kawaiiunicorn | 8b470980088c98f14488cc550338e463b2010134b39041195729f56ac72ea176

Analysis

max time kernel
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 05:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_eb71c4dd2ffd63118157145828054271_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe
Size 4.9MB
Sample260808-gc7rws1dnd
SHA256 8b470980088c98f14488cc550338e463b2010134b39041195729f56ac72ea176
MD5 eb71c4dd2ffd63118157145828054271
SHA1 547ecedf39377d7037304bf6eda3b37cbd027c8c
SHA512 9367a482b1bd2ffd49932443d806d3002098dab28dcceca400b3020cc9bd7d2d0093d2812679663b6fe6eea3d0cb0a15c3027e33ac0a77b50aa6ea255cff69cc
SSDEEP 98304:EL0iZzcCqz9XDWqOTi65LHmD9yM60L79HgWKuu/nUmSNw:EL0+A/9nOT1JHmhLLxHgWKLUNw
TLSH
T11D36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery kawaiiunicorn trojan

Malware Config

Signatures

Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
trojan kawaiiunicorn

Detects KawaiiUnicorn 64 IoCs

resource	yara_rule
behavioral2/memory/908-0-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2880-51-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4544-71-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2432-138-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4540-185-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3088-213-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1232-212-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4420-357-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2712-381-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3252-378-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4136-441-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/260-473-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3752-478-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4736-468-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4680-521-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1204-544-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5992-465-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5380-450-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1188-440-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4140-590-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3308-662-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4872-827-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3828-826-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4304-825-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2012-824-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5976-823-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1052-821-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4260-822-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4400-820-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3160-819-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3840-818-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5104-817-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5092-813-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2720-812-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3292-816-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7028-924-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7056-925-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/672-923-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2616-922-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4632-854-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6676-853-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/352-852-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4356-661-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4668-650-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2260-649-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5452-648-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/408-660-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4840-592-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5088-591-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5552-572-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6556-1068-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2620-1066-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2760-993-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6172-992-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5784-991-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6524-1077-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7328-1194-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6800-1276-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7304-1278-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7884-1277-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/8088-1255-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/8076-1254-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/8000-1253-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7976-1252-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 28 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c447-6.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000e00000001c448-11.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c44b-19.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c44c-28.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c44d-39.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c44e-40.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c44f-47.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c450-56.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c451-67.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c452-73.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c453-77.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c455-84.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c454-91.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c456-102.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c45a-127.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c459-135.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c45b-149.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c457-136.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c46a-178.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c458-182.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c45c-191.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c46e-194.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c46c-210.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c468-226.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c46f-228.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c46b-223.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c469-219.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c46d-215.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Executes dropped EXE 15 IoCs

pid	Process
3820	Unicorn-5209.exe
4868	Unicorn-60134.exe
3324	Unicorn-6527.exe
2520	Unicorn-25127.exe
4320	Unicorn-54462.exe
2028	Unicorn-48754.exe
2880	Unicorn-17735.exe
1856	Unicorn-62371.exe
4544	Unicorn-19921.exe
4700	Unicorn-7123.exe
3568	Unicorn-43980.exe
5888	Unicorn-1577.exe
3024	Unicorn-21177.exe
2032	Unicorn-21443.exe
1676	Unicorn-21443.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
12740	6920	WerFault.exe	321

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_eb71c4dd2ffd63118157145828054271_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60134.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25127.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48754.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43980.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1577.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5209.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6527.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19921.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21443.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21443.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17735.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21177.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
908	2026-08-08_eb71c4dd2ffd63118157145828054271_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe
3820	Unicorn-5209.exe
4868	Unicorn-60134.exe
3324	Unicorn-6527.exe
2520	Unicorn-25127.exe
4320	Unicorn-54462.exe
2880	Unicorn-17735.exe
2028	Unicorn-48754.exe
1856	Unicorn-62371.exe
4544	Unicorn-19921.exe
4700	Unicorn-7123.exe
3568	Unicorn-43980.exe
5888	Unicorn-1577.exe
3024	Unicorn-21177.exe
2032	Unicorn-21443.exe
1676	Unicorn-21443.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 3820	908	2026-08-08_eb71c4dd2ffd63118157145828054271_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe	89
PID 3820 wrote to memory of 4868	3820	Unicorn-5209.exe	90
PID 908 wrote to memory of 3324	908	2026-08-08_eb71c4dd2ffd63118157145828054271_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe	91
PID 4868 wrote to memory of 2520	4868	Unicorn-60134.exe	92
PID 3820 wrote to memory of 4320	3820	Unicorn-5209.exe	93
PID 3324 wrote to memory of 2028	3324	Unicorn-6527.exe	94
PID 908 wrote to memory of 2880	908	2026-08-08_eb71c4dd2ffd63118157145828054271_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe	95
PID 2520 wrote to memory of 1856	2520	Unicorn-25127.exe	96
PID 4868 wrote to memory of 4544	4868	Unicorn-60134.exe	97
PID 3820 wrote to memory of 4700	3820	Unicorn-5209.exe	98
PID 4320 wrote to memory of 3568	4320	Unicorn-54462.exe	99
PID 3324 wrote to memory of 5888	3324	Unicorn-6527.exe	101
PID 908 wrote to memory of 3024	908	2026-08-08_eb71c4dd2ffd63118157145828054271_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe	100
PID 2880 wrote to memory of 1676	2880	Unicorn-17735.exe	103
PID 2028 wrote to memory of 2032	2028	Unicorn-48754.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-08_eb71c4dd2ffd63118157145828054271_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_eb71c4dd2ffd63118157145828054271_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:908
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5209.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5209.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60134.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60134.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62371.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45293.exe
        6⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44004.exe
        7⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12151.exe
        8⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10413.exe
        9⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24823.exe
        10⤵
        
        PID:8952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35531.exe
        10⤵
        
        PID:10888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38677.exe
        9⤵
        
        PID:8392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25659.exe
        8⤵
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61880.exe
        9⤵
        
        PID:8660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60913.exe
        9⤵
        
        PID:11132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58620.exe
        8⤵
        
        PID:704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7470.exe
        7⤵
        
        PID:1380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7097.exe
        8⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63753.exe
        8⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5027.exe
        8⤵
        
        PID:11312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17495.exe
        7⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24163.exe
        6⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52001.exe
        7⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        8⤵
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49798.exe
        9⤵
        
        PID:520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39134.exe
        8⤵
        
        PID:10412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56952.exe
        7⤵
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29922.exe
        7⤵
        
        PID:2628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10428.exe
        6⤵
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2000.exe
        6⤵
        
        PID:8384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25427.exe
        5⤵
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26599.exe
        6⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15161.exe
        7⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30471.exe
        8⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53432.exe
        8⤵
        
        PID:10636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47543.exe
        8⤵
        
        PID:9784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44076.exe
        7⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40168.exe
        7⤵
        
        PID:9700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2456.exe
        7⤵
        
        PID:12260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14398.exe
        6⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9785.exe
        7⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14085.exe
        7⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24713.exe
        8⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63906.exe
        7⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33455.exe
        7⤵
        
        PID:12304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20422.exe
        6⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39653.exe
        7⤵
        
        PID:2168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20468.exe
        5⤵
        
        PID:3404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24233.exe
        6⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65042.exe
        7⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31490.exe
        7⤵
        
        PID:8288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14424.exe
        6⤵
        
        PID:6488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3861.exe
        6⤵
        
        PID:9400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11966.exe
        6⤵
        
        PID:10544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16593.exe
        5⤵
        
        PID:5552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18577.exe
        6⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59950.exe
        7⤵
        
        PID:9604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45325.exe
        7⤵
        
        PID:4264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52102.exe
        6⤵
        
        PID:10156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62356.exe
        6⤵
        
        PID:8128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41359.exe
        5⤵
        
        PID:7068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20905.exe
        6⤵
        
        PID:8624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9382.exe
        6⤵
        
        PID:10008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25890.exe
        5⤵
        
        PID:6764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62954.exe
        5⤵
        
        PID:6328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19921.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6250.exe
        5⤵
        
        PID:1176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22515.exe
        6⤵
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13355.exe
        7⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53200.exe
        8⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22861.exe
        9⤵
        
        PID:8528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34510.exe
        8⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38906.exe
        8⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38482.exe
        7⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23705.exe
        7⤵
        
        PID:9836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49020.exe
        7⤵
        
        PID:8412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7195.exe
        6⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32972.exe
        7⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61415.exe
        8⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54526.exe
        7⤵
        
        PID:9136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3963.exe
        7⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22181.exe
        6⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4705.exe
        7⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17282.exe
        8⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61600.exe
        7⤵
        
        PID:500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5256.exe
        7⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60035.exe
        7⤵
        
        PID:12472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35424.exe
        6⤵
        
        PID:8832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63277.exe
        5⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58057.exe
        6⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58348.exe
        7⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50505.exe
        8⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31490.exe
        7⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7463.exe
        8⤵
        
        PID:7656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25854.exe
        7⤵
        
        PID:11684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22831.exe
        6⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60598.exe
        6⤵
        
        PID:10104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46467.exe
        6⤵
        
        PID:1168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40466.exe
        5⤵
        
        PID:916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13558.exe
        6⤵
        
        PID:7976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37101.exe
        5⤵
        
        PID:7836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7167.exe
        6⤵
        
        PID:11700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32033.exe
        5⤵
        
        PID:11248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15662.exe
        5⤵
        
        PID:12844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39163.exe
      4⤵
      PID:2840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47605.exe
        5⤵
        
        PID:3088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30870.exe
        6⤵
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42619.exe
        7⤵
        
        PID:352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53691.exe
        8⤵
        
        PID:8748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8081.exe
        7⤵
        
        PID:9064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45842.exe
        7⤵
        
        PID:10368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64746.exe
        6⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49820.exe
        7⤵
        
        PID:8008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32765.exe
        7⤵
        
        PID:11348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45226.exe
        6⤵
        
        PID:7972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47370.exe
        7⤵
        
        PID:6652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52366.exe
        6⤵
        
        PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29644.exe
        5⤵
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
        6⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44591.exe
        7⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47303.exe
        7⤵
        
        PID:7392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56590.exe
        7⤵
        
        PID:11308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56905.exe
        6⤵
        
        PID:7356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31864.exe
        7⤵
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46840.exe
        6⤵
        
        PID:9844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18308.exe
        6⤵
        
        PID:7512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35399.exe
        5⤵
        
        PID:4280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29895.exe
        6⤵
        
        PID:7428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11854.exe
        7⤵
        
        PID:10096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42101.exe
        7⤵
        
        PID:7744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9778.exe
        6⤵
        
        PID:11032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37841.exe
        6⤵
        
        PID:8432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20501.exe
        5⤵
        
        PID:7568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31502.exe
        5⤵
        
        PID:9256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30848.exe
        5⤵
        
        PID:12612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64745.exe
      4⤵
      PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57325.exe
        5⤵
        
        PID:1972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2722.exe
        6⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17731.exe
        7⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34273.exe
        8⤵
        
        PID:11136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22497.exe
        7⤵
        
        PID:11172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8458.exe
        7⤵
        
        PID:11460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11352.exe
        6⤵
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18430.exe
        7⤵
        
        PID:10944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14015.exe
        7⤵
        
        PID:12888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45226.exe
        6⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48677.exe
        7⤵
        
        PID:11888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23614.exe
        5⤵
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27793.exe
        6⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52218.exe
        7⤵
        
        PID:11676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31490.exe
        6⤵
        
        PID:8284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28543.exe
        5⤵
        
        PID:6540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16032.exe
        6⤵
        
        PID:8960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22537.exe
        6⤵
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33686.exe
        5⤵
        
        PID:8920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5107.exe
        5⤵
        
        PID:11328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39158.exe
      4⤵
      PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57979.exe
        5⤵
        
        PID:972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64876.exe
        6⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57713.exe
        7⤵
        
        PID:10488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31490.exe
        6⤵
        
        PID:7764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14092.exe
        5⤵
        
        PID:868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19073.exe
        6⤵
        
        PID:6684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12963.exe
        5⤵
        
        PID:7648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48657.exe
      4⤵
      PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15733.exe
        5⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60489.exe
        6⤵
        
        PID:8520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31490.exe
        5⤵
        
        PID:5900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38055.exe
        6⤵
        
        PID:7772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1384.exe
        5⤵
        
        PID:11240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52065.exe
      4⤵
      PID:1456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57305.exe
        5⤵
        
        PID:7380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48808.exe
        6⤵
        
        PID:9016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44423.exe
        5⤵
        
        PID:9432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61327.exe
        5⤵
        
        PID:9828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14513.exe
        5⤵
        
        PID:13252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5758.exe
      4⤵
      PID:8820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54462.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54462.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43980.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27888.exe
        5⤵
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61082.exe
        6⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15764.exe
        7⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1093.exe
        8⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16020.exe
        8⤵
        
        PID:10964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11121.exe
        8⤵
        
        PID:11548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22141.exe
        7⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64027.exe
        8⤵
        
        PID:11412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61718.exe
        7⤵
        
        PID:10328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61631.exe
        6⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1524.exe
        7⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39544.exe
        8⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2285.exe
        7⤵
        
        PID:10524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21077.exe
        6⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35263.exe
        7⤵
        
        PID:1992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45597.exe
        6⤵
        
        PID:10464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24739.exe
        5⤵
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57564.exe
        6⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1311.exe
        7⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48092.exe
        7⤵
        
        PID:10356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42641.exe
        7⤵
        
        PID:11952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61036.exe
        6⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29073.exe
        7⤵
        
        PID:8720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24516.exe
        8⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56440.exe
        7⤵
        
        PID:3812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44344.exe
        6⤵
        
        PID:10080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27546.exe
        6⤵
        
        PID:11656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17060.exe
        5⤵
        
        PID:5072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52012.exe
        6⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45368.exe
        7⤵
        
        PID:11184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12705.exe
        6⤵
        
        PID:10384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26463.exe
        6⤵
        
        PID:13000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40259.exe
        5⤵
        
        PID:7460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4396.exe
        6⤵
        
        PID:11396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30239.exe
        5⤵
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58568.exe
        5⤵
        
        PID:6752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19985.exe
      4⤵
      PID:1232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40081.exe
        5⤵
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3314.exe
        6⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14085.exe
        6⤵
        
        PID:9048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1135.exe
        6⤵
        
        PID:11360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47149.exe
        5⤵
        
        PID:6172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38902.exe
        6⤵
        
        PID:4188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33807.exe
        6⤵
        
        PID:9788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21183.exe
        5⤵
        
        PID:9524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63737.exe
        6⤵
        
        PID:7708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37787.exe
      4⤵
      PID:1300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53418.exe
        5⤵
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38473.exe
        6⤵
        
        PID:6584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20567.exe
        6⤵
        
        PID:10264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32095.exe
        6⤵
        
        PID:6324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37740.exe
        5⤵
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20220.exe
        6⤵
        
        PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58158.exe
        5⤵
        
        PID:10224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10503.exe
        5⤵
        
        PID:11544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2770.exe
      4⤵
      PID:5784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43295.exe
      4⤵
      PID:9180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7123.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7123.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45293.exe
      4⤵
      PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26599.exe
        5⤵
        
        PID:1488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35442.exe
        6⤵
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1425.exe
        7⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31490.exe
        7⤵
        
        PID:8204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38736.exe
        6⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3992.exe
        7⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50151.exe
        8⤵
        
        PID:11120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27820.exe
        6⤵
        
        PID:8976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57888.exe
        7⤵
        
        PID:1400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16453.exe
        5⤵
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1617.exe
        6⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13342.exe
        7⤵
        
        PID:11960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16664.exe
        6⤵
        
        PID:9560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21680.exe
        6⤵
        
        PID:12000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42467.exe
        5⤵
        
        PID:6576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6733.exe
      4⤵
      PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        5⤵
        
        PID:4356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9448.exe
        6⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12996.exe
        7⤵
        
        PID:3144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62709.exe
        6⤵
        
        PID:9456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55132.exe
        6⤵
        
        PID:10388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27574.exe
        5⤵
        
        PID:7104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41604.exe
        6⤵
        
        PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33286.exe
      4⤵
      PID:1204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19023.exe
        5⤵
        
        PID:6556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48896.exe
        5⤵
        
        PID:8892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4638.exe
        5⤵
        
        PID:7508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42385.exe
      4⤵
      PID:7152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11927.exe
        5⤵
        
        PID:11208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28955.exe
        5⤵
        
        PID:12824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45028.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45028.exe
    3⤵
    PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26599.exe
      4⤵
      PID:3080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61674.exe
        5⤵
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49189.exe
        6⤵
        
        PID:7484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28747.exe
        5⤵
        
        PID:7900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56280.exe
        6⤵
        
        PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36306.exe
        5⤵
        
        PID:1740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62530.exe
      4⤵
      PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13506.exe
        5⤵
        
        PID:7120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52176.exe
        5⤵
        
        PID:2596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3375.exe
      4⤵
      PID:7492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41070.exe
        5⤵
        
        PID:11848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10079.exe
      4⤵
      PID:3348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52923.exe
      4⤵
      PID:11380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17668.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17668.exe
    3⤵
    PID:1820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24233.exe
      4⤵
      PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18063.exe
        5⤵
        
        PID:6588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37593.exe
        6⤵
        
        PID:11712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31490.exe
        5⤵
        
        PID:1276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55397.exe
        6⤵
        
        PID:10360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6687.exe
      4⤵
      PID:6792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31593.exe
      4⤵
      PID:10956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49575.exe
      4⤵
      PID:12068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56930.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56930.exe
    3⤵
    PID:2008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18717.exe
      4⤵
      PID:7236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29176.exe
        5⤵
        
        PID:11304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8754.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8754.exe
    3⤵
    PID:7336
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6527.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6527.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48754.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48754.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21443.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22032.exe
        5⤵
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28322.exe
        6⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1477.exe
        7⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31490.exe
        7⤵
        
        PID:6412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
        6⤵
        
        PID:6188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23518.exe
        6⤵
        
        PID:9276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53871.exe
        6⤵
        
        PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19831.exe
        5⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45333.exe
        6⤵
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60154.exe
        7⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15699.exe
        7⤵
        
        PID:9240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        7⤵
        
        PID:1764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2930.exe
        6⤵
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42607.exe
        7⤵
        
        PID:9468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16537.exe
        7⤵
        
        PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58746.exe
        5⤵
        
        PID:1052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27975.exe
        6⤵
        
        PID:8064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11565.exe
        5⤵
        
        PID:8100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22616.exe
        6⤵
        
        PID:11404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58918.exe
        5⤵
        
        PID:10208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44268.exe
        5⤵
        
        PID:12972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2166.exe
      4⤵
      PID:4224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55182.exe
        5⤵
        
        PID:2092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10968.exe
        6⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32614.exe
        7⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26686.exe
        8⤵
        
        PID:9172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48704.exe
        7⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43922.exe
        7⤵
        
        PID:1192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48556.exe
        7⤵
        
        PID:12900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55390.exe
        6⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52253.exe
        7⤵
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-374.exe
        6⤵
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55759.exe
        6⤵
        
        PID:9392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14647.exe
        5⤵
        
        PID:2492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48701.exe
        6⤵
        
        PID:7136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5814.exe
        5⤵
        
        PID:6784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21486.exe
        6⤵
        
        PID:9212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19399.exe
        7⤵
        
        PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27682.exe
        5⤵
        
        PID:8676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33758.exe
      4⤵
      PID:2512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8877.exe
        5⤵
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29620.exe
        6⤵
        
        PID:7444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20567.exe
        6⤵
        
        PID:9664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12443.exe
        6⤵
        
        PID:12116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-172.exe
        5⤵
        
        PID:8776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25141.exe
      4⤵
      PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57196.exe
        5⤵
        
        PID:6224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20567.exe
        5⤵
        
        PID:9644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12443.exe
        5⤵
        
        PID:6380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3131.exe
      4⤵
      PID:8548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44570.exe
      4⤵
      PID:10260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37600.exe
      4⤵
      PID:4744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1577.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1577.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22032.exe
      4⤵
      PID:716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31555.exe
        5⤵
        
        PID:2768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23247.exe
        6⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49796.exe
        7⤵
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21942.exe
        7⤵
        
        PID:10428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34372.exe
        6⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2435.exe
        7⤵
        
        PID:8492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4339.exe
        8⤵
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
        6⤵
        
        PID:7824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51738.exe
        6⤵
        
        PID:4164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-366.exe
        5⤵
        
        PID:3876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8763.exe
        6⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31490.exe
        6⤵
        
        PID:8268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37992.exe
        7⤵
        
        PID:11260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12533.exe
        6⤵
        
        PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26042.exe
        5⤵
        
        PID:7200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-407.exe
        6⤵
        
        PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27132.exe
        5⤵
        
        PID:9808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22279.exe
        5⤵
        
        PID:7532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21995.exe
      4⤵
      PID:4136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28312.exe
        5⤵
        
        PID:1768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52160.exe
        5⤵
        
        PID:8912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46501.exe
        5⤵
        
        PID:11436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
      4⤵
      PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23756.exe
        5⤵
        
        PID:8028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41403.exe
        6⤵
        
        PID:10200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28012.exe
        6⤵
        
        PID:11452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2367.exe
      4⤵
      PID:8636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28153.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28153.exe
    3⤵
    PID:2984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26599.exe
      4⤵
      PID:1780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5566.exe
        5⤵
        
        PID:3996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61617.exe
        6⤵
        
        PID:6840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19098.exe
        6⤵
        
        PID:10408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7517.exe
        5⤵
        
        PID:6524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4755.exe
        6⤵
        
        PID:10124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42755.exe
        6⤵
        
        PID:7660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13674.exe
        5⤵
        
        PID:9768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42403.exe
        5⤵
        
        PID:12424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54144.exe
      4⤵
      PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13096.exe
        5⤵
        
        PID:52
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48392.exe
        6⤵
        
        PID:12032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51600.exe
        5⤵
        
        PID:10424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2135.exe
      4⤵
      PID:7892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26334.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26334.exe
    3⤵
    PID:3484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46023.exe
      4⤵
      PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        5⤵
        
        PID:6516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39902.exe
        5⤵
        
        PID:10112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5256.exe
        5⤵
        
        PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16371.exe
        5⤵
        
        PID:708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42068.exe
      4⤵
      PID:7924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63462.exe
        5⤵
        
        PID:7364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35678.exe
      4⤵
      PID:2992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2256.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2256.exe
    3⤵
    PID:3840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7611.exe
      4⤵
      PID:6920
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6920 -s 604
        5⤵
        Program crash
        
        PID:12740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62439.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62439.exe
    3⤵
    PID:8540
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17735.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17735.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21443.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21443.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43521.exe
      4⤵
      PID:5836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30678.exe
        5⤵
        
        PID:1884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32785.exe
        6⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44975.exe
        7⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43431.exe
        7⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32384.exe
        7⤵
        
        PID:12792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24663.exe
        6⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52301.exe
        7⤵
        
        PID:11148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57058.exe
        7⤵
        
        PID:11808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17203.exe
        6⤵
        
        PID:2476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12818.exe
        6⤵
        
        PID:12072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45976.exe
        5⤵
        
        PID:2720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8548.exe
        6⤵
        
        PID:8768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28475.exe
        7⤵
        
        PID:10644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55153.exe
        5⤵
        
        PID:8272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26519.exe
        6⤵
        
        PID:11588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20023.exe
      4⤵
      PID:2712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18945.exe
        5⤵
        
        PID:3160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52012.exe
        6⤵
        
        PID:6700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8820.exe
        5⤵
        
        PID:7884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
        6⤵
        
        PID:11168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28085.exe
        6⤵
        
        PID:11284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36058.exe
      4⤵
      PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47715.exe
        5⤵
        
        PID:6976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31490.exe
        5⤵
        
        PID:7260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56306.exe
        6⤵
        
        PID:11988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55132.exe
        5⤵
        
        PID:10832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58031.exe
      4⤵
      PID:4160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22550.exe
      4⤵
      PID:9408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47336.exe
      4⤵
      PID:1892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54382.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54382.exe
    3⤵
    PID:4364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40081.exe
      4⤵
      PID:3712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43833.exe
        5⤵
        
        PID:4240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38478.exe
        6⤵
        
        PID:6984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14085.exe
        6⤵
        
        PID:8944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52232.exe
        7⤵
        
        PID:12016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12198.exe
        5⤵
        
        PID:7476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64344.exe
        6⤵
        
        PID:8844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27893.exe
        5⤵
        
        PID:10420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56365.exe
      4⤵
      PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64949.exe
        5⤵
        
        PID:8076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13581.exe
        6⤵
        
        PID:11896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27479.exe
        5⤵
        
        PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59060.exe
        5⤵
        
        PID:4768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60931.exe
      4⤵
      PID:8000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39373.exe
        5⤵
        
        PID:8184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45627.exe
      4⤵
      PID:3604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4153.exe
      4⤵
      PID:12104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62321.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62321.exe
    3⤵
    PID:260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53200.exe
      4⤵
      PID:5976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53608.exe
        5⤵
        
        PID:8212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48610.exe
        6⤵
        
        PID:3332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34043.exe
      4⤵
      PID:8324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9933.exe
        5⤵
        
        PID:7608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38519.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38519.exe
    3⤵
    PID:3556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23756.exe
      4⤵
      PID:7412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20567.exe
      4⤵
      PID:9656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60130.exe
      4⤵
      PID:7176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50002.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50002.exe
    3⤵
    PID:9100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47949.exe
      4⤵
      PID:12816
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21177.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21177.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22032.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22032.exe
    3⤵
    PID:5484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26599.exe
      4⤵
      PID:3172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4663.exe
        5⤵
        
        PID:672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63120.exe
        6⤵
        
        PID:8420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12963.exe
        5⤵
        
        PID:200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46445.exe
        5⤵
        
        PID:10352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5246.exe
        5⤵
        
        PID:12712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62229.exe
      4⤵
      PID:4840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10683.exe
        5⤵
        
        PID:7112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14791.exe
        6⤵
        
        PID:8936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65386.exe
        6⤵
        
        PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44423.exe
        5⤵
        
        PID:8560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28210.exe
        5⤵
        
        PID:1260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19820.exe
      4⤵
      PID:7128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6733.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6733.exe
    3⤵
    PID:5052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44570.exe
      4⤵
      PID:408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40751.exe
        5⤵
        
        PID:7028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20495.exe
        6⤵
        
        PID:8988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50389.exe
        6⤵
        
        PID:9672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62709.exe
        5⤵
        
        PID:8052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54134.exe
      4⤵
      PID:6800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47333.exe
      4⤵
      PID:9712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7722.exe
      4⤵
      PID:12252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18019.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18019.exe
    3⤵
    PID:2260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62406.exe
      4⤵
      PID:6964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14495.exe
        5⤵
        
        PID:9160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16664.exe
      4⤵
      PID:9324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39086.exe
      4⤵
      PID:7724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13708.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13708.exe
    3⤵
    PID:5260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42478.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42478.exe
    3⤵
    PID:10028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37254.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37254.exe
    3⤵
    PID:6392
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34590.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34590.exe
  2⤵
  PID:4884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10916.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10916.exe
    3⤵
    PID:1188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21706.exe
      4⤵
      PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46177.exe
        5⤵
        
        PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25350.exe
        5⤵
        
        PID:11608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31490.exe
      4⤵
      PID:7784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12533.exe
      4⤵
      PID:11056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29852.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29852.exe
    3⤵
    PID:5224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21816.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21816.exe
    3⤵
    PID:8800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24351.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24351.exe
    3⤵
    PID:11880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63876.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63876.exe
    3⤵
    PID:10292
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10121.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10121.exe
  2⤵
  PID:5816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3973.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3973.exe
    3⤵
    PID:7084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8921.exe
      4⤵
      PID:12196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9315.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9315.exe
    3⤵
    PID:9292
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36632.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36632.exe
  2⤵
  PID:6276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49244.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49244.exe
    3⤵
    PID:4896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20762.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20762.exe
    3⤵
    PID:12008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25643.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25643.exe
    3⤵
    PID:13060
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11119.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11119.exe
  2⤵
  PID:8316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-1577.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-1577.exe
Size 4.9MB
SHA256 4350f4a104113718d0bd22fb6c410718ed3d8fbf8e4742037d17fed0113eadc7
MD5 c4e03b3a8750b7f8d9ab5ee544e2979f
SHA1 eee3a108cb69e0a7d39eff128a8049fcce0fc24d
SHA512 13b20c6219365ccf5363ccd74e3511cc73956b5ee2548c791a033ee957ece70e2eff59c478a77b8fd163c2e1529ab0337d03621ad8522e0b641f0c7608853fd7
SSDEEP 98304:EL0iZzcCqz9XDWqOTi65LHOD9yMo0L79HgWKuu/nUmSNw:EL0+A/9nOT1JHOh9LxHgWKLUNw
TLSH
T1B236E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-17735.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-17735.exe
Size 4.9MB
SHA256 8f0f82b9e8ff6c16673513d8030d3eb261dbe4d92942f141432e154242dfd787
MD5 6a788f9e8b8460eb0629ed573fc58e3c
SHA1 3ea926f090755783b3860ddf45d7260c1f8e5b67
SHA512 1d07add4853785f915a460e307af2289ba475859176e0b6b4fcb943878cc6b8c69e3e10a4d1c684062ea499eff40a6089021aad97cf5c298eea4fcaa6c580229
SSDEEP 98304:EL9iZzcCqz9XDWqOTi65LHmD9yM60L79HgWKuu/nUmSNw:EL9+A/9nOT1JHmhLLxHgWKLUNw
TLSH
T10D36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-19921.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-19921.exe
Size 4.9MB
SHA256 346f87cd545b273afa68163b0684ce7b13067fb0a81291e873399a7542efbe00
MD5 23bd4f366d4b2a530691249a140ebb35
SHA1 cbad84f19c1db9685d7f9456138d71f726976b2a
SHA512 4e5df1c858dff1e7c33ea388259bdd701682a1739c5e14442bf48ddfc0882a36478dc8ef7ac74d857c08b237cb1da0fc96db55343a8ff01633fa0b53cdcd1ca3
SSDEEP 98304:EL0iZzcCqz9XDWqOTi65LHmD9yM60L7MHgWKuu/2UmSNw:EL0+A/9nOT1JHmhLLoHgWKLbNw
TLSH
T1FC36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-19985.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-19985.exe
Size 4.9MB
SHA256 caeadb7b04d82fead781c077dc0f498b36f03d58f99004709941d48df9e90de5
MD5 fc1cef24449b7e33438ffd8b4133843c
SHA1 994505ff47e9aa8843d42055d8faa5bfbabf2fa2
SHA512 535fb4f5668f5c218ed588cd685b2c32a6a19b9e9b35827f16afeabf587afc6b47fcd86962637421e63842939262cdae01bdeab9acbba92e6f8b8dd29afc99ce
SSDEEP 98304:RL0iZzcCqzQXDWqOTi65LHmD9yM60L79HgWKuu/nUmSNw:RL0+A/cnOT1JHmhLLxHgWKLUNw
TLSH
T1AF36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-21177.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-21177.exe
Size 4.9MB
SHA256 647edbddabcf51117466419eb8c3747741cfc1cf50ba16f0d4e0a58e4fbca6b8
MD5 68b22688e8c6cfc8d811324ec976dcd7
SHA1 b8725970941c3fcb085157781b5edca09a1dd83d
SHA512 0dfae7fd72574a80aa43fa5e8ba93f8a4b7fde8e6e9ca90aaf0b3d2b5eddd07d62b76b951e6a7b47a20316f21ebd9c9187dd6c98a419e96cc400c01e2c07d62f
SSDEEP 98304:EL0iZzcCqz9XDWqOTP65LHmD9yM60L79HgWKuu/nUmSNw:EL0+A/9nOTiJHmhLLxHgWKLUNw
TLSH
T14436E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-21443.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-21443.exe
Size 4.9MB
SHA256 92a80d8f656a0d07b482fd87d964eff534d901cfe2feac9a82d6f4917bc72fd6
MD5 ddf3e81646e2447b4f5e800dfe084949
SHA1 159d3ebf73946979a090f104751b87f42286f492
SHA512 fcdf6b56c661524ffbfba9164c2d51b230b5e85beccea870ca7f0de2c75e15a809fbd112e13b0902b8691e40d69678e874a5779473725482083bf1fe3d8b8600
SSDEEP 98304:EL0iZzcCqz9XDWqOTi65LHmD9yMo0L99HgWKuu/nUmdNw:EL0+A/9nOT1JHmh9LPHgWKLTNw
TLSH
T1A636E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-22032.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-22032.exe
Size 4.9MB
SHA256 1d8bf35f976cb3a570bf925dc0c714cdc1c248f929c8902b9e05d1d28d38995d
MD5 c4bbce0fd300ba367026e813e9c53411
SHA1 8aab787122bc721c8d1e76348461d3364c4ef717
SHA512 eedab8572d5595aa94d40ada2ac06a3c3746cb798b2d4b0e77b3a5e36061540d73e718fa5b3ade0d044d2b4bdbd883ff1445c8494c0efd68560b8dac2cd904f3
SSDEEP 98304:EL0iZzcCqz9XDWqOTP65LHmD9yM60L79HgWKuE/nUmSNw:EL0+A/9nOTiJHmhLLxHgWKdUNw
TLSH
T11A36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-25127.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe
Size 4.9MB
SHA256 e2635afd8944181fdc68572efe948bdf224ab40341be3dbddf974357ea6a0f2f
MD5 568e13c7dbc6d512f2785111483ece86
SHA1 2b4df2ac53e6c5e5e84e6b1f9f964e2e634ecb0a
SHA512 32ff592be482c5b4fc1b0a02e7363bf1f5c48c73c5126b009462252adeb7e641821ef6721b00d2a4dfb194aa5974bc29f526e83592ff7de2dd07c1b0486f3a96
SSDEEP 98304:EL0iZzcCqz9XDWqOIi65LHmD9yM60L79HgWKuu/2UmSNw:EL0+A/9nOI1JHmhLLxHgWKLbNw
TLSH
T19F36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-25427.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-25427.exe
Size 4.9MB
SHA256 b3e0356b79b246e6459dac38b6f8825f86f27a5d5f0eeb5f3ab199c77710466b
MD5 cd8c3e98b58fe8fdeedd0c04e036f0ed
SHA1 382e23f91992b1b4436fefe2d7333496ff648381
SHA512 aac282c9a172d5b66bb1764298b6ff8abe05ff4d0dfd8ee28f4ccc6e683e477efe27144a437247416240539ff1374e547ac7535940214c79dbbe2027bd529666
SSDEEP 98304:ELoiZzcCqz9XDWqOIi65LHmD9yM60L79HgWKuu/2UmSNw:ELo+A/9nOI1JHmhLLxHgWKLbNw
TLSH
T11236E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-27888.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-27888.exe
Size 4.9MB
SHA256 fb57ec8af7b77e744574048e0f21070265b959c7ad97f7162de7dbbd97431560
MD5 118d4846768cfbe8960fc52f5d80dcd8
SHA1 3c259fc81125ef3c2cd5d76f773cddb8c3d1c38f
SHA512 317bfb7a5295e1b28fe845e491a0967d45e74b5d89ab4e8cd2ad0b160726420f13ae5de745a547bd8dcf485000837d5429cbdadc3c69d70aa80452ef6d7ff2e8
SSDEEP 98304:EL0iZzcCqzQXDWqOTi65LHmD9yM60Lc9HgWKuu/nUmSNw:EL0+A/cnOT1JHmhLLqHgWKLUNw
TLSH
T1C336E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-28153.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-28153.exe
Size 4.9MB
SHA256 56afd19de12904fe35bf32103eebe046ba7219f1e8993080f21adec2a6bb3b85
MD5 e6ae646d5b63f60e852e8d91b28c7c6b
SHA1 51ea7183ae82be865005f6ad067db7b6df48727e
SHA512 b89f54a5ed105e1c25d75a04eeca2d9de3b593eb331aad67d7840680e97c7dc93a12fad9e5438579b8da978337a13e1eb77e1b194016b07edc2ff2be4657d365
SSDEEP 98304:EL0iZzcCqz9XDqqOTi65LHmD9yMo0L79HgWKuu/nUmSNw:EL0+A/9rOT1JHmh9LxHgWKLUNw
TLSH
T1CA36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-34590.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-34590.exe
Size 4.9MB
SHA256 583416c49298744a64c3a3680e4380ac81aab199225ccf34213332a406f5044b
MD5 da1bd2c3c3be51688d2bb23f832dfda4
SHA1 65b7e8d5d0e6caf723a760fcdd1c4b0fb4649eab
SHA512 780bb9190c6de065f3eb1cbcf833020e6fd168db2321c2ee95bf83c0501882c047f246d94f3c1a05cd5eeef28d6af2238cc6257890aa20337e5b897f71ef8d47
SSDEEP 98304:EL0iZzcCqz9XDWqOTi65LZmD9yM60L79HgWKuu/nUmSNw:EL0+A/9nOT1JZmhLLxHgWKLUNw
TLSH
T18536E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-39163.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-39163.exe
Size 4.9MB
SHA256 68f05908fc4446edc9b0812d714cbb446e9bf394c0fe79b297cac6d79d4bfb54
MD5 f5f9c6564e62d5e394f4b4a999fed115
SHA1 00d349f7e35661da883a9d7e1594361a7bcd4a97
SHA512 463dd69568c4980888e39016acad7ef0b53ce52d8bba95efac8209b309d381c0143e3d062e09d2d36d096b67ab0dfdfde7d46761404b98468aad2c698ced0a3b
SSDEEP 98304:EL0iZzcCqz9XDWqOTi65LHmD9yM60L79HgWKuu/2UmSNw:EL0+A/9nOT1JHmhLLxHgWKLbNw
TLSH
T1E136E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-43521.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-43521.exe
Size 4.9MB
SHA256 cb040fd367b0acb9483ecb38a726f1c15959a63835cb7771df0fababaaba0069
MD5 cb060db96c0c54a4c1bf44dfb1d14369
SHA1 2ffa7b26d9052834f5d0b335562ad6552e8d853a
SHA512 b9d1461904539ed3562b0e3058691f80f3f0b6e56ff9166d5572c72eea918f1805c2437d1475a705377e3361852277342b1c4a997d991d4ea90257559fcc006b
SSDEEP 98304:EL0iZzcCqz9XDWqOTi65LHmD9yMo0L99HgWKuu/nemdNw:EL0+A/9nOT1JHmh9LPHgWKLRNw
TLSH
T12936E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-43980.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-43980.exe
Size 4.9MB
SHA256 bb0622676ba360f398ddc127ea6266910925692e5934becee71dd858a9dde364
MD5 8bc7eee94f2a5d4c0ddced2c6a2cd7ce
SHA1 f111fb78fb903c0afe29b6e20022ce29529056a1
SHA512 68284a56324d6c039501746d0486a21d1d106148062322edf5f3c4e8066d8f25044889091feff49be906743c25a0d6e4a25aea41ef817831bca1bfb359488b93
SSDEEP 98304:EL0iZzcCqzQXDWqOTi65LHmD9yM60Lv9HgWKuu/nUmSNw:EL0+A/cnOT1JHmhLL1HgWKLUNw
TLSH
T19536E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-45028.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-45028.exe
Size 4.9MB
SHA256 328c71000caffd4735ed4c037ac0a3c83d33f0aa7524d9c969a433d0bb79db7f
MD5 2d23ab574b1d61513e42ded49e2882b4
SHA1 85a3e1c9ab1157234286e5ce1191f23102df8b3a
SHA512 a2d4b43bc84728324996d65a1956c8d82615a00347f0951ae81552a64ceea80d417d4661f70f4bcf414b64d33115c6c43e461c2675fa622955a3cc291459c058
SSDEEP 98304:EL0iZzcCqz9XDWqOTi61LHmD9yM60L79HgWKuu/nUmSNw:EL0+A/9nOT1tHmhLLxHgWKLUNw
TLSH
T11836E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-45293.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-45293.exe
Size 4.9MB
SHA256 29c9247eb0b66b748bef1765a780d8b8fc92e91681f74cecf0680eae83dbaf8d
MD5 53fc4f2ff656c58e3f1daaa3bc89d7de
SHA1 d7de7cc84745b43e427d0beee2e7900343fcc911
SHA512 f383a5d43b7ec10dde6ac0ddfb94440f9088a7e2b2a8f307fcac7d31b5632d72f09b46e83ddb6f09d9faf0db0d33f486995b5a485f07f3e5c326b3bf225df86b
SSDEEP 98304:EL0iZzcCqz9XDWqOIi65LHmD9yM60LR9HgWKuu/2UtSNw:EL0+A/9nOI1JHmhLLjHgWKLuNw
TLSH
T19736E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-47605.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-47605.exe
Size 4.9MB
SHA256 644370207af2424dbcc46390b1e5b47ea1de06093b2691571911c74db5b0a747
MD5 e3511d8a002e4bcec5062a2f17866fdd
SHA1 745ae2b17a7497d43bc156eedaf8640584a69773
SHA512 56be4caea2f22cf0f90a70e67063610c818d3d069d63ca7712270c3cdf43a47565319c22d94d7320a51f39638c69e2cd5fcc2e48a8beb36c3c5b3d51896c940e
SSDEEP 98304:ELuiZzcCqz9XDWqOTi65LHmD9yM60L79HgWKuu/2UmSNw:ELu+A/9nOT1JHmhLLxHgWKLbNw
TLSH
T14836E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-48754.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-48754.exe
Size 4.9MB
SHA256 ccda15b1c40ef39a38ae2ee6365d80928d9d93dbc21632193b177644e1fdb0d1
MD5 69894a9546d220721b125f3a068d602c
SHA1 b45fa0a380ab44eac067ebc379f1940aa9b3096c
SHA512 8d9be20d8f21d3a9aa5b742acc6d196c1fb18323de6151ad3dec43569ed5d5fd024c4fc202244c839d931175bc81821a145e34516f331b5e8d4ea67c76ab4832
SSDEEP 98304:EL0iZzcCqz9XDWqOTi65LHmD9yMo0L99HgWKuu/nUmSNw:EL0+A/9nOT1JHmh9LPHgWKLUNw
TLSH
T11536E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-5209.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-5209.exe
Size 4.9MB
SHA256 d29a91a9265ce3034bea1734cfe38cdd9eab009f2df3c666eae7d490a7e1550f
MD5 49c235d29c416cdfff7aa1b6a2c8d842
SHA1 27e6062166de013d9d719ffd398b7ae4cb949837
SHA512 3d42b5fd281beb44badceefce4ce245b5735cb1f50055b824bb58929a153a204046a453eee92239324e5767d07293e8e5ee3a17394c244c0db7cbb1da14a0ae2
SSDEEP 98304:EL0iZzcCqz9XDWqOTi65LHmD9yM60L79HgWKuu/nUmSNw:EL0+A/9nOT1JHmhLLxHgWKLUNw
TLSH
T19736E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-54382.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-54382.exe
Size 4.9MB
SHA256 c5efb6e2089fcfd21bd11a8539df7ef19971b7a259c163d7a0aea2b5c2816ca3
MD5 b2e1aa0aac39bf9dac7d2b8fe5b0e00a
SHA1 81df923bc3e10722ee80a7e80c6280923a97d616
SHA512 2cb9f0b33a407ade3f342b5a61d5a1ebbacbf915be10af31860e420842c398441d9e64209a9a67d93c02b6242054354d0304532f3387bb56da916bfb90a2291a
SSDEEP 98304:EL9iZzcCqz9XDWqOTi6NLHmD9yM60L79HgWKuu/nUmSNw:EL9+A/9nOT1lHmhLLxHgWKLUNw
TLSH
T11436E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-54462.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-54462.exe
Size 4.9MB
SHA256 e1ae28655ecb8b23578df48d89dd38ec968751b7f70601069f117e481343edec
MD5 344af92bceca10261322baaeb1b950f8
SHA1 d121c065df76cfae784abe9e9e216447a8c959b7
SHA512 1839f3534d3bfe05158d89f4e76f7afa4e552d61cf018682d176c5bd943453e1ab5c82aa1073db7b1e0a1f0ec0ebbd756bff3e788ed98ef63c1156be4db0d29c
SSDEEP 98304:EL0iZzcCqzQXDWqOTi65LHmD9yM60L79HgWKuu/nUmSNw:EL0+A/cnOT1JHmhLLxHgWKLUNw
TLSH
T12B36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-60134.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-60134.exe
Size 4.9MB
SHA256 43ee42e46088be46c8135fbbd0c8cd72f566d95453bfa1de095fb2c475807768
MD5 e94bd43e6be0059f2800e758ece8d9a0
SHA1 35214be9cf07e055e13bbcf9b2fa9495b0b4e99d
SHA512 b04a6040d712d12cf603acb5f7450f6f943f2fa15b69bedbe6376619e095f9271053bf3d5e12c90374a1ffdff6fc4be1d623049c7607f51b250ab8bbca400dea
SSDEEP 98304:EL0iZzcCqz9XDWqOTi65LHmD9yM60L79HgWKuu/2UmSNw:EL0+A/9nOT1JHmhLLxHgWKLbNw
TLSH
T18F36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-62371.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-62371.exe
Size 4.9MB
SHA256 e32b3d0732e17b1b118e55be275086bc7b630df493c3ff54cafc3d69fbf96d02
MD5 73a6fe834db15891befbc9da7be41bad
SHA1 a9984e115b750825eea6281ae6831879dbe9aed7
SHA512 e04cbfd478c6b4ee00d67174f0dac672818ba349421592a096a87fbd50060d863e563c2dfabda8dbfffc270f613603c45a4cea9fbd380e38dfcc5bd6796e034b
SSDEEP 98304:EL0iZzcCqz9XDWqOIi65LHmD9yM60L79HgWKuu/2UtSNw:EL0+A/9nOI1JHmhLLxHgWKLuNw
TLSH
T1F136E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-6250.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-6250.exe
Size 4.9MB
SHA256 dba72831dd130f76eb4b5556105b5bfe0bffc2fc6aa6e7150655420deb77a25b
MD5 4cd2c499e4e8c044645c7003ca1dbead
SHA1 e3013d365b3b9192b5504b42f13d0c15550b9bd8
SHA512 64750e0f93df9129d564c63f253089b5fe9d37e8e680034b732e0ed5e0cf17bcbdd553399a7abcb2cfdfcae4c61105a5b23a916f73bded91d721f8725c407c4f
SSDEEP 98304:EL0iZzcCqz9XDWqOTi65LHmD9yM60L7MHgWKuu/2UmqNw:EL0+A/9nOT1JHmhLLoHgWKLjNw
TLSH
T15E36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-64745.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-64745.exe
Size 4.9MB
SHA256 70c02750aa45936dd75833bd635afe680770943950fc2cab69106ce4806e75d4
MD5 aad9563c00d9af678f5c17db6f330002
SHA1 44001e33dac22cfc9510efe3d15c0b2419bb6d73
SHA512 a256619fe125326e8b1ce566465039c06fe9288f8952206912d52c52d48c67159172575a769a645975b4b57c6851e9cb2f592c70c31b7c3267b24413e8166401
SSDEEP 98304:ELniZzcCqz9XDWqOTi65LHmD9yM60L79HgWKuu/2UmSNw:ELn+A/9nOT1JHmhLLxHgWKLbNw
TLSH
T14036E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-6527.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-6527.exe
Size 4.9MB
SHA256 40031a615ee7188b399492f2368e647399364e9ecfe85c75dfaf901240c7d255
MD5 5ac4e4d70c6a79d24b742a07b2f56447
SHA1 5cc4acd25332f743d3e4cc59b127ab97c92c6b0c
SHA512 739c1411bdd25935eb1bf2c68cd1a06ff162f875d359d2d654c7b2fdd4192bb8344179e91ec6c297b671356db0a0f1c66a7966ee4a2cbb4b816100e80af607c6
SSDEEP 98304:EL0iZzcCqz9XDWqOTi65LHmD9yMo0L79HgWKuu/nUmSNw:EL0+A/9nOT1JHmh9LxHgWKLUNw
TLSH
T1C036E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-7123.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-7123.exe
Size 4.9MB
SHA256 6018a434b09b80f8ac7d1f95f9f35deb4f5fd8c8963186b1fdc0038ea18d9d8e
MD5 55447e978e27ee093eb618529a42eafa
SHA1 552bf2c429fcf725239190e601ef9844378ad9cd
SHA512 47b0b9b64b1d1fde9c7d229313e9ae60146af03d9d2230f6b67b33ac134a4e73848b598a0d47c62a4552094110adc05efd74bd71038fd89877d4227ef6ad231f
SSDEEP 98304:EL0iZzcCqz9XDWqOTi65LHmD9yM60L79HgWKuu/nUmS5w:EL0+A/9nOT1JHmhLLxHgWKLU5w
TLSH
T15136E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/52-1211-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/260-473-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/352-852-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/408-660-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/672-923-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/908-0-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1052-821-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1188-440-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1204-544-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1232-212-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1456-1147-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1768-1072-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2012-824-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2260-649-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2280-1150-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2432-138-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2616-922-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2620-1066-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2708-1069-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2712-381-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2720-812-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2760-993-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2880-51-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3088-213-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3160-819-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3252-378-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3292-816-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3308-662-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3752-478-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3828-826-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3840-818-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4136-441-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4140-590-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4160-1210-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4260-822-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4304-825-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4356-661-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4400-820-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4420-357-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4540-185-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4544-71-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4632-854-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4668-650-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4680-521-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4736-468-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4840-592-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4872-827-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5088-591-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5092-813-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5104-817-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5260-1149-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5380-450-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5452-648-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5552-572-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5764-1239-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5784-991-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5976-823-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5992-465-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6172-992-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6188-1070-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6516-1208-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6524-1077-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6532-1075-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6540-1065-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6548-1067-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6556-1068-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6676-853-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6708-1204-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6720-1202-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6792-1207-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6800-1276-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6840-1209-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7028-924-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7056-925-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7068-1148-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7104-1203-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7112-1201-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7136-1205-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7152-1206-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7200-1241-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7304-1278-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7312-1152-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7328-1194-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7336-1247-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7348-1195-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7356-1196-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7484-1200-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7884-1277-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7892-1243-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7900-1245-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7908-1246-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7924-1248-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7976-1252-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/8000-1253-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/8076-1254-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/8088-1255-0x0000000000400000-0x0000000000475000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads