9184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30854.exe
        5⤵
        
        PID:10272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36727.exe
      4⤵
      PID:11592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52976.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52976.exe
    3⤵
    PID:9576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21908.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21908.exe
    3⤵
    PID:13596
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54108.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54108.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33648.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33648.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40776.exe
      4⤵
      PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54814.exe
        5⤵
        
        PID:2644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35809.exe
        6⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63432.exe
        7⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24447.exe
        8⤵
        
        PID:10652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42118.exe
        8⤵
        
        PID:13000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7528.exe
        7⤵
        
        PID:8648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30738.exe
        6⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44674.exe
        7⤵
        
        PID:12984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14461.exe
        7⤵
        
        PID:12304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49932.exe
        6⤵
        
        PID:9616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45586.exe
        6⤵
        
        PID:11920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54703.exe
        5⤵
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40210.exe
        6⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40068.exe
        7⤵
        
        PID:8876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62788.exe
        7⤵
        
        PID:12188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7286.exe
        7⤵
        
        PID:6824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42781.exe
        6⤵
        
        PID:9084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7178.exe
        6⤵
        
        PID:1268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21718.exe
        5⤵
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31178.exe
        6⤵
        
        PID:11108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44439.exe
        6⤵
        
        PID:13588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45870.exe
        5⤵
        
        PID:9864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41737.exe
        5⤵
        
        PID:11268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48240.exe
        5⤵
        
        PID:2744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21435.exe
      4⤵
      PID:3700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14158.exe
        5⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33251.exe
        6⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30121.exe
        7⤵
        
        PID:560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55434.exe
        6⤵
        
        PID:9812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29606.exe
        6⤵
        
        PID:11944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14510.exe
        6⤵
        
        PID:8016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23027.exe
        5⤵
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22878.exe
        6⤵
        
        PID:2720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60324.exe
        5⤵
        
        PID:7588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43219.exe
        5⤵
        
        PID:12964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43131.exe
      4⤵
      PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65262.exe
        5⤵
        
        PID:8348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8079.exe
        5⤵
        
        PID:10180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26290.exe
      4⤵
      PID:8356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30520.exe
      4⤵
      PID:2652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46077.exe
      4⤵
      PID:9496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16826.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16826.exe
    3⤵
    PID:1752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3475.exe
      4⤵
      PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11833.exe
        5⤵
        
        PID:952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43396.exe
        6⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30702.exe
        7⤵
        
        PID:9644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64522.exe
        7⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51170.exe
        7⤵
        
        PID:13472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23363.exe
        6⤵
        
        PID:10008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2964.exe
        6⤵
        
        PID:4900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27422.exe
        5⤵
        
        PID:6788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47380.exe
        6⤵
        
        PID:7840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55389.exe
        6⤵
        
        PID:13036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43689.exe
        5⤵
        
        PID:9092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4312.exe
        6⤵
        
        PID:14356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47309.exe
        5⤵
        
        PID:11884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30478.exe
      4⤵
      PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45446.exe
        5⤵
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17730.exe
        6⤵
        
        PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29183.exe
        5⤵
        
        PID:8764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46795.exe
        6⤵
        
        PID:13424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7857.exe
        5⤵
        
        PID:6276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21718.exe
      4⤵
      PID:6976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33374.exe
        5⤵
        
        PID:9016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6627.exe
        5⤵
        
        PID:2740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16746.exe
      4⤵
      PID:4712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25597.exe
      4⤵
      PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28627.exe
      4⤵
      PID:4156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58798.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58798.exe
    3⤵
    PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27226.exe
      4⤵
      PID:540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45781.exe
        5⤵
        
        PID:7892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2532.exe
        6⤵
        
        PID:11828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55897.exe
        6⤵
        
        PID:13560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4321.exe
        5⤵
        
        PID:11612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11738.exe
      4⤵
      PID:7632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52805.exe
        5⤵
        
        PID:11860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46028.exe
      4⤵
      PID:10692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31730.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31730.exe
    3⤵
    PID:5752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44219.exe
      4⤵
      PID:7876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6735.exe
        5⤵
        
        PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57158.exe
        5⤵
        
        PID:1424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62142.exe
      4⤵
      PID:10308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23316.exe
      4⤵
      PID:6620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6124.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6124.exe
    3⤵
    PID:7884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40957.exe
      4⤵
      PID:13416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29899.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29899.exe
    3⤵
    PID:11140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22655.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22655.exe
    3⤵
    PID:7516
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51777.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51777.exe
  2⤵
  PID:4484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14434.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14434.exe
    3⤵
    PID:3236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15920.exe
      4⤵
      PID:2772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-972.exe
        5⤵
        
        PID:3788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28020.exe
        6⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57110.exe
        7⤵
        
        PID:9076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19503.exe
        7⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9604.exe
        7⤵
        
        PID:7068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25350.exe
        6⤵
        
        PID:9152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16246.exe
        6⤵
        
        PID:11584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4423.exe
        6⤵
        
        PID:14016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28512.exe
        5⤵
        
        PID:7104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38531.exe
        6⤵
        
        PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51990.exe
        5⤵
        
        PID:7256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39425.exe
        5⤵
        
        PID:11904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9860.exe
        5⤵
        
        PID:14344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39326.exe
      4⤵
      PID:968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54294.exe
        5⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7608.exe
        6⤵
        
        PID:9068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65507.exe
        6⤵
        
        PID:52
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-312.exe
        6⤵
        
        PID:8888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16517.exe
        5⤵
        
        PID:9836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57480.exe
        5⤵
        
        PID:11996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23853.exe
        5⤵
        
        PID:9488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8924.exe
      4⤵
      PID:6388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47363.exe
      4⤵
      PID:10600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53215.exe
      4⤵
      PID:1452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25519.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25519.exe
    3⤵
    PID:2308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8647.exe
      4⤵
      PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13624.exe
        5⤵
        
        PID:2556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61473.exe
        6⤵
        
        PID:1548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4998.exe
        5⤵
        
        PID:9848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1895.exe
        5⤵
        
        PID:11732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42876.exe
      4⤵
      PID:6212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60617.exe
        5⤵
        
        PID:9944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
        5⤵
        
        PID:6392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30957.exe
      4⤵
      PID:9604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15943.exe
      4⤵
      PID:13208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1723.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1723.exe
    3⤵
    PID:3204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34505.exe
      4⤵
      PID:7300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37321.exe
      4⤵
      PID:1860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57457.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57457.exe
    3⤵
    PID:8160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38698.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38698.exe
    3⤵
    PID:10848
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42069.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42069.exe
  2⤵
  PID:3136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33325.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33325.exe
    3⤵
    PID:1496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2103.exe
      4⤵
      PID:2420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31227.exe
        5⤵
        
        PID:568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-480.exe
        6⤵
        
        PID:896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6708.exe
        6⤵
        
        PID:13616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21586.exe
        5⤵
        
        PID:9920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9716.exe
      4⤵
      PID:7080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37168.exe
        5⤵
        
        PID:12248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5085.exe
      4⤵
      PID:10132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18835.exe
      4⤵
      PID:1356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36975.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36975.exe
    3⤵
    PID:4632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48663.exe
      4⤵
      PID:6600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40644.exe
        5⤵
        
        PID:8832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36727.exe
        5⤵
        
        PID:11300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49793.exe
        5⤵
        
        PID:13436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37991.exe
      4⤵
      PID:8840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19484.exe
      4⤵
      PID:2044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51574.exe
      4⤵
      PID:3912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3166.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3166.exe
    3⤵
    PID:7036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30364.exe
      4⤵
      PID:8824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3305.exe
      4⤵
      PID:11796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58085.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58085.exe
    3⤵
    PID:8864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12710.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12710.exe
    3⤵
    PID:12064
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49576.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49576.exe
  2⤵
  PID:4320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54890.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54890.exe
    3⤵
    PID:2996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33630.exe
      4⤵
      PID:6700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20624.exe
        5⤵
        
        PID:7960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4543.exe
        5⤵
        
        PID:11836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35926.exe
        5⤵
        
        PID:9296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55413.exe
      4⤵
      PID:9200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25793.exe
      4⤵
      PID:13068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8235.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8235.exe
    3⤵
    PID:7796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36842.exe
      4⤵
      PID:6484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54388.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54388.exe
    3⤵
    PID:10916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51574.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51574.exe
    3⤵
    PID:13908
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15571.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15571.exe
  2⤵
  PID:4852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3648.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3648.exe
    3⤵
    PID:8856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12197.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12197.exe
    3⤵
    PID:11200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48347.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48347.exe
    3⤵
    PID:1656
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57137.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57137.exe
  2⤵
  PID:7684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18711.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18711.exe
    3⤵
    PID:11440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39294.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39294.exe
    3⤵
    PID:8756
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38062.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38062.exe
  2⤵
  PID:13564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 228 -p 4672 -ip 4672
1⤵
PID:4512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-10049.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-10049.exe
Size 4.9MB
SHA256 39bcc88a47fcbe60a911576cd3ae620148fa5d356df06d7f79dfdb6fa7a10560
MD5 005fb4bd7b368f616616e755b1a288fc
SHA1 ca3cbabf4a52719a6cba35bd61f0a3c32e81f7eb
SHA512 8285d7db27b60f51a2790c5b03e098c018acd82ed4fd0128ee880614ed6086a29ebda58e87cf3657d2e072a36ba7767c777b9f972218295da727fbc088b67a8a
SSDEEP 98304:E/0isBcCqzbtDWq/Ri6kLfmDKyMv0V6aHgWKuu/8zUdqw:E/0vi/Rn/R1ufmmWVfHgWKLBqw
TLSH
T16636E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-13841.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-13841.exe
Size 4.9MB
SHA256 84993a0da959f1810dad08e9ee95104a96e00e6d53083ed9769c6be316c1ed37
MD5 6e0f082c77342800e9f9d5e77851ef59
SHA1 db77d89acbee604c010e6341d2e061bda1398fc9
SHA512 fa7e8e8468cf22312ffdffd0baec9c22aac755cc9a108ea9e8cd4294c53759b9a37dee25d3d3dd4fdafe2ac826fd00e52eef4c9459d07c91608c327f438a097f
SSDEEP 98304:Ec0isBcCqzCtDWq/Ri6kLfmDKyMY0VgaHgWKuu/8iUdqw:Ec0vi/Mn/R1ufmm9VJHgWKLCqw
TLSH
T12A36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-14434.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-14434.exe
Size 4.9MB
SHA256 0ca66385f650091edb6ad343a28073a32f61d9f329ff8336ee42efae194dff89
MD5 5ebc8765befc6c7f7624b307edbecee2
SHA1 1ee25c7a1b76134a4249d01ae51f63916cafc3bd
SHA512 4f29d1c0baba1dd2a684050bf9b3502c228793681143303341c2c0ee12a06307299138f953688eea7509d0ac2d25da22ea2c95bfab0ff00e613df058093a8b39
SSDEEP 98304:E/0isBcCqzCtDWq/Ri6kLfmDKyMv0VgaHgaKuu/8iUdqw:E/0vi/Mn/R1ufmmWVJHgaKLCqw
TLSH
T19336E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-15373.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-15373.exe
Size 4.9MB
SHA256 662ddb7b1e0f9beebf6e09872c308b4bfa58bb950c981336657727808efe2dd6
MD5 ac392efec5460af7b6281a1509dffe46
SHA1 2d93bc9002ef2cc709a1df8dca218cf7d1c7ca43
SHA512 a590bd2c3255798b11bfd0c9a6b4f59fe1de374675c3fa60575b40bb30ea9cf8204792cdb4591f0d0a23f7499825561ad0341b1cdd9b28602db1a234916e916e
SSDEEP 98304:E/0isBcCqzCtDWq/Ri6kLfmDKyMY0VCaHgWKuu/8iUbqw:E/0vi/Mn/R1ufmm9VHHgWKLoqw
TLSH
T13A36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-16826.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-16826.exe
Size 4.9MB
SHA256 7112c2d7607c8999d9ff57402116cbf9a30c576315143696cc605773628ecc30
MD5 85d8ede44536eb1c7d8106ec26e703c5
SHA1 f862b0e8be5c469fa3c5fcfeb47fbe142c37182f
SHA512 8ac7887c403cbf6cd96b74246d56037d970625cbe1e02103082002756537cb11364fe252a58922a5cb1aff26b44901f8c7e532f4f901afd5f15d666b15eb3e5e
SSDEEP 98304:E/0isBcCqzCtDWq/Ri6kLfmDKyMv0VDaHsWKuu/8iUdqw:E/0vi/Mn/R1ufmmWV+HsWKLCqw
TLSH
T12D36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-20273.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-20273.exe
Size 4.9MB
SHA256 6d99be3431d384cf5a100c26ca843bc3cb2650e182a6eecfd7e838c228be8ac8
MD5 f8bda214512b0d0637211db62e08b3c2
SHA1 5e6127618df6a954c62af2c91d706f4b1f2a2aed
SHA512 9511a3154cb1b541e5d0eb187023761e4aefb78a135dabd1c8aec6387c37b8fcf3f32a4f62f4b042bdcc4395467a1623c24288770bfa099715f8c6f11a755e40
SSDEEP 98304:E/0isBcCqzltDWq/Ii6kLfmDKyMv0V6aHgoKuu/8iUdqw:E/0vi/Dn/I1ufmmWVfHgoKLCqw
TLSH
T1A636E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-2598.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-2598.exe
Size 4.9MB
SHA256 6b5a8c49b7749f23e158f98f5bf7b1481c26d36f98960da227fd78dc0c25b32a
MD5 bc484fdafd38eea5ea25892f2975b28e
SHA1 9f8c2ef8f80afa1e22fc2b309b46cf0c0907d231
SHA512 9d6fc165873364657482a26e516694e4119918f294065b1d9ee52451205f51aa8321f7a69b98e65d5ee333bf80f17547115ad5a8eea62a2c20625d0da23019b9
SSDEEP 98304:E/0isBcCqzltDWq/Ii6kLfmDKyMv0V6aHgoKuu/8iUdql:E/0vi/Dn/I1ufmmWVfHgoKLCql
TLSH
T19036E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-26034.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-26034.exe
Size 4.9MB
SHA256 0cb90b9c04f35122d1ebdba93cbaac600cce5f7e1007e6863f2b4a12d8c70617
MD5 d0b231908ce09cfd9d7114d68fc607b3
SHA1 dfe30207c6030a214592b6741295f148a26e7777
SHA512 ef4f0e22753a5df7ca601f66552c3a20f5d5872ae32ed6ef239e1e4fc8c46804602b05be02a971b929efe0c7e0a4a415d9b133eabf18fb48345613b832f2e866
SSDEEP 98304:E6fisBcCqzCtDWq/R06kLfmDKyMv0V6THgoKuu/8iUdqw:E6fvi/Mn/RDufmmWVWHgoKLCqw
TLSH
T18436E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-26063.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-26063.exe
Size 4.9MB
SHA256 ff30b4612fa96ff7122a00b5da9e3640acfc4c69769ec68afcbdc2aa0087c45f
MD5 4840dcd0a1ffd3725d7fe10a94a38967
SHA1 5cdd254e2b63d4ddbb53e977f87553f78de240d1
SHA512 e35fb17b4e0a697227b8100de121c21366f72fcb9387191121cd9fa6fb99b0cebb63084700108c4068b62291d90b4702b896219c335bc601adb9bddccd99e150
SSDEEP 98304:E/0isBcCqzCtDWq/Ri6kLfmDKyMv0V6THgoKuO/8iUdqw:E/0vi/Mn/R1ufmmWVWHgoKrCqw
TLSH
T14B36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-26194.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-26194.exe
Size 4.9MB
SHA256 d9eabbb1b7adc2434006d4aefb7de2e03885d0ac366e6cbee03e0cffa26a7c2b
MD5 96212a31785efea58cab574030b82110
SHA1 76b965491287bbc1b7cba95c0454718129d967d1
SHA512 2413ef27d5164d022a09be61614ec0e3f6fc3fdcc517ee106f48b22050b6a928e6bd69768a2a60679b2de999e2abb9fe2de82d3980d080f6f8c43570b13325fb
SSDEEP 98304:E/UisBcCqzCtDWq/Ri6kLfmDKyMY0VgaHgWKuu/8iUWqw:E/Uvi/Mn/R1ufmm9VJHgWKLhqw
TLSH
T11F36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-27730.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-27730.exe
Size 4.9MB
SHA256 e97177a2128ebb6bbc7c6ec2c0f3765c5f0e58d114d0004de28283d1ac40c75d
MD5 f2270d85b2158eff6609f3a23e5ea252
SHA1 3f4eb2d72be341613041e44a7f1cbcdb4225d3ba
SHA512 f3e60850a8c019777ed9f343bd4c5ab4995311b26a98f871d0e1d5d6e9576526c00b097b99fc4f0c391d47d198e106fef6fbdaff652ce0e95e79f1c58398e9f3
SSDEEP 98304:E/0isBcCqzCtDWq/R06kLfmDKyMv0V6THgoKuu/8iUdqw:E/0vi/Mn/RDufmmWVWHgoKLCqw
TLSH
T1EE36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-30419.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-30419.exe
Size 4.9MB
SHA256 c0752f52323b371c0d45f4d89b9c1665a4ae2d7e1ec6d93ab937329fdb174571
MD5 ca24d023f1caade3df7e37771725e9e5
SHA1 0dcfea698bb24d4ad8bb533e55444f274eefdab6
SHA512 d7bd1f24f8b0a3a0e680343fc2f6f08aa2891f4b4542fd1ce10cb7cdebe6834b63f2c9d7cce1d4294fbfb456c8a89425332b1f56fb8f0b14d96adcb1af100e92
SSDEEP 98304:E/0isBcCqzCtDWq/Ri6kLfmDKyMv0V6aHgWKuu/8zUdqw:E/0vi/Mn/R1ufmmWVfHgWKLBqw
TLSH
T17736E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-32176.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-32176.exe
Size 4.9MB
SHA256 23798d431e7f4f027fbd052bba9a9653eb60d78f919a0db2b8204d2d6f3eb8c8
MD5 b6c0228efcdc0033004197c3d671fe25
SHA1 a10e9b1c63d6956b2a58a4dbc670ff9c23f1b04a
SHA512 69b9c36754942386c98d3877526cb222d635db5cfc7014c3f4c58fac289b0bdcb205d864d3fb924980fd12ee558fc6bb40f6299ce3b7b7441b3ae5e55f12d565
SSDEEP 98304:E/0isBcCqzCtDWq/Ri6kLfmDKyMY0VgaHgWKuu/8iUWqw:E/0vi/Mn/R1ufmm9VJHgWKLhqw
TLSH
T14B36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-33325.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-33325.exe
Size 4.9MB
SHA256 feb3ff201f7445a04226551dfda862cf8a57d9260f147371dbedb8ac4463051c
MD5 a3b7707c9465c405aebd2253843f7efd
SHA1 5d9abfaa4562c33080fb6c99139f146638c44c1c
SHA512 aa3c9992874c3fae7b91d16f133845db6bec07aa82da46346ba2498ff855b6f90d6c2a36ca2a5b0494a048aedf9619a9ad2cddf5d1354cee742ca07f7a4602b3
SSDEEP 98304:E/0isBcCqzCtDWq/Ri6kLfmXKyMv0VjaHgWKuu/8iUdqw:E/0vi/Mn/R1ufmaWVeHgWKLCqw
TLSH
T1E436E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-33404.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-33404.exe
Size 4.9MB
SHA256 95b3892c761bfc4ec62fafa4967fa07de6a2781bad84085728ed9e8bbd8177f0
MD5 210797617bd5429ef777a5cd5977218d
SHA1 705924f938f3c9d2f2ee3585f285cc2499a99ae9
SHA512 621a841fb2925e40b89883720cd90933a12ff4dc4e76472ed93f31ad00520bd9406da557b5389b3fc50f12031d543cec8fb7cdb0490fdca5c79dea77c80133a7
SSDEEP 98304:E/0isBcCqzCtDWq/Ri6kLfmDKyMv0V6THgoKuu/8iUdqw:E/0vi/Mn/R1ufmmWVWHgoKLCqw
TLSH
T10736E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-33648.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-33648.exe
Size 4.9MB
SHA256 41b2eb4741f5883e12c57ad64960dec7f8aa327e7cc311adeb0ca99b020f0d2d
MD5 70c5dba372d61bf3eba47c7153e6d694
SHA1 bf09a6a304384a88d1a0ec853b2219255581b3de
SHA512 bf35cbdc8648984f5172a51328cca5c0eb4e1983b48ffaec157869d6326b2deee5bccdd6fa8712fb47ccbad23c99f99c4c18a367403203d14b4587a5275bcd46
SSDEEP 98304:E/0isBcCqzCtDWq/Ri6kLfmEKyMv0VDaHgWKuu/8iUdqw:E/0vi/Mn/R1ufmfWV+HgWKLCqw
TLSH
T13A36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-34645.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-34645.exe
Size 4.9MB
SHA256 5a2fea4dbb9a36f4dbb252d80658002222d32a28905fa4e78be55ac88edd03b1
MD5 a0197d05d28afb6cbd08c41842cbac2f
SHA1 9057598110f85884f10401f5eddb1e05b81ccf23
SHA512 ab806939635505733516d96c9a3e031d40b995330cb462d7affb7cbc6d4546487aeff8adb07220d0074e282f62776aef99f6a72de5546229f48cec6c791e8e03
SSDEEP 98304:E/0isBcCqzCtDWq/Ri6kLfmDKyMo0V6aHgWKuu/8iUdqw:E/0vi/Mn/R1ufmm9VfHgWKLCqw
TLSH
T11C36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-4030.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-4030.exe
Size 4.9MB
SHA256 f1ec50fd1cc7e6e16bfc07b990bec37eb3e69a1eced14e19c104c587e666460b
MD5 02b6360434d30e74e8984076ddc889f3
SHA1 f08d7da82713d2d2f4cd1b20e537269308644797
SHA512 0a3b2bb6d08965c7ad80a36a79d093e555d20dd5e48c1a8a8cc89ef96ff9cf6af9914a7c45a33e407c86d12f82fd5ff030a1a38c31e6f57da835df5f27ccc51c
SSDEEP 98304:E/0isBcCqzCtDWq/Ri6kLfmDKyMw0VgaHgWKuu/8iUWqw:E/0vi/Mn/R1ufmmVVJHgWKLhqw
TLSH
T13036E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-4036.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-4036.exe
Size 4.9MB
SHA256 c7526ad5c3272e72e5869b4468d9525c2e62964f346940072f5ede572109eec9
MD5 6da7ec01d76c86da148427a7f3efb079
SHA1 d32427d7838cae65a4e202d306f950435ef6523b
SHA512 8e0004c3f3e410265727630dd8e90a875cd26c848155eefcbd65c09f77fb0c6dfacfbe42c5f2011df066af538581941775cfe8b00866a6e8ba395110589a7d80
SSDEEP 98304:E/0isBcCqzCtDWq/Ri6kLfmDKyMY0VgaHgWKuu/8iUdqw:E/0vi/Mn/R1ufmm9VJHgWKLCqw
TLSH
T1CE36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-40776.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-40776.exe
Size 4.9MB
SHA256 c0e06bd393fa6a6842084af4717aa961373bc2de5c213272722eeb406554b0a6
MD5 a444f88ed333d4e04b5d5865029a7574
SHA1 5f8554b537d713f5b195ac970caa882f75b68637
SHA512 ec5ee5406f2618ea60ecf9a048f4f16c4444c89ebb814799bcefa34d6587d4ecda7aa66bc4a783884fd2471a746f41439119c0e509eec2cbd391f816c35203f6
SSDEEP 98304:Ek0isBcCqzCtDWq/Ri6kLfmEKyMv0VDaHgWKuu/8iUdqw:Ek0vi/Mn/R1ufmfWV+HgWKLCqw
TLSH
T17636E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-42069.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42069.exe
Size 4.9MB
SHA256 4831011ae780b6ce61b6a7be11424b367937632b217d82a8b09d35e287703d52
MD5 6cd7d22f8de12d5f1e1d938b11cc45ae
SHA1 49cfb671e319142d89b43361350577e7f98d6fbf
SHA512 f054bd3b05cffccac54f0a23a9e1fcc4cf5846907dcd192a132fe601bdf09b0ee62aaf7161531f3c6b41c9bc1655c5a0ba4b69f28c6b7dde4fd5ce4428097594
SSDEEP 98304:E/0isBcCqzCtDWq/Ri6kLfmDKyMv0VjaHgWKuu/8iUdqw:E/0vi/Mn/R1ufmmWVeHgWKLCqw
TLSH
T12C36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-44751.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-44751.exe
Size 4.9MB
SHA256 08b70392166bc7962d9d8c2bdba4a9ebadca7ed99180ca9d22de86c24d858839
MD5 d609b49ae84f4e0dd43fa60fa98b169b
SHA1 0f5daf01d7fa7b32dd49cd10cc26e36aa85c152d
SHA512 89aad4fc37a35f8c5b631c46a397737a5ba4fa7be9dabd2cd526da6e616f04be748f4720e8e549d117bd557931bc754ba249aae1122d6c88d445eb4a7bdd303f
SSDEEP 98304:E/0isBcCqzCtDWq/Ri6kLfmDKyMY0V0aHgWKuu/8iUbqw:E/0vi/Mn/R1ufmm9VFHgWKLoqw
TLSH
T11F36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-45017.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-45017.exe
Size 4.9MB
SHA256 5d7a6f28f72ae4c422fcd11c6ab72ba064fb62deb1a2832ecccba40d5114ed40
MD5 66accb0b27d81384ce514d6abcddd132
SHA1 931abe67f721e0d8b4a010baddccd31dbdaa25fd
SHA512 ed175bf910b0b554e5a9ac29d974ed23ecb7dc7ed0ad3d7b3ba4205e1dff206bfe3f8fe7ebff7f296b5276a0e6bfab7bdac2fe5560f2d4b961aef4acf9981b59
SSDEEP 98304:E/0isBcCqzCtDWq/Ri6kLfmDKyMv0V6aHgWKuu/8iUdqw:E/0vi/Mn/R1ufmmWVfHgWKLCqw
TLSH
T17436E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-45929.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-45929.exe
Size 4.9MB
SHA256 beefd0f9fc2e843949026f2915a660caf53af43f262a9ef3e421c07172682287
MD5 e119f6ba664898708ce5486d6e03728b
SHA1 a734733f98abe268659a131a3e2c9c93b305d1d6
SHA512 28f1340233343aab99f26f8885ddac05a7033bfded40efa0ed1308440d497a25db9b0eec3266b55f1693f899d98aaed021a71537e46ca005783ad0239443cb0a
SSDEEP 98304:E/fisBcCqzCtDWq/R06kLfmDKyMv0V6THgoKuu/8iUdqw:E/fvi/Mn/RDufmmWVWHgoKLCqw
TLSH
T13236E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-51777.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-51777.exe
Size 4.9MB
SHA256 f177e1f6534197ad4a4bdbbe09d4faac281cd8caa5b0c0cb7509bace38746b43
MD5 dad218edfcb1068cf3cbdef473aed151
SHA1 db125b6f483fd4a6b40ff4871009a5ca23f74710
SHA512 a71c0bb001e301fd21962293f55c3be3b47471aa7d5bc120384078a79652d2869b0c1f87c77579f933fd7a925873e272b9856771628526d48310fcd7c355a615
SSDEEP 98304:E/0isBcCqzCtDWq/Ri6kLfmDKyMv0VgaHgWKuu/8iUdqw:E/0vi/Mn/R1ufmmWVJHgWKLCqw
TLSH
T15C36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-52836.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-52836.exe
Size 4.9MB
SHA256 aac058f3d1501403ec660df30ca9f1c7a542ac89b902c120d538152255411277
MD5 08735e1cd54d22c8c0b6519a3e08a01d
SHA1 1af8f4b0211f2e3d5a5654ccb95007f876bc29e0
SHA512 6f76c0c0e8e59a0aace50fcfdd46efca4b26d270228e6acf5911d9e9829dacbb07185cba4b6cd428515dd1be712d8ecda12b3b4bd9aba410c75926f3ed54881f
SSDEEP 98304:E/0isBcCqzCtDWq/Ri6kLfmDKyMY0V0aHsWKuu/8iUbqw:E/0vi/Mn/R1ufmm9VFHsWKLoqw
TLSH
T1A936E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-54108.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-54108.exe
Size 4.9MB
SHA256 efa52f028578e50e953dac7a99b4c4106bd442d544f9abbab69f79a13531816a
MD5 21276c8f7b73a9b4e0e44e0b69ea4e08
SHA1 70f35087a1bfd8833267e1fa2ca2995cd0ad57a8
SHA512 5989bd83891e36975b7db8a4b2b75576fae2a254ee637494b5d63255fd590929f30299d1e6f0a4d19184e4f56fbb181097ab5be1ab6ce4cffaa11f31a7656288
SSDEEP 98304:E/0isBcCqzCtDWq/Ri6kLfmDKyMv0VDaHgWKuu/8iUdqw:E/0vi/Mn/R1ufmmWV+HgWKLCqw
TLSH
T1BD36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-54814.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-54814.exe
Size 4.9MB
SHA256 aa376d17bf2ee5f27dd22681af16082139c637c8270d09cfb5fc57d6246baf28
MD5 047e14900fe3769f12c5155fd4118584
SHA1 6ae649e15282970acd65dd490a7f39e3980a81bd
SHA512 076d0755fdb89ca087cc089c8c740241993ba3a977d7c7c089d8cbf9fe899020527f365a7dab33a9f535a7c8b1c0538f7067cf350b094e0a1df4f894205c5595
SSDEEP 98304:E/UisBcCqzCtDWq/Ri6kLfmDKyMY0VgaHgQKuu/8iUWqw:E/Uvi/Mn/R1ufmm9VJHgQKLhqw
TLSH
T16A36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-55012.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-55012.exe
Size 4.9MB
SHA256 5df62cf171962690f827bc1f938977bab69ab079cae86dd0b9b46e81519a5c8f
MD5 12d6ae6e78e1c68fa4ef100ce69703aa
SHA1 83879e0b3a0025cf1e50530bdb19fd67038b7b9b
SHA512 af4dcab7ea28db6ac554f8e93fd19762aaa17862776ce10b9ae423ce863af70ef317db2d154330f652e41d2ae97b1b6cf0d34df79d5d831e69d6b0310ee4b348
SSDEEP 98304:E/0isBcCqzCtDWq/Ri6kLfmDKyMv0V6aHgoKuu/8iUdqw:E/0vi/Mn/R1ufmmWVfHgoKLCqw
TLSH
T1CA36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-57829.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-57829.exe
Size 4.9MB
SHA256 70ae490df53e87e3dca8aa1eb67c132ddffd9723a3a29e1d493ad833a7523536
MD5 fbddf2dbf09b52c6c6021e156476b06c
SHA1 66a38c8b4d76d05f0bd1942d90584e2e1404d873
SHA512 9f68312db24695b35041578cdff5d740b60e782034da5c8b45452404ac1b7a2f6447d57027cb6243f6ded9529f9f6d59a4c0c7f51cec66e65d0379d21c61ba75
SSDEEP 98304:E/0isBcCqzCtDWq/Ri6kLfmDKyMv0V6aHgpKuD/8iUdqw:E/0vi/Mn/R1ufmmWVfHgpKWCqw
TLSH
T1D436E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-57942.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-57942.exe
Size 4.9MB
SHA256 dc7fd6ce4d4321072b5b18e7052e72151015086669d432ead89ff14b89fb96cc
MD5 4eb564bd8aa336f434ed19391e296d8e
SHA1 1c4f57fd97ad26b653ac6c380dce040d081f6580
SHA512 d786c523c2730174ff225fd28462b5828cb30a2735ae850c3b9ac2989f50c4f80e1abe678a0b74fb6a0a51426638620c48d4efa81185d4da68720f9357075181
SSDEEP 98304:E/0isBcCqzCtDWq/Ii6kLfmDKyMv0V6aHgoKuu/8iUdqw:E/0vi/Mn/I1ufmmWVfHgoKLCqw
TLSH
T19C36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-58798.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-58798.exe
Size 4.9MB
SHA256 73acf563340d80437b952244053e87eabff28978c78ae7428a2057436357d2dd
MD5 f3577d65fa268f4a5204d1994ce3fbe2
SHA1 09ee54102e1e7f41ebc2e17ad52e451c1fecedc5
SHA512 8264ceccf4e437b059c07c7dbf4f162deb8e883ed1be43d9443da00b2c49bee0f4ac5d8f38ced4b3305efab7641ce028970d75656c8c0e40ae3d548206ecc3ca
SSDEEP 98304:E/0isBcCqzCtDWq/Ri6kLfmDKyMY0VgaHSWKuu/8iUbqw:E/0vi/Mn/R1ufmm9VJHSWKLoqw
TLSH
T10236E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-58898.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-58898.exe
Size 4.9MB
SHA256 243d7979e06d1c3fe44a9eb087f75448bc8f56f59d33d53a12bb2ac2916c8e45
MD5 111043b8c94d6ca9f4ad2d8629700450
SHA1 116e591bf9145371c48bfbd023c079bb2f94b51f
SHA512 18e822be0727681980c8b6954cec6b7993f9a650e78ea92b2ea5cc6f478f5340e089dfd893192fc623d6f6f93ddc6c326fde9c34bdcff7fd3a8eaf0aea02680f
SSDEEP 98304:E/0isBcCqzCtDWq/Ri6kLfmDKyMo0VraHgWKuu/8iUdqw:E/0vi/Mn/R1ufmm9VmHgWKLCqw
TLSH
T14F36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-61397.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-61397.exe
Size 4.9MB
SHA256 246d02e2c6fb35a828263cf3f1961ee5b2a262e0029c6c407f48be3b4b9774af
MD5 5b149a40cea2d4b193ad5c23f8aa6017
SHA1 668597eacc064adbecff121abb6ef530ad1ec996
SHA512 a91c00f932fcbb68fc7e630182229d75dd1449489345f21bcde2ecb0825b36ff5d3591beeddfeaec859b754635dd5748a9a7a54d26077df5a1dbd755bd6ce16c
SSDEEP 98304:E/0isBcCqzCtDWq/Ri6kLfmDKyMv0V6aHgpKuu/8iUdqw:E/0vi/Mn/R1ufmmWVfHgpKLCqw
TLSH
T19436E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-63580.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-63580.exe
Size 4.9MB
SHA256 c2d5ae76e05890d280117eae9fef8c6a8f96386487edb2d2a192af54011cd438
MD5 563605a50169edd9a8f6796cf9865a05
SHA1 790697ee114aba4129ff302aa3cc190908574368
SHA512 72d53f6c11a82bb77126d3814c1ea50943a575d4c5cff46bf987b9ccbcdf2b6c3bec686e1e83d4cb2443fee37a957c3e33f2747d3a2ea3e0ab8d66646de61680
SSDEEP 98304:E/0isBcCqzCtDWq/Ri6kLfmDKyMY0VgaHgWKuu/8iUbqw:E/0vi/Mn/R1ufmm9VJHgWKLoqw
TLSH
T19036E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/540-655-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/568-1095-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/672-476-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/952-483-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1136-1090-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1168-752-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1288-836-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1920-1091-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2120-259-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2196-1092-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2296-440-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2468-751-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2520-134-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2712-668-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2752-322-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2940-1088-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2948-527-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2996-610-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3068-1117-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3476-138-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3548-442-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3744-1127-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3852-0-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3852-2332-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3872-326-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3896-1093-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4136-2680-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4288-1128-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4324-22-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4672-172-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4800-1212-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4884-843-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4964-323-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5048-23-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5264-165-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5308-473-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5316-411-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5488-680-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5520-550-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5568-549-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5664-283-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5872-906-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6072-304-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6156-1119-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6160-1094-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6200-1210-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6336-839-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6352-840-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6368-841-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6496-1120-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6512-1211-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6548-777-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6580-1317-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6600-1087-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6684-1252-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6732-1209-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6752-842-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6788-1085-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6796-903-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6836-904-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6956-837-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6972-1257-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6976-838-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7012-902-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7036-963-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7072-1089-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7080-1086-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7112-1118-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7132-905-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7204-1324-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7248-1254-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7436-1253-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7460-1339-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7468-1134-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7596-1320-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7604-1259-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7632-1260-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7796-1256-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7852-1261-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7876-1255-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7884-1258-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/8160-1321-0x0000000000400000-0x0000000000475000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads