kawaiiunicorn | 708e5c85080f1eb99def0404cb5809f1439e6d13aa9a3c39ae801fb8adf788c8

Analysis

max time kernel
146s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 14:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_585bd7595b93a8274da49c8490d31843_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe
Size 4.9MB
Sample260805-rhk57ahn7x
SHA256 708e5c85080f1eb99def0404cb5809f1439e6d13aa9a3c39ae801fb8adf788c8
MD5 585bd7595b93a8274da49c8490d31843
SHA1 1cc9ba2824b49433e179bed99013b10bce992e75
SHA512 68104bdc786b4c6a88562adf4ad3633f63e3c6262650ff61bd7ad2d8a928f7b6e6d1698e617028cee61b33fb5e1648f0fe023007fa30216bb480c067acc588a5
SSDEEP 98304:APAdsBcCqzC8DWq/Ri6pLfmDKQMo0LdqHgW6uToni1Rbw:APAOi/vn/R15fmmPLkHgW62Jbw
TLSH
T1DF36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery kawaiiunicorn trojan

Malware Config

Signatures

Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
trojan kawaiiunicorn

Detects KawaiiUnicorn 64 IoCs

resource	yara_rule
behavioral2/memory/3312-0-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4548-103-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1756-135-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2900-286-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5224-285-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4648-300-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/800-299-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1672-388-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3424-387-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4612-519-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2676-518-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4896-517-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2212-538-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1612-550-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2348-549-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3452-546-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3444-543-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6756-933-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3460-1058-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5152-1057-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1776-1056-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6312-1034-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5724-1133-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7188-1160-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7652-1188-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/8132-1189-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7940-1204-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3312-1226-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7808-1187-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7800-1186-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7612-1185-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6080-1158-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7348-1114-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4452-1113-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7532-1112-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7196-1086-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7224-1085-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7272-1084-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7092-1024-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6356-1005-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5864-1001-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7008-1000-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6992-980-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6960-979-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7000-977-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7028-929-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6732-931-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2736-895-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6268-894-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6260-893-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7100-892-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6524-891-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6568-899-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6364-898-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6500-863-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6560-860-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/700-790-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6300-796-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6576-797-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6156-733-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/432-732-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6224-692-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5328-566-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2908-565-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 32 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c508-6.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c509-11.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c50c-21.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c50d-29.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c50f-38.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c50e-37.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c510-48.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c511-57.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c512-62.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c514-69.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c516-83.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c515-82.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c517-98.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c519-105.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c518-106.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c51a-117.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c51b-124.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c51c-131.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c51d-129.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c51e-144.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c520-154.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c521-155.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c51f-161.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c522-176.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c524-177.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c523-184.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c525-190.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c527-223.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c52c-221.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c533-229.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c528-246.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c52d-240.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Executes dropped EXE 12 IoCs

pid	Process
996	Unicorn-21195.exe
5516	Unicorn-13192.exe
5944	Unicorn-29206.exe
4744	Unicorn-24781.exe
1780	Unicorn-8999.exe
2532	Unicorn-16421.exe
1752	Unicorn-61712.exe
1324	Unicorn-13955.exe
4852	Unicorn-59627.exe
4332	Unicorn-37282.exe
5812	Unicorn-3540.exe
3580	Unicorn-50695.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
11684	9544	WerFault.exe	374

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16421.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50695.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_585bd7595b93a8274da49c8490d31843_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29206.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24781.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8999.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61712.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13955.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59627.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37282.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21195.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13192.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3312	2026-08-05_585bd7595b93a8274da49c8490d31843_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe
996	Unicorn-21195.exe
5516	Unicorn-13192.exe
5944	Unicorn-29206.exe
4744	Unicorn-24781.exe
1780	Unicorn-8999.exe
2532	Unicorn-16421.exe
1752	Unicorn-61712.exe
1324	Unicorn-13955.exe
4852	Unicorn-59627.exe
4332	Unicorn-37282.exe
5812	Unicorn-3540.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 996	3312	2026-08-05_585bd7595b93a8274da49c8490d31843_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe	89
PID 996 wrote to memory of 5516	996	Unicorn-21195.exe	90
PID 3312 wrote to memory of 5944	3312	2026-08-05_585bd7595b93a8274da49c8490d31843_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe	91
PID 5516 wrote to memory of 4744	5516	Unicorn-13192.exe	92
PID 996 wrote to memory of 1780	996	Unicorn-21195.exe	93
PID 5944 wrote to memory of 2532	5944	Unicorn-29206.exe	94
PID 3312 wrote to memory of 1752	3312	2026-08-05_585bd7595b93a8274da49c8490d31843_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe	95
PID 4744 wrote to memory of 1324	4744	Unicorn-24781.exe	96
PID 5516 wrote to memory of 4852	5516	Unicorn-13192.exe	97
PID 1780 wrote to memory of 4332	1780	Unicorn-8999.exe	98
PID 996 wrote to memory of 3580	996	Unicorn-21195.exe	99
PID 2532 wrote to memory of 5812	2532	Unicorn-16421.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-08-05_585bd7595b93a8274da49c8490d31843_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_585bd7595b93a8274da49c8490d31843_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21195.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21195.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13192.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13192.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24781.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13955.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36104.exe
        6⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11498.exe
        7⤵
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1597.exe
        8⤵
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37280.exe
        9⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2841.exe
        10⤵
        
        PID:12652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46408.exe
        9⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49303.exe
        9⤵
        
        PID:52
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18483.exe
        8⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42703.exe
        9⤵
        
        PID:7960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19619.exe
        10⤵
        
        PID:12008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62842.exe
        9⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46516.exe
        9⤵
        
        PID:13856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1762.exe
        8⤵
        
        PID:7620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29735.exe
        8⤵
        
        PID:9508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24969.exe
        8⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31491.exe
        8⤵
        
        PID:10352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24902.exe
        7⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7212.exe
        8⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4711.exe
        9⤵
        
        PID:10076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38891.exe
        9⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46351.exe
        8⤵
        
        PID:8432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61389.exe
        8⤵
        
        PID:12236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18980.exe
        7⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4654.exe
        8⤵
        
        PID:8788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55023.exe
        9⤵
        
        PID:11100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45023.exe
        8⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9708.exe
        7⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63262.exe
        8⤵
        
        PID:9532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57878.exe
        7⤵
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40811.exe
        7⤵
        
        PID:260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62323.exe
        6⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
        7⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5676.exe
        8⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1831.exe
        9⤵
        
        PID:8504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11089.exe
        9⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63180.exe
        8⤵
        
        PID:7856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
        8⤵
        
        PID:10720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48032.exe
        7⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19445.exe
        8⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5379.exe
        7⤵
        
        PID:9856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4771.exe
        7⤵
        
        PID:1888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55166.exe
        6⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56522.exe
        7⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17949.exe
        7⤵
        
        PID:9932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3208.exe
        7⤵
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30684.exe
        6⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12085.exe
        7⤵
        
        PID:9848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55752.exe
        7⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65217.exe
        7⤵
        
        PID:14320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-633.exe
        6⤵
        
        PID:9896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45107.exe
        6⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8593.exe
        6⤵
        
        PID:7236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9139.exe
        5⤵
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63714.exe
        6⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44384.exe
        7⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-222.exe
        8⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10672.exe
        9⤵
        
        PID:12904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63455.exe
        8⤵
        
        PID:8636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55057.exe
        9⤵
        
        PID:9676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48358.exe
        9⤵
        
        PID:13944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11503.exe
        8⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10781.exe
        8⤵
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48608.exe
        7⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41924.exe
        8⤵
        
        PID:10832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55727.exe
        7⤵
        
        PID:10244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28602.exe
        6⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13268.exe
        7⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50420.exe
        8⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24861.exe
        7⤵
        
        PID:8764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29640.exe
        8⤵
        
        PID:12868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47585.exe
        8⤵
        
        PID:14564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33677.exe
        7⤵
        
        PID:9604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41347.exe
        6⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5261.exe
        7⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18878.exe
        8⤵
        
        PID:9460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18084.exe
        7⤵
        
        PID:10640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-157.exe
        7⤵
        
        PID:13012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43891.exe
        6⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58489.exe
        7⤵
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31923.exe
        8⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17823.exe
        8⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        7⤵
        
        PID:2792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8464.exe
        6⤵
        
        PID:3372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21288.exe
        6⤵
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61878.exe
        6⤵
        
        PID:13612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11590.exe
        5⤵
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16289.exe
        6⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16751.exe
        7⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55645.exe
        7⤵
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41985.exe
        8⤵
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37091.exe
        8⤵
        
        PID:7928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24697.exe
        7⤵
        
        PID:4248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12152.exe
        6⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55692.exe
        7⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9544 -s 516
        8⤵
        Program crash
        
        PID:11684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19872.exe
        7⤵
        
        PID:6172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20838.exe
        6⤵
        
        PID:9412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62659.exe
        6⤵
        
        PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36527.exe
        5⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16621.exe
        6⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59818.exe
        7⤵
        
        PID:11008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55069.exe
        6⤵
        
        PID:9040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28005.exe
        6⤵
        
        PID:11096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28302.exe
        5⤵
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29735.exe
        6⤵
        
        PID:9016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24026.exe
        6⤵
        
        PID:3756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22067.exe
        6⤵
        
        PID:10876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19261.exe
        5⤵
        
        PID:8728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50074.exe
        5⤵
        
        PID:11284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25687.exe
        5⤵
        
        PID:13756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59627.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33281.exe
        5⤵
        
        PID:3584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17721.exe
        6⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27939.exe
        7⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36294.exe
        8⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58811.exe
        9⤵
        
        PID:10060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50708.exe
        9⤵
        
        PID:11160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31558.exe
        9⤵
        
        PID:9448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41991.exe
        8⤵
        
        PID:10572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32354.exe
        7⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55801.exe
        8⤵
        
        PID:8412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6206.exe
        9⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19449.exe
        8⤵
        
        PID:11888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42005.exe
        8⤵
        
        PID:13696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3459.exe
        7⤵
        
        PID:8808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5993.exe
        7⤵
        
        PID:11820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12349.exe
        6⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32376.exe
        7⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32475.exe
        8⤵
        
        PID:8748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49107.exe
        8⤵
        
        PID:3776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30206.exe
        7⤵
        
        PID:8516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35707.exe
        7⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11850.exe
        7⤵
        
        PID:14600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14294.exe
        6⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4654.exe
        7⤵
        
        PID:8616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58970.exe
        8⤵
        
        PID:7500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46324.exe
        8⤵
        
        PID:14080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38608.exe
        7⤵
        
        PID:10388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40998.exe
        7⤵
        
        PID:12980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59101.exe
        6⤵
        
        PID:9008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64702.exe
        6⤵
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61747.exe
        5⤵
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12370.exe
        6⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47498.exe
        7⤵
        
        PID:9568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44478.exe
        7⤵
        
        PID:1076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8395.exe
        6⤵
        
        PID:1504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23869.exe
        6⤵
        
        PID:5964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50096.exe
        5⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10995.exe
        6⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8987.exe
        7⤵
        
        PID:8256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42858.exe
        7⤵
        
        PID:11712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44644.exe
        6⤵
        
        PID:7748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5232.exe
        6⤵
        
        PID:11788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49817.exe
        5⤵
        
        PID:6460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32174.exe
        6⤵
        
        PID:9024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58264.exe
        7⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16709.exe
        6⤵
        
        PID:11748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63983.exe
        6⤵
        
        PID:8428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37114.exe
        5⤵
        
        PID:9440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42418.exe
      4⤵
      PID:1756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16652.exe
        5⤵
        
        PID:2680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54690.exe
        6⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42433.exe
        7⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1644.exe
        8⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45443.exe
        9⤵
        
        PID:9704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51668.exe
        9⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40220.exe
        9⤵
        
        PID:1028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60435.exe
        8⤵
        
        PID:10168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20673.exe
        7⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51816.exe
        8⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6464.exe
        7⤵
        
        PID:10952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11083.exe
        6⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20690.exe
        7⤵
        
        PID:9268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4356.exe
        7⤵
        
        PID:7148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25332.exe
        6⤵
        
        PID:9316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25703.exe
        6⤵
        
        PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29562.exe
        5⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31224.exe
        6⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38303.exe
        7⤵
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6225.exe
        7⤵
        
        PID:13928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9781.exe
        6⤵
        
        PID:9916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10172.exe
        6⤵
        
        PID:3164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26546.exe
        5⤵
        
        PID:2584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51940.exe
        5⤵
        
        PID:9908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61643.exe
        5⤵
        
        PID:12812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44122.exe
        5⤵
        
        PID:14160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37876.exe
      4⤵
      PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5105.exe
        5⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        6⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25464.exe
        7⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22551.exe
        8⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45343.exe
        8⤵
        
        PID:14584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10134.exe
        7⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32707.exe
        6⤵
        
        PID:7580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-325.exe
        6⤵
        
        PID:9236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26936.exe
        6⤵
        
        PID:12876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62604.exe
        6⤵
        
        PID:15144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34087.exe
        5⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63424.exe
        6⤵
        
        PID:7880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22823.exe
        7⤵
        
        PID:9976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58025.exe
        7⤵
        
        PID:11808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13131.exe
        7⤵
        
        PID:14068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60871.exe
        6⤵
        
        PID:9496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13412.exe
        5⤵
        
        PID:7940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17808.exe
        6⤵
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52743.exe
        6⤵
        
        PID:14180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12329.exe
        5⤵
        
        PID:10608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11664.exe
        5⤵
        
        PID:12860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22384.exe
        5⤵
        
        PID:14208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37098.exe
      4⤵
      PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6060.exe
        5⤵
        
        PID:6952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55967.exe
        6⤵
        
        PID:8212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17835.exe
        6⤵
        
        PID:4948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57132.exe
        6⤵
        
        PID:13956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4965.exe
        5⤵
        
        PID:9872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9230.exe
        5⤵
        
        PID:12116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23656.exe
      4⤵
      PID:6568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4986.exe
        5⤵
        
        PID:9884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35274.exe
        5⤵
        
        PID:3184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44552.exe
      4⤵
      PID:9328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52868.exe
        5⤵
        
        PID:14192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59827.exe
      4⤵
      PID:5016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8999.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8999.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37282.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-450.exe
        5⤵
        
        PID:3288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25588.exe
        6⤵
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37211.exe
        7⤵
        
        PID:1224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37327.exe
        8⤵
        
        PID:8604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30632.exe
        8⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56002.exe
        7⤵
        
        PID:8420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55962.exe
        7⤵
        
        PID:12036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4285.exe
        7⤵
        
        PID:13732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53657.exe
        6⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32376.exe
        7⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
        8⤵
        
        PID:9716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42858.exe
        8⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50827.exe
        8⤵
        
        PID:13788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47944.exe
        7⤵
        
        PID:9404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26635.exe
        7⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56692.exe
        7⤵
        
        PID:13648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40335.exe
        6⤵
        
        PID:3460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50954.exe
        6⤵
        
        PID:9952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5234.exe
        6⤵
        
        PID:1976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51332.exe
        5⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50279.exe
        6⤵
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35417.exe
        7⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37810.exe
        8⤵
        
        PID:11828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54907.exe
        8⤵
        
        PID:7968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46408.exe
        7⤵
        
        PID:9112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36885.exe
        7⤵
        
        PID:1768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20704.exe
        6⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5095.exe
        7⤵
        
        PID:10020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10635.exe
        7⤵
        
        PID:7684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41995.exe
        7⤵
        
        PID:9628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30952.exe
        6⤵
        
        PID:8688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38421.exe
        7⤵
        
        PID:7680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55726.exe
        6⤵
        
        PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39153.exe
        5⤵
        
        PID:432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48603.exe
        6⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32465.exe
        7⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2286.exe
        7⤵
        
        PID:13688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26884.exe
        6⤵
        
        PID:11188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28764.exe
        5⤵
        
        PID:7280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54862.exe
        6⤵
        
        PID:10272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57034.exe
        6⤵
        
        PID:12696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36495.exe
        5⤵
        
        PID:9296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3549.exe
        5⤵
        
        PID:12896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
      4⤵
      PID:2748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14212.exe
        5⤵
        
        PID:5620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32215.exe
        6⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30107.exe
        7⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3258.exe
        8⤵
        
        PID:9048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38608.exe
        8⤵
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55649.exe
        7⤵
        
        PID:9724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35389.exe
        7⤵
        
        PID:9820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
        7⤵
        
        PID:13952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-559.exe
        6⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46703.exe
        6⤵
        
        PID:10828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59412.exe
        5⤵
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14612.exe
        6⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6917.exe
        7⤵
        
        PID:12056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59729.exe
        6⤵
        
        PID:7644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37692.exe
        6⤵
        
        PID:9340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48939.exe
        5⤵
        
        PID:6768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12625.exe
        6⤵
        
        PID:8200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6442.exe
        6⤵
        
        PID:1276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46548.exe
        5⤵
        
        PID:9364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20353.exe
        5⤵
        
        PID:10972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57283.exe
      4⤵
      PID:800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7710.exe
        5⤵
        
        PID:560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56688.exe
        6⤵
        
        PID:6328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39438.exe
        6⤵
        
        PID:9940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40624.exe
        6⤵
        
        PID:6780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1820.exe
        5⤵
        
        PID:6312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16606.exe
        6⤵
        
        PID:9208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31701.exe
        6⤵
        
        PID:11060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44274.exe
        5⤵
        
        PID:9576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49438.exe
      4⤵
      PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40461.exe
        5⤵
        
        PID:6940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23154.exe
        5⤵
        
        PID:9224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20814.exe
      4⤵
      PID:6480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2703.exe
        5⤵
        
        PID:9696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59779.exe
        5⤵
        
        PID:292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-149.exe
      4⤵
      PID:10632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63725.exe
      4⤵
      PID:12972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50695.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50695.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14840.exe
      4⤵
      PID:1564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32879.exe
        5⤵
        
        PID:4816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64778.exe
        6⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57783.exe
        7⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13396.exe
        8⤵
        
        PID:11436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35472.exe
        8⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52760.exe
        7⤵
        
        PID:8456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52344.exe
        7⤵
        
        PID:10936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17964.exe
        6⤵
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47758.exe
        7⤵
        
        PID:11648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35769.exe
        6⤵
        
        PID:10028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
        6⤵
        
        PID:2084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59386.exe
        5⤵
        
        PID:1540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63377.exe
        6⤵
        
        PID:6888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-82.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-82.exe
        6⤵
        
        PID:10468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34579.exe
        5⤵
        
        PID:7272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37820.exe
        6⤵
        
        PID:8524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65251.exe
        6⤵
        
        PID:2812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6719.exe
        5⤵
        
        PID:8704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49544.exe
        5⤵
        
        PID:12284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59608.exe
        5⤵
        
        PID:14200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26334.exe
      4⤵
      PID:3992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64778.exe
        5⤵
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61732.exe
        6⤵
        
        PID:3884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20938.exe
        6⤵
        
        PID:8308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5564.exe
        6⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30050.exe
        6⤵
        
        PID:13396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54887.exe
        5⤵
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32558.exe
        6⤵
        
        PID:8852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31701.exe
        6⤵
        
        PID:11076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60745.exe
        5⤵
        
        PID:8756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19471.exe
        6⤵
        
        PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64623.exe
        5⤵
        
        PID:10248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39188.exe
      4⤵
      PID:3828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54332.exe
        5⤵
        
        PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32967.exe
        5⤵
        
        PID:10760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22100.exe
      4⤵
      PID:7800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43903.exe
      4⤵
      PID:10436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21949.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21949.exe
    3⤵
    PID:1296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13574.exe
      4⤵
      PID:1672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49869.exe
        5⤵
        
        PID:700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60409.exe
        6⤵
        
        PID:7544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32967.exe
        6⤵
        
        PID:10448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5036.exe
        7⤵
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33007.exe
        7⤵
        
        PID:13972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20177.exe
        6⤵
        
        PID:10220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48302.exe
        5⤵
        
        PID:8092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30991.exe
        6⤵
        
        PID:10180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26888.exe
        6⤵
        
        PID:812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26505.exe
        5⤵
        
        PID:9788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53754.exe
        5⤵
        
        PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23652.exe
        5⤵
        
        PID:10672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52562.exe
      4⤵
      PID:6500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40643.exe
        5⤵
        
        PID:8652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2044.exe
        5⤵
        
        PID:12240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29032.exe
      4⤵
      PID:9064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42800.exe
        5⤵
        
        PID:13004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58209.exe
      4⤵
      PID:12252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
    3⤵
    PID:200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9376.exe
      4⤵
      PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8295.exe
        5⤵
        
        PID:11816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46050.exe
      4⤵
      PID:8644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22569.exe
        5⤵
        
        PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34938.exe
      4⤵
      PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-252.exe
      4⤵
      PID:13900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19681.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19681.exe
    3⤵
    PID:6224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55147.exe
      4⤵
      PID:7632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22823.exe
        5⤵
        
        PID:9960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25025.exe
        5⤵
        
        PID:4988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50827.exe
        5⤵
        
        PID:10524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55749.exe
      4⤵
      PID:8568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22341.exe
      4⤵
      PID:6592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58781.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58781.exe
    3⤵
    PID:2548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54.exe
      4⤵
      PID:2160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37676.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37676.exe
    3⤵
    PID:10984
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29206.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29206.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16421.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16421.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3540.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46828.exe
        5⤵
        
        PID:2316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47077.exe
        6⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12370.exe
        7⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39750.exe
        8⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27182.exe
        9⤵
        
        PID:8532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17316.exe
        8⤵
        
        PID:10200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65214.exe
        7⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27523.exe
        8⤵
        
        PID:13892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61695.exe
        7⤵
        
        PID:10320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11097.exe
        7⤵
        
        PID:12704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21285.exe
        6⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61649.exe
        7⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42427.exe
        7⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26508.exe
        7⤵
        
        PID:6436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48010.exe
        6⤵
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32354.exe
        7⤵
        
        PID:3900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62028.exe
        6⤵
        
        PID:10044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9152.exe
        6⤵
        
        PID:2360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59007.exe
        5⤵
        
        PID:2604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62448.exe
        6⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33829.exe
        7⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57636.exe
        8⤵
        
        PID:11144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38923.exe
        8⤵
        
        PID:15072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12770.exe
        7⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38761.exe
        7⤵
        
        PID:7888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3548.exe
        6⤵
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26414.exe
        6⤵
        
        PID:11292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7916.exe
        6⤵
        
        PID:13920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7584.exe
        5⤵
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44042.exe
        6⤵
        
        PID:8392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47491.exe
        7⤵
        
        PID:13216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34524.exe
        6⤵
        
        PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2505.exe
        5⤵
        
        PID:7852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41318.exe
        6⤵
        
        PID:11948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58677.exe
        5⤵
        
        PID:10260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51434.exe
        5⤵
        
        PID:12724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37159.exe
      4⤵
      PID:920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24327.exe
        5⤵
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43673.exe
        6⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15053.exe
        7⤵
        
        PID:7612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15998.exe
        7⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55541.exe
        7⤵
        
        PID:13828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2500.exe
        6⤵
        
        PID:7808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26414.exe
        6⤵
        
        PID:11496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52012.exe
        5⤵
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33013.exe
        6⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37159.exe
        7⤵
        
        PID:12168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7289.exe
        6⤵
        
        PID:10252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15638.exe
        5⤵
        
        PID:6364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36850.exe
        6⤵
        
        PID:8
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10449.exe
        6⤵
        
        PID:13352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6091.exe
        5⤵
        
        PID:9376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60016.exe
        5⤵
        
        PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40951.exe
        5⤵
        
        PID:13740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57968.exe
      4⤵
      PID:5844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64285.exe
        5⤵
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58909.exe
        6⤵
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56319.exe
        7⤵
        
        PID:10392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62163.exe
        6⤵
        
        PID:8560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64443.exe
        6⤵
        
        PID:12804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53864.exe
        6⤵
        
        PID:15100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43127.exe
        5⤵
        
        PID:7188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5135.exe
        6⤵
        
        PID:12884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13817.exe
        5⤵
        
        PID:10096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28482.exe
        5⤵
        
        PID:2116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19267.exe
        5⤵
        
        PID:15080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65089.exe
      4⤵
      PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5702.exe
        5⤵
        
        PID:6696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25888.exe
        6⤵
        
        PID:12996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49522.exe
        5⤵
        
        PID:11212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43664.exe
      4⤵
      PID:8840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16371.exe
      4⤵
      PID:3488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20815.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20815.exe
    3⤵
    PID:4548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55546.exe
      4⤵
      PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37010.exe
        5⤵
        
        PID:1204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44633.exe
        6⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52516.exe
        7⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7617.exe
        7⤵
        
        PID:9400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64443.exe
        7⤵
        
        PID:12796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48494.exe
        6⤵
        
        PID:8164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21814.exe
        6⤵
        
        PID:10148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48203.exe
        5⤵
        
        PID:6216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56107.exe
        6⤵
        
        PID:7780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34420.exe
        6⤵
        
        PID:10476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21070.exe
        6⤵
        
        PID:12732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-771.exe
        6⤵
        
        PID:9632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15057.exe
        5⤵
        
        PID:8132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47628.exe
        6⤵
        
        PID:9968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58767.exe
        6⤵
        
        PID:6488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2905.exe
        5⤵
        
        PID:10052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61643.exe
        5⤵
        
        PID:6608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23257.exe
      4⤵
      PID:5816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24514.exe
        5⤵
        
        PID:2908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28375.exe
        6⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49911.exe
        7⤵
        
        PID:10084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31247.exe
        7⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53048.exe
        7⤵
        
        PID:14120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46875.exe
        6⤵
        
        PID:9424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32437.exe
        7⤵
        
        PID:13032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27053.exe
        6⤵
        
        PID:12032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21529.exe
        5⤵
        
        PID:7348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17286.exe
        6⤵
        
        PID:10212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12900.exe
        6⤵
        
        PID:11916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26505.exe
        5⤵
        
        PID:9796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23957.exe
        5⤵
        
        PID:7064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42888.exe
      4⤵
      PID:4680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25464.exe
        5⤵
        
        PID:7144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        6⤵
        
        PID:6004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16178.exe
        6⤵
        
        PID:11012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14877.exe
        5⤵
        
        PID:11108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64067.exe
      4⤵
      PID:8144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60912.exe
      4⤵
      PID:1492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10521.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10521.exe
    3⤵
    PID:5744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54690.exe
      4⤵
      PID:1424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36486.exe
        5⤵
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52760.exe
        6⤵
        
        PID:8408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12599.exe
        6⤵
        
        PID:2032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49810.exe
        6⤵
        
        PID:13908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47944.exe
        5⤵
        
        PID:8992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52627.exe
        5⤵
        
        PID:1272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41617.exe
        5⤵
        
        PID:13560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62012.exe
      4⤵
      PID:6408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50133.exe
      4⤵
      PID:10036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13671.exe
        5⤵
        
        PID:12308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40101.exe
        5⤵
        
        PID:13848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50757.exe
      4⤵
      PID:1236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
    3⤵
    PID:3452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24701.exe
      4⤵
      PID:6868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55651.exe
        5⤵
        
        PID:10604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42550.exe
        5⤵
        
        PID:13764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24824.exe
      4⤵
      PID:11908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18868.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18868.exe
    3⤵
    PID:6152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58489.exe
      4⤵
      PID:8316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29149.exe
        5⤵
        
        PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10449.exe
        5⤵
        
        PID:7180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2018.exe
      4⤵
      PID:5324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15234.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15234.exe
    3⤵
    PID:8668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56488.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56488.exe
    3⤵
    PID:11268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27031.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27031.exe
    3⤵
    PID:13680
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61712.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61712.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48932.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48932.exe
    3⤵
    PID:2564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38743.exe
      4⤵
      PID:4748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17659.exe
        5⤵
        
        PID:1436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13330.exe
        6⤵
        
        PID:720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61130.exe
        7⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47960.exe
        7⤵
        
        PID:9288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5232.exe
        7⤵
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38934.exe
        6⤵
        
        PID:7336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47190.exe
        7⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30568.exe
        7⤵
        
        PID:7648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9069.exe
        6⤵
        
        PID:10752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47356.exe
        6⤵
        
        PID:13232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60948.exe
        5⤵
        
        PID:4308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57934.exe
        6⤵
        
        PID:9152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35523.exe
        6⤵
        
        PID:8188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1793.exe
        5⤵
        
        PID:5596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39982.exe
        6⤵
        
        PID:12632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52568.exe
        5⤵
        
        PID:10144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2432.exe
        5⤵
        
        PID:12712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23257.exe
      4⤵
      PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61161.exe
        5⤵
        
        PID:940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13393.exe
        6⤵
        
        PID:8592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48845.exe
        6⤵
        
        PID:7816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28945.exe
        5⤵
        
        PID:8816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26610.exe
        6⤵
        
        PID:14932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24824.exe
        5⤵
        
        PID:5132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31403.exe
      4⤵
      PID:2736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49963.exe
        5⤵
        
        PID:8496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60293.exe
        6⤵
        
        PID:11804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23149.exe
        5⤵
        
        PID:4872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9324.exe
      4⤵
      PID:8800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
      4⤵
      PID:3988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9038.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9038.exe
    3⤵
    PID:2900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51867.exe
      4⤵
      PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49314.exe
        5⤵
        
        PID:7028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41411.exe
        6⤵
        
        PID:9032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26765.exe
        7⤵
        
        PID:13020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32473.exe
        6⤵
        
        PID:2128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36495.exe
        6⤵
        
        PID:13400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50492.exe
        5⤵
        
        PID:9536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44637.exe
        6⤵
        
        PID:2856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22037.exe
        6⤵
        
        PID:10164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56594.exe
        5⤵
        
        PID:12064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58670.exe
      4⤵
      PID:7264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26505.exe
      4⤵
      PID:9780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27649.exe
      4⤵
      PID:5960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42080.exe
      4⤵
      PID:14136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14517.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14517.exe
    3⤵
    PID:4612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33772.exe
      4⤵
      PID:6756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16518.exe
        5⤵
        
        PID:7672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18118.exe
        5⤵
        
        PID:5660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17217.exe
      4⤵
      PID:10124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30592.exe
      4⤵
      PID:7472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62178.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62178.exe
    3⤵
    PID:6992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15057.exe
      4⤵
      PID:10596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15231.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15231.exe
    3⤵
    PID:10340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45533.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45533.exe
    3⤵
    PID:13208
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48667.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48667.exe
  2⤵
  PID:2988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52941.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52941.exe
    3⤵
    PID:4224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11882.exe
      4⤵
      PID:4192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13330.exe
        5⤵
        
        PID:3744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42189.exe
        6⤵
        
        PID:6404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38976.exe
        6⤵
        
        PID:11240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61319.exe
        6⤵
        
        PID:7424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18949.exe
        6⤵
        
        PID:9004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13963.exe
        5⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2999.exe
        6⤵
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50143.exe
        6⤵
        
        PID:13748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13817.exe
        5⤵
        
        PID:10236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20313.exe
        5⤵
        
        PID:7220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54809.exe
      4⤵
      PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20207.exe
        5⤵
        
        PID:7200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44945.exe
        5⤵
        
        PID:10300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24958.exe
      4⤵
      PID:7404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1805.exe
      4⤵
      PID:10440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18270.exe
      4⤵
      PID:13200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63138.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63138.exe
    3⤵
    PID:3424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2038.exe
      4⤵
      PID:5068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55287.exe
      4⤵
      PID:8596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62842.exe
      4⤵
      PID:6032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30455.exe
      4⤵
      PID:7820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61938.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61938.exe
    3⤵
    PID:1072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54763.exe
      4⤵
      PID:7532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6543.exe
      4⤵
      PID:11200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11410.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11410.exe
    3⤵
    PID:7588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14031.exe
      4⤵
      PID:9664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8606.exe
      4⤵
      PID:10332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31558.exe
      4⤵
      PID:15304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54795.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54795.exe
    3⤵
    PID:9748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5035.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5035.exe
    3⤵
    PID:10968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21914.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21914.exe
    3⤵
    PID:15116
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43601.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43601.exe
  2⤵
  PID:5828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53595.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53595.exe
    3⤵
    PID:5700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11607.exe
      4⤵
      PID:7564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53303.exe
        5⤵
        
        PID:2248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42929.exe
        5⤵
        
        PID:14244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34834.exe
      4⤵
      PID:10280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42842.exe
        5⤵
        
        PID:14332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3495.exe
      4⤵
      PID:13224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15141.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15141.exe
    3⤵
    PID:6924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7595.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7595.exe
    3⤵
    PID:8944
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16069.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16069.exe
  2⤵
  PID:3796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11545.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11545.exe
    3⤵
    PID:7300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-953.exe
      4⤵
      PID:14152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5749.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5749.exe
    3⤵
    PID:10624
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28081.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28081.exe
  2⤵
  PID:7524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48544.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48544.exe
    3⤵
    PID:4632
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34879.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34879.exe
  2⤵
  PID:11180
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36859.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36859.exe
  2⤵
  PID:12988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-11498.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-11498.exe
Size 4.9MB
SHA256 607995d1441a03a3312c2a77fd0e6f8832b7417d6f5895c10da427501b0a686b
MD5 cb3932b78431c89dbfdd0114e21893f7
SHA1 3f840cd12e723b1fcc427fa4e934e975c2752c66
SHA512 9e062a1a90c142c2cdc31dadc80d96d5e9b8d8437217cc0c443c420f15a9e434e62b87486ce00f95a4f409cafeebbe56bcd5f8e4a2105c12b70ee49f47281eac
SSDEEP 98304:APRdsBcCqzC7DWq/ui6pLfmDKQMU0LlqHgW6uToni1Rbw:APROi/Sn/u15fmmbLsHgW62Jbw
TLSH
T15136E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-13192.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-13192.exe
Size 4.9MB
SHA256 1dfb9544d7681e2e61d4d001341822a4fb905e6ca9420c96a41a4fc841ce0d39
MD5 1fe15c54f3a7e378cce1e7e74b25793a
SHA1 e160ff45d1f3452dea96fb8f8ce7019add9683b1
SHA512 e67bf6843e0d0370e785106352855fefc8a2c81304557671b3c5d7db819791a8b5138d1fa94663b7e315aa0d275b2174b5fe42b2f23f9696912ca7676a4846f9
SSDEEP 98304:AP7dsBcCqzC7DWq/Ri6pLfmDKQMo0LdqHgW6uToni1Rbw:AP7Oi/Sn/R15fmmPLkHgW62Jbw
TLSH
T13936E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-13955.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-13955.exe
Size 4.9MB
SHA256 8843254ecccc1332eb4a218f43bf8aa15dac6aa91190a334af7f2d3a03494203
MD5 1e66c8e72aba9ed82477f827f918a1f8
SHA1 c0372de98edaaf52a77a739c58cd00ac411d4563
SHA512 6a648cdce1c0525c19f9d37db52844de39362cbae779ecf6cb5629d72625e0b7394f049832e9f1a2934a625b43bfd4d47efe56bb72c0d969d174ba579b5f1423
SSDEEP 98304:APRdsBcCqzC7DWq/ui6pLfmDKQMo0LdqHgW6uToni1Rbw:APROi/Sn/u15fmmPLkHgW62Jbw
TLSH
T14136E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-14840.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-14840.exe
Size 4.9MB
SHA256 dfa4cf802eda703f80aede1132dabe8b2386cfe99bad268ed1b60523ebb426da
MD5 74f30ca50496355bc8d668936d553660
SHA1 e82f6d3d1cb56e2dfb31a80066938456d0e4e95f
SHA512 43ecff7a738d2404b40c8ac4724c2e866c344a92a44fed398f03bc60ab554ebd6136e304f589225dd297cb6ba09f9e8284c049697faf57608f5ea6a70fcb36b3
SSDEEP 98304:APAXsBcCqzC7DWq/Ri6pLfmDKQMo0LNqHgW6uToni1Rbw:APA8i/Sn/R15fmmPLUHgW62Jbw
TLSH
T11936E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-16421.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-16421.exe
Size 4.9MB
SHA256 9b888c9e1efb08d5bb22dcfa73d4b8787b8d2c8da507f5853e0c8a799b186160
MD5 2478396033985cb4b7527983957e8515
SHA1 78f24e2fa814d297ef6d49460c2900711985ed3b
SHA512 7903c4fa581efe5b0d4b699b1ecf1cb8ca84d8c136a883d01fb61d9c936a984723ff20fc7c722ac7076df4d7bd15926b04da711f79e5dc839b97dec2d567593f
SSDEEP 98304:APAds4cCqzC8DWq/Ri6pLfmDKQMo0LdqHgW6uTonf1Rbw:APAOH/vn/R15fmmPLkHgW62ybw
TLSH
T14F36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-20815.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-20815.exe
Size 4.9MB
SHA256 56c6af437f03038f87fe3fa91f5cd3d751a56d39511ad71944b2d2b8c3ee05ad
MD5 671fe114d3c2489e3ca2bff5314607ce
SHA1 c6200b185972e34c9c50139bdfa890c0ea3078eb
SHA512 1712f68a5bf7037696fc46a98dcb55b018b4cc28d220408264eb4dc1a204b2eb0d11632cafc6562faa333accbb8fee1f222140aa4967e5c9e714badc86b0772f
SSDEEP 98304:APAdsBcCqzC8DWq/Ri6pLfmDKQMo0LdqHCW6uTonf1Rbw:APAOi/vn/R15fmmPLkHCW62ybw
TLSH
T13E36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-21195.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-21195.exe
Size 4.9MB
SHA256 04152fbda01510cb610becef41d71e2d7d96e905717f4f89b456b1ca0897b545
MD5 b5c76589393f8176389c51722b459eba
SHA1 d6922dba54fb27cc28612b750a96654b16d0c8f1
SHA512 79c55650b5a9713aecd7387d27034d51750307437f0b64af6b411428d68f3927317e954a5fca7b33f5a4eba2b1ca42a9c0b4ba4fbbb4958d23c7743ef1dd0cea
SSDEEP 98304:APAdsBcCqzC7DWq/Ri6pLfmDKQMo0LdqHgW6uToni1Rbw:APAOi/Sn/R15fmmPLkHgW62Jbw
TLSH
T1ED36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-21949.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-21949.exe
Size 4.9MB
SHA256 23db18b13a1a4ff3c650640d333ff6ac1f3918ad7e44628fd0593bf5bbd9b699
MD5 b707bf9546ec0d2b0526ae7304a85ac5
SHA1 2ecfc720043a674865bf8d77dbe600a6de423ecb
SHA512 3d51d4e4d2e3d708de3e9b3a8ef4939da9abb7531e2dfc20c6d3baa58b97717524a82c23644a151ae95f0b6f073a80b6f16ea468f9be9ea7dd1924bcb49c8586
SSDEEP 98304:APAdsBcCqzC7DWq/Ri6pLfmDKQMo03dqHgW6uToni1Rbw:APAOi/Sn/R15fmmP3kHgW62Jbw
TLSH
T12D36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-24781.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-24781.exe
Size 4.9MB
SHA256 36e00532a99bbb16734e0f0275fb9180a38281d4c7583cde329d5dfc33b2ff13
MD5 9f77624aa3d7db079533e54042512de5
SHA1 e8f8b17c8f6970590796f7c7f82a179f2813d999
SHA512 c0da8201b17a0d3284041d3934fbd4795466f2234328499ba9eee38f3d74ef1dfc0e9788468dfaf5cefc554fb861beb0e2a1aa14e3ec502d09fc28ae9546700b
SSDEEP 98304:AP7dsBcCqzC7DWq/ui6pLfmDKQMo0LdqHgW6uToni1Rbw:AP7Oi/Sn/u15fmmPLkHgW62Jbw
TLSH
T15B36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-29206.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-29206.exe
Size 4.9MB
SHA256 f9d13912f594a8c3cee530c17567996107d293eb2b4f5ccf044772d38d605076
MD5 91bb78a496ed64d80648ddd9fee57bdc
SHA1 d7599d92216545a829e9e9f061be26af8fc63499
SHA512 de19810c54b7c97b1dd443180ec0fc5c455673146e3110dd106a2783b7bbe73bb5a8feeae7abbd4439bb7d502f92f9d8d7de640c5dd708e340b96f4ed89c8185
SSDEEP 98304:APAdsBcCqzC8DWq/Ri6pLfmDKQMo0LdqHgW6uTonf1Rbw:APAOi/vn/R15fmmPLkHgW62ybw
TLSH
T19336E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-33281.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-33281.exe
Size 4.9MB
SHA256 57efee8d2957b4b12aade71c8c89506e9ec0793a6c67e856beb409dc8b6dbfc2
MD5 2f245dc3373b667f79ce798ef2f72d4f
SHA1 6bb929d9a69611ac3cc09e4a41c6d34eb4e2acd0
SHA512 33f10653f3e4438351c945e76a71c5fdf6f0ddd971d09799b3f80d0b526c73937735dee1a2a9fb91203eeece9473d4bf4370012d394af7b6311663dc40deea41
SSDEEP 98304:AP7dsBcCqzC7DWq/li6pLfmDKQMo0LdqHgW6uTonx1Rbw:AP7Oi/Sn/l15fmmPLkHgW62Qbw
TLSH
T1CD36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-3540.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-3540.exe
Size 4.9MB
SHA256 0ff93b30ebc1a442e0c8ed20143f0426124bf3445568f68628035b5d1155435c
MD5 9e9ebd879e1d09b68e72fa9d91f8fc8d
SHA1 12b2b2c93b88c271e3b5705150858e9bc8361d45
SHA512 ee9f75430d8f8f6bbc7b885f81cd3cf0d44ebe7056317dad479d6a65c6a42b96d1956526b70e1a59c33444ed3c816ab5d44dfd3d647abc7e086c362d54e28b4f
SSDEEP 98304:APAds4cCqzC8DWq/Ri6pLfmDKQMo0LdqHgW6uTonf1Rbw:APAOH/vn/R15fmmPLkHgW62ybw
TLSH
T1E836E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-36104.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-36104.exe
Size 4.9MB
SHA256 92f1824bc28ac7888a94e308a76260196c91b36250016411b1e8ea462c7cecdd
MD5 4aada6807a4a7bc06402c831585070f5
SHA1 2e2f2ec136c20c7811f49c54a052c313b142d303
SHA512 970b513ff008858c8d967953f17a73f12acf6f9fe4973fdeeab156b03504da932a18782c6d854996b7d16d421e32a715be9eae8336032a960c693473d8845d06
SSDEEP 98304:APRdsBcCqzC7DWq/ui6pLfmDKQMU0LdqHgW6uToni1Rbw:APROi/Sn/u15fmmbLkHgW62Jbw
TLSH
T19F36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-37159.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-37159.exe
Size 4.9MB
SHA256 541f83a3bd2f3ad22c29cc6dfd2702a54b0db9d0121a57397b6f537fffea51ab
MD5 b872031d8c15f7cc2378205cc9fe123d
SHA1 e878f776a1b56d4c4c91de92efff7082c2ded5b4
SHA512 70fe848db6778f677be94eda56996998637450216a44437caf7da32ccf8372e4e60e2f1dbcfaa558980ec3d43b7e16e04f71d18e5c156986de96c85b583f4eb8
SSDEEP 98304:APAds4cCqzC8DWq/Ri6pLfmDKQMo0LdqHgW6uTonf1Rbw:APAOH/vn/R15fmmPLkHgW62ybw
TLSH
T12D36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-37282.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-37282.exe
Size 4.9MB
SHA256 7c29add4e2266037cb01e2f8ee2c7fd6f73e5d593e478d2721913f2981f1fb12
MD5 f6791798d36c785dce6da7c9f3df0988
SHA1 929f86ae48bd5723fd40704dc3051b84f90829c4
SHA512 ecfc1cf02071cbb80a82062e6652b8012a8bf2755d279a3be61d95c8f568c402996b17584a9d0ba02969ee9de3b82a8a841f95b4939f9c032c5ffe1525edf6e2
SSDEEP 98304:APAdsBcCqzC7DWq/Ri6pLfmDKQMd0ZdqHgW6uToni1Rbw:APAOi/Sn/R15fmmqZkHgW62Jbw
TLSH
T1C036E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-37876.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-37876.exe
Size 4.9MB
SHA256 70f805045a69542b4320a7108449e3bc55b2b362be2a151dd06ce6142cd94f1e
MD5 40a7a766a1dfb032a52eb6c3016ef13f
SHA1 9643a29edf6338816acb947967365572f7ed0ab8
SHA512 0377ff133a75ccc5066d2e459f228090d3f3c7f64aedcb355260210a568ca106ba641c4376dfca13f2f13888e8d055771a03caa12044b3ea1ec2dcd4fb95ac36
SSDEEP 98304:AP7dsBcCqzC7DWq/Ri6pLfmDKQMo0LdqHgWruToni1Rbw:AP7Oi/Sn/R15fmmPLkHgWr2Jbw
TLSH
T1F736E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-38743.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-38743.exe
Size 4.9MB
SHA256 78e98c6e1523ccee23dd1cc6cbe25f861543b373a61b13cad532b3c1ed76cd87
MD5 819fc0c74a7182dc83bb3cd6213c807d
SHA1 4d180ac3ce558dbd20080d66a143b5b93be46d07
SHA512 5bf95848d2e4570a14a92fa9e48b1a686fdf6777a19f8d497b9f111cc6ee3a07cc33333532c807ef9c45b469f2a0a7a50c64c3b9eb48e72b0116839a63b6702a
SSDEEP 98304:APAdsBcCqzC8DWq/Ri6pLfmDKQMW0LjqHgWduToni1Rbw:APAOi/vn/R15fmmFLOHgWd2Jbw
TLSH
T13636E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-42418.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42418.exe
Size 4.9MB
SHA256 883314b0cee77b384fd32d12385057692a6c5de3361c461533a837b1f3682409
MD5 90c659399be4748a3e505848b7ed1b13
SHA1 97225e3e19981239468dab8f1dab5712db79a228
SHA512 768c61f4d4672befd4de629fd30c0fcc2060e7204668228a5b18ddf8d6d8b59e6868f8ab5edd3d999535f72631add068d518085cfd80e10f39b41c84c8ab5c0b
SSDEEP 98304:AP7dsBcCqzC7DWq/Ri6pLfmDKQMF0LdqHgW6uToni1Rbw:AP7Oi/Sn/R15fmmCLkHgW62Jbw
TLSH
T1EA36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-450.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-450.exe
Size 4.9MB
SHA256 ab7d1a555ed77bc5d85ce773be719d3badb4dddbaa2cee426c71add6b1e64ceb
MD5 1c300609319d9a255ee15a1dcf8b0e0e
SHA1 abb3e78592fbfd65a24feb87df856dd2b6c53aa6
SHA512 66ab0c6a9b537b1b67024cd91080ec73ed38134cea443993a3dead0a44b28d523c9d36973dec23063bac0e6952bde43142573f5a68c092b631dd75a633ed9872
SSDEEP 98304:APAdsBcCqzC7DWq/Ri6pLfmDKQMd0ZdqHgW6uToni1Rbw:APAOi/Sn/R15fmmqZkHgW62Jbw
TLSH
T16336E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-46122.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
Size 4.9MB
SHA256 8b952ca461723e67fb83740d5062d97aa0d1e3cb3bd157363f96b9c62dd8209d
MD5 04ea30108cf0b6d2164dc7388b98abfe
SHA1 95de796f2647e82b1fa40f4fe4fba7d476c0781b
SHA512 9bba49fa4a76375b1cf59d6979c180dbee56c6d203e1921b5df216a9f5a0e4c180e26c149c57ff1248183ec737effba89dbbf6352b9e9204ced6ac529a008224
SSDEEP 98304:AP1dsBcCqzC7DWq/Ri6pLfmDKQMo0ZdqHgW6uToni1Rbw:AP1Oi/Sn/R15fmmPZkHgW62Jbw
TLSH
T12D36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-46828.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-46828.exe
Size 4.9MB
SHA256 f9fb1783492361bd56aabf289da4c07fd38409d85e9b92b8eced1598a108c7b6
MD5 2ce04479628f5501922d281bfa8dc425
SHA1 dc2b110b33ad57d5a443f07cbf700b9cdcb7a8a1
SHA512 f9104d5c833a16bce5a4477d4043fd7706e66c93e49231ab87254f06571395dbbbf132702bd21cd9446c96f4c3b2c85404c5e9d853ccaa4f2cc0c293fbfc58b6
SSDEEP 98304:APAds4cCqzC8DWq/Ri6pLfmDKQMo0LFqHgW6uTonf1Rbw:APAOH/vn/R15fmmPLMHgW62ybw
TLSH
T1D836E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-48667.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-48667.exe
Size 4.9MB
SHA256 86e351bd60074cfe27b30b090a8f2d3bf3cb09b6f40c45ef0811e80c5d695fd6
MD5 cd2c4b13e382046231093bdcdae36073
SHA1 b13e3921ca22e4af2363140322c0d5d8475063d2
SHA512 614293c74e5bf1e1b28e6deadaee2a8d4b4b61bae3706f05565bf2e32f79768d7a90956ba011ae38487293e011c4c099050cfd6996c632ea9dabe2a6f875d10d
SSDEEP 98304:APAdsBcCqzC8DWq/Ri6pLfmDKQMo0LdqHgW6uToni1RWw:APAOi/vn/R15fmmPLkHgW62JWw
TLSH
T1C236E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-48932.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-48932.exe
Size 4.9MB
SHA256 49d0e02197b21939c5d96e226284890b74cf6bdcc6ebc448d421d4defede47e9
MD5 b224c7d2d24a80f7b8715d852940d75a
SHA1 1c58efe73e6f624cc10762be95c5d2f006f39d18
SHA512 2843e5726f707321229a2a9502e04997cc141a8d835e2166efa5d52bcda8cdec981c4a36b422dde77799d04363fb68553917755da023a0fae026626ed4d3b289
SSDEEP 98304:APAdsBcCqzC8DWq/Ri6pLfmDKQMo0LjqHgWduToni1Rbw:APAOi/vn/R15fmmPLOHgWd2Jbw
TLSH
T1CA36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-50695.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-50695.exe
Size 4.9MB
SHA256 bf4cfb6f7007ec15a728e563c9182e869a5cfe6fba895c0e93536d840d2542be
MD5 31f9b0b1931d86bc2c015c6576323b02
SHA1 9502d3de637328b67db7df53327fc8111560b64a
SHA512 151ab17a720cb82071d3713ff49e96b871614ed2e8f0d8f50c928b070cc4f3e87fb44fe91e8ce7fd429c0da9cca484172d0eee8bd571c1ddc5b22ebb1f5c28ff
SSDEEP 98304:APAdsBcCqzC7DWq/Ri6pLfmDKQMo0LNqHgW6uToni1Rbw:APAOi/Sn/R15fmmPLUHgW62Jbw
TLSH
T1CF36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-52941.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-52941.exe
Size 4.9MB
SHA256 d206a664efe3ae826ac05e842a925e810a4949b6ecee85741975260a0e629d70
MD5 e99c3d2008f76b98c84580eca479b8b3
SHA1 c506cdfcc30e08b984be2f7f7cbfb5e3f982ed9a
SHA512 fff04636947140fe49e6bd01104aa349c403a58fd39217a445c4760e64c88dc409aef7b7947b3f46e7b9ae4f7d1ff21be9f9b237065cf09481b56bf539b1c8a7
SSDEEP 98304:APAdsBcCqzC8DWq/Ri6pLfmDKQMo0LdqHgg6uToni1RWw:APAOi/vn/R15fmmPLkHgg62JWw
TLSH
T18136E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-55546.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-55546.exe
Size 4.9MB
SHA256 233c3ae7733ff2b44904e8788d7703908f566dc49721eb9b34e460f305f4e252
MD5 96d78c32e0bf52c89584f5db41eb4c57
SHA1 555cd71306d35d6adad7b7279af9e1603c4e04b9
SHA512 5fab489ec46e1898c4f8baccb22660eeeba58679e364ad968573fc99eaa1de5efdb249cd22c6337b4983d6e92504e69534ef233fcb62df4a759254fc81d91aef
SSDEEP 98304:APAdsBcCqzC8DWq/Ri6pLfmDKQMo0LdqHCWyuTonf1Rbw:APAOi/vn/R15fmmPLkHCWy2ybw
TLSH
T13036E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-59627.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-59627.exe
Size 4.9MB
SHA256 128ab97c259b0bdd838be2c9f52271ac56a5bf31f7769cd2517f76664fe0bfe7
MD5 47ccec93e25d05b4dfed13ecc5198896
SHA1 f263007369803e6123a971bc4930ce18141cfbab
SHA512 976d8dc8c673498d2bc2a11bbf5b1dcda500b46382448a9f58c5b219041de0c4c52c54fa38c56a0410647456911760cadbb616760ab070dd787b4a4f4ceb0c2d
SSDEEP 98304:AP7dsBcCqzC7DWq/li6pLfmDKQMo0LdqHgW6uToni1Rbw:AP7Oi/Sn/l15fmmPLkHgW62Jbw
TLSH
T19A36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-61712.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-61712.exe
Size 4.9MB
SHA256 822e0fc86f3c72cde44e438e7e694c97b925407a97c967a6a711394667178e39
MD5 48f09e47541b55d9a098b076663e1978
SHA1 ef83d6a6138f375c434eee4bc266d2abd488d729
SHA512 8aa39f284138c8016f1187ac17f468a537d167c3e8269925fd550b2b0ded3b4f805083381fcbe2ad3a2bd76663cbe62719f465b45073c7d57e8f1e952cd7c08a
SSDEEP 98304:APAdsBcCqzC8DWq/Ri6pLfmDKQMo0LdqHgWduToni1Rbw:APAOi/vn/R15fmmPLkHgWd2Jbw
TLSH
T11E36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-61747.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-61747.exe
Size 4.9MB
SHA256 fcbb89cdc24f74c1ed2d8025d79296fc291dc5989a75d6a290247d0e72bd5cab
MD5 b6c133fd6d197bdc13cd9b7d6bd9cd5f
SHA1 4d6637f33fe1304fb482fd7fbcf6e123f2b285a3
SHA512 6914eb23e547559d58cf135908b7247cf8e1397f92af9ffb9dd63548c838b055154cb533995eba7502bfd3d7155bfdc2f81a72acb59b7e801b57e614c5e0d4ab
SSDEEP 98304:AP7dsBcCqzC7DWq/lZ6pLfmDKQMo0LdqHgW6uToni1Rbw:AP7Oi/Sn/lQ5fmmPLkHgW62Jbw
TLSH
T1FF36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-63714.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-63714.exe
Size 4.9MB
SHA256 37dbc595ec25b528c2cbf7877c07dc42b46342bec2161267503533cdc33990c8
MD5 1d9820b6e89e0e9c301849d7fb66ce36
SHA1 405fcdadff17be9d74098ba631d4f8483b444db5
SHA512 79ac2d8d2afc2f74d7cbcf8218a4090be05125b60d9e892838f06f9ba34f09a0b2f4ff0c6e72541c4ff69ed4174a96d76d0b209c50973de9e01657eddcec398e
SSDEEP 98304:AP7dsBcCqzC7DWq/ui6pLfmDKQMo0adqHgW6uToni1sbw:AP7Oi/Sn/u15fmmPakHgW620bw
TLSH
T1C936E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-8999.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-8999.exe
Size 4.9MB
SHA256 2d2479d96cbea9cf11ba385df087c18f5a25865bfc9690e92a67668fd8a89e42
MD5 57bee75a91ef52617029f1b4cd821141
SHA1 ebda5fb06b3900b40fcef97256957edddccfaea3
SHA512 d10df1a531474347c1fa4d4b7d88530a9616cb35642b09092cdc9f5eb4edaddf9169b710f74cfe2ba0a67cb6cb8e109ab0a942134d7ba4acee16bf947055e042
SSDEEP 98304:APAdsBcCqzC7DWq/Ri6pLfmDKQMo0ZdqHgW6uToni1Rbw:APAOi/Sn/R15fmmPZkHgW62Jbw
TLSH
T17036E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-9139.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-9139.exe
Size 4.9MB
SHA256 761aaed31ac4c61f2620640b2b54cf09943b7051e07d8357b580df8d13ebee8c
MD5 6cdcdaeb4737b19f1743914f84053d5c
SHA1 12647cd9adddeeaa4bc32edcde693cd2d6deeec6
SHA512 fb1f7b4e4a41cb744e7b6dd79369ad3b72793e28be0d214c4790a6b42e03df0782aec82e3c6c6471b88aee9ce1630af933c39aff9ac3a52e3fe6adf329735d19
SSDEEP 98304:AP7dsBcCqzC7DWq/ui6pLfmDKQMo0adqHgW6uToni1Rbw:AP7Oi/Sn/u15fmmPakHgW62Jbw
TLSH
T1B336E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/432-732-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/700-790-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/800-299-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/996-1752-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1612-550-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1672-388-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1756-135-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1776-1056-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1780-3105-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2212-538-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2348-549-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2532-3106-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2676-518-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2736-895-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2900-286-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2908-565-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3312-0-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3312-1226-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3424-387-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3444-543-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3452-546-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3460-1058-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4452-1113-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4548-103-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4612-519-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4648-300-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4744-2980-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4896-517-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5152-1057-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5224-285-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5328-566-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5516-2306-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5724-1133-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5864-1001-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5944-2450-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6080-1158-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6156-733-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6224-692-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6260-893-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6268-894-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6300-796-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6312-1034-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6356-1005-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6364-898-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6500-863-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6524-891-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6560-860-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6568-899-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6576-797-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6732-931-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6756-933-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6960-979-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6992-980-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7000-977-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7008-1000-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7028-929-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7092-1024-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7100-892-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7188-1160-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7196-1086-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7224-1085-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7272-1084-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7348-1114-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7532-1112-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7612-1185-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7652-1188-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7800-1186-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7808-1187-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7940-1204-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/8092-1269-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/8132-1189-0x0000000000400000-0x0000000000475000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads