kawaiiunicorn | c600e006bde5ec1700598013ba62e39465268060977bdd03cf70a8cd3b343c87

Analysis

max time kernel
17s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 07:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_87fe1bebae9c9e4be71f395e9d46f518_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe
Size 4.9MB
Sample260809-jmkffstbqa
SHA256 c600e006bde5ec1700598013ba62e39465268060977bdd03cf70a8cd3b343c87
MD5 87fe1bebae9c9e4be71f395e9d46f518
SHA1 3e58f4d981ab3afaa6894e5d2c5f3408f9016587
SHA512 5a05f991ac2f3052e1958af991a03a180a0f192da75f9f4ad73ceb25497a2a83417095d27a740ded70e2f2f858253683399b57b42614bf2fd8274a0f4cc972b8
SSDEEP 98304:EEBi/Bc6qzCtDWq/Yi6pLfjDKyM60LJFHgSKuu/nijsDw:EEBci3Mn/Y15fjmTLXHgSKLPDw
TLSH
T14536E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery kawaiiunicorn trojan

Malware Config

Signatures

Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
trojan kawaiiunicorn

Detects KawaiiUnicorn 64 IoCs

resource	yara_rule
behavioral2/memory/4940-0-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1204-104-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1396-193-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4588-192-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5952-271-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5364-280-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2716-270-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1720-384-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5344-382-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1956-381-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4432-405-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2344-420-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3596-403-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4536-539-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5332-565-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3316-670-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4492-572-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4844-571-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3664-566-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6288-917-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6320-921-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6540-920-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7000-986-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6528-919-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6312-918-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6280-916-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3336-1242-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6564-1241-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7008-1238-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6964-1237-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6980-1231-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6972-1175-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6616-1169-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6828-1168-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6864-1172-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6872-1173-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7060-1170-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1312-1171-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7164-1167-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6460-1074-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6352-1073-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6272-1070-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6372-1081-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6672-1079-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6224-1078-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6584-1076-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1076-1355-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6256-1354-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6496-1352-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6808-1351-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/8148-1432-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/8140-1431-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/8128-1430-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/8116-1649-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/8036-1648-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6820-1610-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7860-1609-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6204-1608-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3376-1570-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6260-1569-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6732-1568-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7428-1510-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7608-1509-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6900-1508-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 30 IoCs

resource	yara_rule
behavioral2/files/0x000800000001bc54-6.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x001600000001c5ca-11.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c643-19.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c644-28.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c646-33.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c647-43.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c648-48.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c649-55.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c64a-69.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c64d-78.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c64e-85.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c64b-81.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c64f-98.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c650-106.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c651-116.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c653-120.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c652-128.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c654-136.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c655-137.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c65a-154.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c65b-150.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c658-185.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c65e-197.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c657-182.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c659-169.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c662-233.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c663-231.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c65c-241.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c661-249.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c666-247.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Executes dropped EXE 12 IoCs

pid	Process
3628	Unicorn-1840.exe
1792	Unicorn-3672.exe
4840	Unicorn-34076.exe
4952	Unicorn-18743.exe
4796	Unicorn-14336.exe
2608	Unicorn-14850.exe
4104	Unicorn-8720.exe
3560	Unicorn-57030.exe
3432	Unicorn-42256.exe
5824	Unicorn-53531.exe
4868	Unicorn-59661.exe
4340	Unicorn-39795.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34076.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18743.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14336.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14850.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8720.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53531.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_87fe1bebae9c9e4be71f395e9d46f518_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57030.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42256.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59661.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1840.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3672.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
4940	2026-08-09_87fe1bebae9c9e4be71f395e9d46f518_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe
3628	Unicorn-1840.exe
1792	Unicorn-3672.exe
4840	Unicorn-34076.exe
4952	Unicorn-18743.exe
4796	Unicorn-14336.exe
2608	Unicorn-14850.exe
4104	Unicorn-8720.exe
3560	Unicorn-57030.exe
3432	Unicorn-42256.exe
4868	Unicorn-59661.exe
5824	Unicorn-53531.exe
4340	Unicorn-39795.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 3628	4940	2026-08-09_87fe1bebae9c9e4be71f395e9d46f518_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe	88
PID 3628 wrote to memory of 1792	3628	Unicorn-1840.exe	89
PID 4940 wrote to memory of 4840	4940	2026-08-09_87fe1bebae9c9e4be71f395e9d46f518_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe	90
PID 1792 wrote to memory of 4952	1792	Unicorn-3672.exe	91
PID 3628 wrote to memory of 4796	3628	Unicorn-1840.exe	92
PID 4840 wrote to memory of 2608	4840	Unicorn-34076.exe	93
PID 4940 wrote to memory of 4104	4940	2026-08-09_87fe1bebae9c9e4be71f395e9d46f518_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe	94
PID 4952 wrote to memory of 3560	4952	Unicorn-18743.exe	95
PID 4796 wrote to memory of 3432	4796	Unicorn-14336.exe	97
PID 3628 wrote to memory of 5824	3628	Unicorn-1840.exe	96
PID 2608 wrote to memory of 4868	2608	Unicorn-14850.exe	98
PID 4840 wrote to memory of 4340	4840	Unicorn-34076.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-08-09_87fe1bebae9c9e4be71f395e9d46f518_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_87fe1bebae9c9e4be71f395e9d46f518_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1840.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1840.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3672.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3672.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18743.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57030.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58299.exe
        6⤵
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-69.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-69.exe
        7⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10853.exe
        8⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43534.exe
        9⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63653.exe
        8⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43812.exe
        9⤵
        
        PID:13196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19004.exe
        7⤵
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58578.exe
        8⤵
        
        PID:8740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44253.exe
        9⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47125.exe
        7⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9045.exe
        7⤵
        
        PID:11904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63556.exe
        6⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62503.exe
        7⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46167.exe
        8⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4188.exe
        9⤵
        
        PID:10560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27850.exe
        9⤵
        
        PID:11772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11955.exe
        8⤵
        
        PID:10552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30046.exe
        8⤵
        
        PID:304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43889.exe
        7⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2244.exe
        8⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57077.exe
        9⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-665.exe
        7⤵
        
        PID:7452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36716.exe
        8⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28419.exe
        8⤵
        
        PID:13792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33099.exe
        7⤵
        
        PID:8528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6734.exe
        7⤵
        
        PID:9048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7613.exe
        6⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-905.exe
        7⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24588.exe
        8⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54834.exe
        9⤵
        
        PID:12736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42028.exe
        7⤵
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56718.exe
        8⤵
        
        PID:13852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36245.exe
        6⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4530.exe
        7⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18161.exe
        8⤵
        
        PID:4184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20296.exe
        6⤵
        
        PID:8256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63130.exe
        5⤵
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62590.exe
        6⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34704.exe
        7⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43026.exe
        8⤵
        
        PID:10584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36770.exe
        9⤵
        
        PID:12540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16632.exe
        7⤵
        
        PID:10880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5213.exe
        7⤵
        
        PID:4708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54714.exe
        6⤵
        
        PID:6496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9155.exe
        6⤵
        
        PID:10592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33817.exe
        6⤵
        
        PID:2556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19669.exe
        5⤵
        
        PID:1988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34870.exe
        6⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59203.exe
        7⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39508.exe
        8⤵
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37402.exe
        8⤵
        
        PID:13232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49850.exe
        7⤵
        
        PID:9860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46680.exe
        7⤵
        
        PID:13432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50856.exe
        6⤵
        
        PID:8924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
        7⤵
        
        PID:8076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17771.exe
        5⤵
        
        PID:236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20662.exe
        6⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53066.exe
        7⤵
        
        PID:6704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36865.exe
        6⤵
        
        PID:2736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11698.exe
        5⤵
        
        PID:7164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39004.exe
        6⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49946.exe
        7⤵
        
        PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32934.exe
        5⤵
        
        PID:7652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7925.exe
        5⤵
        
        PID:11860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53046.exe
      4⤵
      PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44812.exe
        5⤵
        
        PID:4176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41424.exe
        6⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61953.exe
        7⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48731.exe
        8⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28003.exe
        9⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27158.exe
        9⤵
        
        PID:12768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63757.exe
        8⤵
        
        PID:10844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58133.exe
        8⤵
        
        PID:13028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31003.exe
        7⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51836.exe
        8⤵
        
        PID:11556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61634.exe
        7⤵
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57771.exe
        7⤵
        
        PID:7828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34303.exe
        6⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54084.exe
        7⤵
        
        PID:6936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59521.exe
        6⤵
        
        PID:8812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29036.exe
        7⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9971.exe
        7⤵
        
        PID:10216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11252.exe
        5⤵
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34211.exe
        6⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46785.exe
        7⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40134.exe
        8⤵
        
        PID:12260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63757.exe
        7⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35873.exe
        7⤵
        
        PID:6348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40624.exe
        6⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6304.exe
        7⤵
        
        PID:12056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27233.exe
        6⤵
        
        PID:10776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50049.exe
        6⤵
        
        PID:8640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19912.exe
        5⤵
        
        PID:1404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46328.exe
        6⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49435.exe
        7⤵
        
        PID:10720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63647.exe
        7⤵
        
        PID:13352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        6⤵
        
        PID:10824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41971.exe
        6⤵
        
        PID:10060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49687.exe
        6⤵
        
        PID:8428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62114.exe
        5⤵
        
        PID:6372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5117.exe
        6⤵
        
        PID:10648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
        6⤵
        
        PID:14252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1013.exe
        5⤵
        
        PID:10856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44123.exe
        5⤵
        
        PID:7368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13820.exe
      4⤵
      PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47594.exe
        5⤵
        
        PID:2032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14745.exe
        6⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42294.exe
        7⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-480.exe
        8⤵
        
        PID:13320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37773.exe
        6⤵
        
        PID:10016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-501.exe
        6⤵
        
        PID:7792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24074.exe
        5⤵
        
        PID:6584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62527.exe
        6⤵
        
        PID:8356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17996.exe
        5⤵
        
        PID:8324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52914.exe
      4⤵
      PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58798.exe
        5⤵
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29214.exe
        6⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47800.exe
        7⤵
        
        PID:9892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32969.exe
        7⤵
        
        PID:3492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47369.exe
        6⤵
        
        PID:9832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2742.exe
        6⤵
        
        PID:12572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24217.exe
        5⤵
        
        PID:9116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62198.exe
        6⤵
        
        PID:12484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35470.exe
      4⤵
      PID:4468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62934.exe
        5⤵
        
        PID:6540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13819.exe
        6⤵
        
        PID:8500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22900.exe
        5⤵
        
        PID:9212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48550.exe
        6⤵
        
        PID:14244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16921.exe
      4⤵
      PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45880.exe
        5⤵
        
        PID:9732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19666.exe
        6⤵
        
        PID:8660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41612.exe
        5⤵
        
        PID:9396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10251.exe
      4⤵
      PID:9008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42256.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19379.exe
        5⤵
        
        PID:1976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3494.exe
        6⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49431.exe
        7⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30890.exe
        8⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27499.exe
        9⤵
        
        PID:8976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30076.exe
        10⤵
        
        PID:13764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50804.exe
        8⤵
        
        PID:9000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56603.exe
        7⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32450.exe
        8⤵
        
        PID:10096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62199.exe
        8⤵
        
        PID:11332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44934.exe
        7⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16817.exe
        8⤵
        
        PID:12744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35391.exe
        7⤵
        
        PID:6380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5793.exe
        6⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7231.exe
        7⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2974.exe
        8⤵
        
        PID:10316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14906.exe
        8⤵
        
        PID:12820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18241.exe
        7⤵
        
        PID:10232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38325.exe
        6⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8578.exe
        7⤵
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51915.exe
        6⤵
        
        PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11340.exe
        5⤵
        
        PID:2280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45290.exe
        6⤵
        
        PID:1124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4719.exe
        7⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14335.exe
        8⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8910.exe
        9⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19937.exe
        8⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-303.exe
        7⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4743.exe
        8⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23231.exe
        9⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2588.exe
        7⤵
        
        PID:9368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41153.exe
        6⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53500.exe
        7⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42215.exe
        8⤵
        
        PID:8220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31266.exe
        7⤵
        
        PID:11248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1913.exe
        7⤵
        
        PID:12584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31225.exe
        6⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38662.exe
        7⤵
        
        PID:10340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51611.exe
        7⤵
        
        PID:12508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33099.exe
        6⤵
        
        PID:10056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51145.exe
        6⤵
        
        PID:12428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21754.exe
        5⤵
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44377.exe
        6⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25470.exe
        7⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51478.exe
        8⤵
        
        PID:1120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15801.exe
        6⤵
        
        PID:8916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18538.exe
        5⤵
        
        PID:7048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57390.exe
        6⤵
        
        PID:10432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8496.exe
        5⤵
        
        PID:10960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63104.exe
      4⤵
      PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17885.exe
        5⤵
        
        PID:1080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59675.exe
        6⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38897.exe
        7⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-810.exe
        8⤵
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35437.exe
        8⤵
        
        PID:8248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8464.exe
        7⤵
        
        PID:10872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53345.exe
        7⤵
        
        PID:12060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38005.exe
        7⤵
        
        PID:13900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52301.exe
        6⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7307.exe
        7⤵
        
        PID:10780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41296.exe
        7⤵
        
        PID:13084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2843.exe
        6⤵
        
        PID:3400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7677.exe
        6⤵
        
        PID:9340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38465.exe
        5⤵
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52052.exe
        6⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50115.exe
        7⤵
        
        PID:11252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51284.exe
        7⤵
        
        PID:12548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45501.exe
        6⤵
        
        PID:10276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13085.exe
        7⤵
        
        PID:9808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49562.exe
        6⤵
        
        PID:7908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4806.exe
        5⤵
        
        PID:1076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-348.exe
        6⤵
        
        PID:9728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23039.exe
        7⤵
        
        PID:12752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62853.exe
        6⤵
        
        PID:11544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10446.exe
        5⤵
        
        PID:10540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59629.exe
        6⤵
        
        PID:13628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9761.exe
        5⤵
        
        PID:1088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11754.exe
      4⤵
      PID:952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21279.exe
        5⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42156.exe
        6⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14779.exe
        7⤵
        
        PID:8780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14457.exe
        6⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57849.exe
        7⤵
        
        PID:13284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43889.exe
        5⤵
        
        PID:2404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44237.exe
        6⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50115.exe
        7⤵
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28582.exe
        7⤵
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16985.exe
        6⤵
        
        PID:9324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42788.exe
        6⤵
        
        PID:13424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47344.exe
        5⤵
        
        PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        5⤵
        
        PID:5604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56075.exe
        5⤵
        
        PID:13200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53878.exe
      4⤵
      PID:4432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63754.exe
        5⤵
        
        PID:2232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14587.exe
        6⤵
        
        PID:8228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34685.exe
        5⤵
        
        PID:6228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19574.exe
        6⤵
        
        PID:11528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53308.exe
        6⤵
        
        PID:11884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5815.exe
      4⤵
      PID:6320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50742.exe
        5⤵
        
        PID:8968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43803.exe
        6⤵
        
        PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34513.exe
      4⤵
      PID:8984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53531.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53531.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44812.exe
      4⤵
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59898.exe
        5⤵
        
        PID:2344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40677.exe
        6⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40348.exe
        7⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21970.exe
        8⤵
        
        PID:13700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33589.exe
        7⤵
        
        PID:11756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54390.exe
        6⤵
        
        PID:9300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41738.exe
        6⤵
        
        PID:12220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5456.exe
        5⤵
        
        PID:6256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30867.exe
        6⤵
        
        PID:9748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36843.exe
        6⤵
        
        PID:12240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36927.exe
        5⤵
        
        PID:9784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30871.exe
        5⤵
        
        PID:12276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53354.exe
      4⤵
      PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3292.exe
        5⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60770.exe
        6⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58630.exe
        7⤵
        
        PID:8884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36045.exe
        8⤵
        
        PID:12564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29174.exe
        6⤵
        
        PID:9864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38379.exe
        6⤵
        
        PID:6708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28014.exe
        5⤵
        
        PID:3336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47639.exe
        6⤵
        
        PID:10692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23879.exe
        6⤵
        
        PID:12400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46050.exe
        5⤵
        
        PID:10492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57757.exe
        5⤵
        
        PID:6108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40127.exe
        5⤵
        
        PID:4992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43348.exe
      4⤵
      PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52597.exe
        5⤵
        
        PID:8140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3135.exe
        6⤵
        
        PID:8788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37239.exe
        5⤵
        
        PID:11132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25205.exe
      4⤵
      PID:7496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14538.exe
        5⤵
        
        PID:14152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61952.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61952.exe
    3⤵
    PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1548.exe
      4⤵
      PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47044.exe
        5⤵
        
        PID:4200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12752.exe
        6⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        7⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26322.exe
        8⤵
        
        PID:11160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5384.exe
        8⤵
        
        PID:13740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46328.exe
        6⤵
        
        PID:8148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50975.exe
        6⤵
        
        PID:10404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64519.exe
        6⤵
        
        PID:12524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58616.exe
        5⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60654.exe
        6⤵
        
        PID:9816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50522.exe
        7⤵
        
        PID:13648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40050.exe
        6⤵
        
        PID:6716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19194.exe
        5⤵
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44601.exe
        6⤵
        
        PID:13656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13901.exe
        5⤵
        
        PID:6688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36664.exe
      4⤵
      PID:2772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63754.exe
        5⤵
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60856.exe
        6⤵
        
        PID:8380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17772.exe
        7⤵
        
        PID:8216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25505.exe
        5⤵
        
        PID:940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8430.exe
        5⤵
        
        PID:6376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42357.exe
      4⤵
      PID:6272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2003.exe
        5⤵
        
        PID:9388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58508.exe
        6⤵
        
        PID:12376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4260.exe
      4⤵
      PID:9568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25661.exe
      4⤵
      PID:6404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46780.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46780.exe
    3⤵
    PID:2716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18840.exe
      4⤵
      PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30205.exe
        5⤵
        
        PID:6476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47800.exe
        6⤵
        
        PID:9916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45437.exe
        6⤵
        
        PID:11896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17135.exe
        5⤵
        
        PID:9152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56760.exe
        6⤵
        
        PID:14260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56525.exe
      4⤵
      PID:6564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2678.exe
        5⤵
        
        PID:10668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63647.exe
        5⤵
        
        PID:6892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29578.exe
      4⤵
      PID:10736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17710.exe
      4⤵
      PID:12352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28485.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28485.exe
    3⤵
    PID:3208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29582.exe
      4⤵
      PID:2040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25270.exe
        5⤵
        
        PID:7428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48162.exe
        6⤵
        
        PID:9336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54512.exe
        6⤵
        
        PID:13288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30493.exe
        5⤵
        
        PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44402.exe
        5⤵
        
        PID:13328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39337.exe
      4⤵
      PID:4628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2899.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2899.exe
    3⤵
    PID:6172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53508.exe
      4⤵
      PID:6884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54151.exe
        5⤵
        
        PID:6772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4043.exe
      4⤵
      PID:11220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50385.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50385.exe
    3⤵
    PID:8756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10366.exe
      4⤵
      PID:13776
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34076.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34076.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14850.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14850.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59661.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62217.exe
        5⤵
        
        PID:2276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31206.exe
        6⤵
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33910.exe
        7⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39001.exe
        8⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32845.exe
        9⤵
        
        PID:11124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5989.exe
        8⤵
        
        PID:11180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19840.exe
        8⤵
        
        PID:12776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64252.exe
        7⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16164.exe
        7⤵
        
        PID:10364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25153.exe
        7⤵
        
        PID:11464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43894.exe
        6⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9431.exe
        7⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42559.exe
        8⤵
        
        PID:9144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51719.exe
        8⤵
        
        PID:12728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55615.exe
        7⤵
        
        PID:10748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23467.exe
        6⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7421.exe
        7⤵
        
        PID:10504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63719.exe
        7⤵
        
        PID:8084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64494.exe
        6⤵
        
        PID:10888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58706.exe
        6⤵
        
        PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35844.exe
        5⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44631.exe
        6⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53209.exe
        7⤵
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21796.exe
        8⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52200.exe
        7⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62858.exe
        8⤵
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41257.exe
        6⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13243.exe
        7⤵
        
        PID:7508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49819.exe
        8⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46669.exe
        7⤵
        
        PID:10920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14085.exe
        7⤵
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31918.exe
        6⤵
        
        PID:8460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54424.exe
        7⤵
        
        PID:14008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42175.exe
        5⤵
        
        PID:4240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64714.exe
        6⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21277.exe
        7⤵
        
        PID:8036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4829.exe
        8⤵
        
        PID:8432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28443.exe
        7⤵
        
        PID:11164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65346.exe
        7⤵
        
        PID:13008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25422.exe
        6⤵
        
        PID:8764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe
        6⤵
        
        PID:11276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20593.exe
        5⤵
        
        PID:6556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45776.exe
        6⤵
        
        PID:8452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26150.exe
        5⤵
        
        PID:9692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42208.exe
        5⤵
        
        PID:12232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42351.exe
      4⤵
      PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14781.exe
        5⤵
        
        PID:2424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54771.exe
        6⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59203.exe
        7⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37239.exe
        7⤵
        
        PID:10816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54881.exe
        7⤵
        
        PID:11828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58915.exe
        6⤵
        
        PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43889.exe
        5⤵
        
        PID:2184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19131.exe
        6⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9025.exe
        7⤵
        
        PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52881.exe
        5⤵
        
        PID:7244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12149.exe
        6⤵
        
        PID:7440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55306.exe
        6⤵
        
        PID:4448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13804.exe
      4⤵
      PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43500.exe
        5⤵
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64972.exe
        6⤵
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30497.exe
        6⤵
        
        PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63695.exe
        5⤵
        
        PID:10896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59733.exe
        6⤵
        
        PID:2956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13573.exe
        5⤵
        
        PID:11388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47807.exe
      4⤵
      PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49149.exe
        5⤵
        
        PID:4788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15598.exe
        5⤵
        
        PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43037.exe
      4⤵
      PID:3852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30491.exe
        5⤵
        
        PID:9440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51223.exe
      4⤵
      PID:2796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39795.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39795.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62217.exe
      4⤵
      PID:436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19935.exe
        5⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37278.exe
        6⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55620.exe
        7⤵
        
        PID:8820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33206.exe
        6⤵
        
        PID:8236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8559.exe
        5⤵
        
        PID:6616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54302.exe
        6⤵
        
        PID:9616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38249.exe
        6⤵
        
        PID:12268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58499.exe
        5⤵
        
        PID:8736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56369.exe
      4⤵
      PID:4348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56271.exe
        5⤵
        
        PID:6188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11245.exe
        6⤵
        
        PID:9400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36102.exe
        7⤵
        
        PID:12076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53381.exe
        7⤵
        
        PID:14160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25801.exe
        5⤵
        
        PID:9360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57624.exe
      4⤵
      PID:6312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38433.exe
        5⤵
        
        PID:6888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22080.exe
      4⤵
      PID:6472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36635.exe
        5⤵
        
        PID:13640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56087.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56087.exe
    3⤵
    PID:5072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14563.exe
      4⤵
      PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36214.exe
        5⤵
        
        PID:3940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9727.exe
        6⤵
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22325.exe
        6⤵
        
        PID:6092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48818.exe
        6⤵
        
        PID:12556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5321.exe
        5⤵
        
        PID:7036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57381.exe
      4⤵
      PID:4088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19767.exe
        5⤵
        
        PID:4716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1825.exe
      4⤵
      PID:8540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59799.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59799.exe
    3⤵
    PID:1956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4335.exe
      4⤵
      PID:2840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31352.exe
        5⤵
        
        PID:6748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34074.exe
        6⤵
        
        PID:10176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8944.exe
        7⤵
        
        PID:13684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40050.exe
        6⤵
        
        PID:4584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22952.exe
        5⤵
        
        PID:10204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-501.exe
        5⤵
        
        PID:2932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42103.exe
      4⤵
      PID:6828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65319.exe
        5⤵
        
        PID:7708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56065.exe
      4⤵
      PID:8712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36635.exe
        5⤵
        
        PID:14144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47128.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47128.exe
    3⤵
    PID:4664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16557.exe
      4⤵
      PID:6528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44904.exe
        5⤵
        
        PID:8960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36360.exe
        6⤵
        
        PID:4248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24353.exe
      4⤵
      PID:6184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50522.exe
        5⤵
        
        PID:14136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60904.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60904.exe
    3⤵
    PID:7000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52278.exe
      4⤵
      PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52961.exe
        5⤵
        
        PID:12308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18081.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18081.exe
    3⤵
    PID:8872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16952.exe
      4⤵
      PID:13840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49580.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49580.exe
    3⤵
    PID:3580
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8720.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8720.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49747.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49747.exe
    3⤵
    PID:4688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44812.exe
      4⤵
      PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7682.exe
        5⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27086.exe
        6⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34346.exe
        7⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61588.exe
        8⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39931.exe
        9⤵
        
        PID:14128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32314.exe
        7⤵
        
        PID:9908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36334.exe
        8⤵
        
        PID:9960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19795.exe
        7⤵
        
        PID:11324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11465.exe
        6⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18117.exe
        7⤵
        
        PID:7376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56823.exe
        7⤵
        
        PID:13020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60305.exe
        6⤵
        
        PID:10452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41454.exe
        5⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44844.exe
        6⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58578.exe
        7⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12727.exe
        8⤵
        
        PID:12660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54281.exe
        6⤵
        
        PID:9604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50082.exe
        7⤵
        
        PID:11564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23650.exe
        7⤵
        
        PID:13724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50828.exe
        6⤵
        
        PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49508.exe
        5⤵
        
        PID:3376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18340.exe
        6⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63713.exe
        7⤵
        
        PID:8412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31370.exe
        5⤵
        
        PID:7144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50986.exe
        5⤵
        
        PID:3324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60910.exe
        5⤵
        
        PID:12856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53354.exe
      4⤵
      PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46904.exe
        5⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24838.exe
        6⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59750.exe
        7⤵
        
        PID:864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37635.exe
        5⤵
        
        PID:6816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2958.exe
        6⤵
        
        PID:9968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21228.exe
        7⤵
        
        PID:7548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44275.exe
        5⤵
        
        PID:8368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17710.exe
        5⤵
        
        PID:12048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57302.exe
      4⤵
      PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4683.exe
        5⤵
        
        PID:7192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47800.exe
        6⤵
        
        PID:9884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22645.exe
        6⤵
        
        PID:11708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50877.exe
        5⤵
        
        PID:10512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48466.exe
      4⤵
      PID:7176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8739.exe
        5⤵
        
        PID:9596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61824.exe
        6⤵
        
        PID:8696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41475.exe
      4⤵
      PID:8824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58047.exe
      4⤵
      PID:11504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42351.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42351.exe
    3⤵
    PID:4588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59794.exe
      4⤵
      PID:4164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4252.exe
        5⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48072.exe
        6⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40709.exe
        7⤵
        
        PID:13748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64401.exe
        6⤵
        
        PID:4112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33852.exe
        5⤵
        
        PID:6672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8739.exe
        6⤵
        
        PID:8300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41971.exe
        5⤵
        
        PID:7448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61217.exe
        6⤵
        
        PID:9508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16916.exe
        5⤵
        
        PID:12784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17251.exe
      4⤵
      PID:5784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16256.exe
        5⤵
        
        PID:6948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1069.exe
        6⤵
        
        PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20674.exe
        5⤵
        
        PID:7160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6309.exe
        6⤵
        
        PID:11572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53459.exe
        5⤵
        
        PID:7068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62642.exe
      4⤵
      PID:6972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25330.exe
        5⤵
        
        PID:8384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5725.exe
        5⤵
        
        PID:13304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13300.exe
      4⤵
      PID:1112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46762.exe
      4⤵
      PID:5852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64162.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64162.exe
    3⤵
    PID:3732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4065.exe
      4⤵
      PID:1136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4693.exe
        5⤵
        
        PID:4224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42867.exe
        6⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63581.exe
        7⤵
        
        PID:10572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58103.exe
        7⤵
        
        PID:8904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58018.exe
        6⤵
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15818.exe
        6⤵
        
        PID:11328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52200.exe
        5⤵
        
        PID:7700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41257.exe
      4⤵
      PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51144.exe
        5⤵
        
        PID:7860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10410.exe
        5⤵
        
        PID:10608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29061.exe
      4⤵
      PID:7540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34348.exe
        5⤵
        
        PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50236.exe
        5⤵
        
        PID:8088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33099.exe
      4⤵
      PID:8320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54243.exe
      4⤵
      PID:12516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43759.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43759.exe
    3⤵
    PID:6064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62161.exe
      4⤵
      PID:7928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52180.exe
        5⤵
        
        PID:9940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
        5⤵
        
        PID:5548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32506.exe
      4⤵
      PID:10528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3760.exe
      4⤵
      PID:11300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26261.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26261.exe
    3⤵
    PID:7520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13799.exe
      4⤵
      PID:10928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5583.exe
      4⤵
      PID:13096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7898.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7898.exe
    3⤵
    PID:2496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-606.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-606.exe
    3⤵
    PID:12760
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18755.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18755.exe
  2⤵
  PID:1204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
    3⤵
    PID:1396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31118.exe
      4⤵
      PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40485.exe
        5⤵
        
        PID:6604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1946.exe
        6⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61850.exe
        7⤵
        
        PID:6896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56554.exe
        5⤵
        
        PID:8312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34561.exe
        6⤵
        
        PID:6412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14781.exe
      4⤵
      PID:3192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32888.exe
        5⤵
        
        PID:7920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53846.exe
        6⤵
        
        PID:11192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13498.exe
        5⤵
        
        PID:10932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19710.exe
        5⤵
        
        PID:12472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5434.exe
      4⤵
      PID:8056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29788.exe
      4⤵
      PID:1564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32499.exe
      4⤵
      PID:5476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15336.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15336.exe
    3⤵
    PID:1720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26894.exe
      4⤵
      PID:5500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51279.exe
        5⤵
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11816.exe
        6⤵
        
        PID:9588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38567.exe
        7⤵
        
        PID:11520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52962.exe
        6⤵
        
        PID:6648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11598.exe
        5⤵
        
        PID:3220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18566.exe
        6⤵
        
        PID:13784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-85.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-85.exe
      4⤵
      PID:6820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59528.exe
        5⤵
        
        PID:10480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1389.exe
        5⤵
        
        PID:12008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17046.exe
      4⤵
      PID:11236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21296.exe
      4⤵
      PID:13076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21941.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21941.exe
    3⤵
    PID:3888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36164.exe
      4⤵
      PID:7492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49072.exe
        5⤵
        
        PID:4156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7371.exe
        5⤵
        
        PID:2552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10487.exe
      4⤵
      PID:10644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33251.exe
      4⤵
      PID:12532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58580.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58580.exe
    3⤵
    PID:6128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24433.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24433.exe
    3⤵
    PID:2724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42414.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42414.exe
    3⤵
    PID:9204
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22275.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22275.exe
  2⤵
  PID:5364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25659.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25659.exe
    3⤵
    PID:3664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1455.exe
      4⤵
      PID:6988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63269.exe
        5⤵
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51518.exe
        6⤵
        
        PID:9584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21468.exe
      4⤵
      PID:6268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
        5⤵
        
        PID:14016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28014.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28014.exe
    3⤵
    PID:6224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61640.exe
      4⤵
      PID:10188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62173.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62173.exe
    3⤵
    PID:9684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26713.exe
      4⤵
      PID:8496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22766.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22766.exe
    3⤵
    PID:7564
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44598.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44598.exe
  2⤵
  PID:5416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33633.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33633.exe
    3⤵
    PID:10220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20699.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20699.exe
    3⤵
    PID:12168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42927.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42927.exe
    3⤵
    PID:9108
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40173.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40173.exe
  2⤵
  PID:9576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-117.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-117.exe
    3⤵
    PID:13876
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49777.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49777.exe
  2⤵
  PID:7900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-11340.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-11340.exe
Size 4.9MB
SHA256 26924c857ef5efdbd12b91a36146bfb5d3907dfa4385c61a243b3f43b93e8300
MD5 3e79749896499a9a15f84424e5dc478f
SHA1 8da5a3e4a651c1fe97d14257cfae43d5e8146f56
SHA512 9993ab9cd821ce8e4ef966441f9d505ae7cbc1799d3e3a3428b2850259fcce24ec1e9a797a2897dfbb95a55466f50c89d633172689606fdb06aa2599d6861d3b
SSDEEP 98304:EEBi/Bc6qzCtDWq/Yi6pLfjDKyM60LQFHgSbuu/nijsNw:EEBci3Mn/Y15fjmTL2HgSbLPNw
TLSH
T12B36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-11754.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-11754.exe
Size 4.9MB
SHA256 456ccfdeeece0a81cfa380ca9abce7e3fbd6a92a08ea3fb87bf2a86c73b07a48
MD5 24c7226aa90fb4ef20eb2a9632d30c0e
SHA1 8dbe3f60f72529a14eacef520a48f2867758d892
SHA512 07d49c993df3ab3d0bf9da43c4744f0a26cd30569e6115a5c3de98cd0221aa8411c78d5eae85e6979ed9264f436f37ceea612d15104920d3a0881e39cdf919ff
SSDEEP 98304:EEBi/Bc6qzCtDWq/Yi6pLfjDKyM60LIFHgSKu7/nijsNw:EEBci3Mn/Y15fjmTLeHgSKePNw
TLSH
T12E36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-13820.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-13820.exe
Size 4.9MB
SHA256 703d3f5bff2639a75a5645d14a71f4ef99f8929bc61d2e9cec73523edbc5a085
MD5 50a135f65b352baae86d7b39e37b527c
SHA1 2ed7b358e77b0ffdab700a55a3f22a00e149c979
SHA512 64be73dd032c5aff6cfe694a04a547a381f8269942ea3eb314a49f6b1b2579372e28a4ff8355f724fca985bb6823dc3ac3f87993a8c7130f0baea05ce4946189
SSDEEP 98304:EEBi/Bc6qzCtDWq/Yi6pLfJDKyM60LJFHgSKuu/nijsNw:EEBci3Mn/Y15fJmTLXHgSKLPNw
TLSH
T1F336E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-14336.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
Size 4.9MB
SHA256 1e740a4843908887df2a9eff93d4fe563a70e09f2fc378be87e4accc42963ead
MD5 fb550b47d41d762dd05d42bfb039b006
SHA1 cd094779f735458d12c187e58070a1052d197dab
SHA512 8068cbfbf4518afa57f0692425692bc697bcd300718b5de6b4431a4fdddc5eb9d23e5d0721d1e7e6a64df6378d3a3cc23cc279dd7756f8a74454a58e98c43614
SSDEEP 98304:EEBi/Bc6qzCtDWq/Yi6pLfjDKyM60LIFHgSKuu/nijsNw:EEBci3Mn/Y15fjmTLeHgSKLPNw
TLSH
T18336E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-14850.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-14850.exe
Size 4.9MB
SHA256 8ea1b8363afa0836bc545a2ddacacd535c6ba907170f207865986fc167e516d4
MD5 a093c7c36e1fd6ea42d62a7014a73cad
SHA1 81b3d2d50ec89a81652edb807d792082fcf1cfbb
SHA512 b593c900b288c2526f55f314f8072b52f9c6003d3d341e10f68b02677147f01c8d6b1a385dc9508b5ab95e3ad6506462694a5ed55c0bfa05f5c572a3b6702ce6
SSDEEP 98304:EEBi/Bc6qzCtDWq/Yi6pLfjDKyM60LJFHgSKuu/niIuDw:EEBci3Mn/Y15fjmTLXHgSKL4Dw
TLSH
T11336E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-17885.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-17885.exe
Size 4.9MB
SHA256 7ddbc2ed26ca2f38a6442e3ea0bd2c74b21fe03423859c03282ded8d3d0c2d38
MD5 4dde3334841321f63c5283fa7a49eabd
SHA1 3bd4d2bae701c68eabae44f31df342d0a8b82042
SHA512 a8482fadc695c77a7d0ca40ec1764831749440eba2d19ef6c028330fa1240524e574691e9a804c1a5e8b6f56114e2cdd08f671b6da0a723d77563975d507a948
SSDEEP 98304:EEBi/Bc6qzCtDWq/Yi6OLfjDKyM60LIFHgSKuu/nijsNw:EEBci3Mn/Y1MfjmTLeHgSKLPNw
TLSH
T11D36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-1840.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-1840.exe
Size 4.9MB
SHA256 ff6ea6f7d4e879be0c3c3cc1f0e8e3b8fb52d928b4f6d157179a108b2f64318f
MD5 08206dac7070352e75e9b1937f861f79
SHA1 ff18aeb8387cf5d88b1d7d2be0b9a4984747ee6e
SHA512 4be1067496d8cc012b0954f516a00baa3eb9f55f4e73ea6879cd54f50833e74f98719865aa125673dea26fcbc23a55fb5db2427a7ffa6974e54b59f79d1f001c
SSDEEP 98304:EEBi/Bc6qzCtDWq/Yi6pLfjDKyM60LJFHgSKuu/nijsNw:EEBci3Mn/Y15fjmTLXHgSKLPNw
TLSH
T11D36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-18743.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-18743.exe
Size 4.9MB
SHA256 c9031942319a342b3d4f2266b0145ce3e40fd47c54b8bc37e096f9d883801cf8
MD5 a0f02abfec445154300c5094cab63903
SHA1 47089ac4f8fa9ac2907e9db44c3bd173f53a3f11
SHA512 5be1cbae1107ff7abd60c1a884222cd398d801d088d2d0f58c737d8fdae7a30978464ba4488a3e80c9a134271ac3586b09c62001c4868dbe72f94fdb97702053
SSDEEP 98304:EEBi/Bk6qzCtDWq/Yi6pLfjDKyM60LJFHgSKuu/nijsNw:EEBca3Mn/Y15fjmTLXHgSKLPNw
TLSH
T18136E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-18755.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-18755.exe
Size 4.9MB
SHA256 c670f36a88b9dbe83aba38673488638f00242a9e6c88ce37e914b65f1840c1bb
MD5 2a63e8b5abae04a293389799b47c17b1
SHA1 b49a0bacc045a8e4f65214aac8102eb4f7a3e7cd
SHA512 2383df5203476ee4787daaebde27346cd4ae8528adc8f4e87a9b1e2e37c0dde3339f067f5341afd96d395ae118118caa6d79a68278ea1145152ef9c548b685b5
SSDEEP 98304:EEBi/Bc6qzCtDWq/Yi6pLfjDKyM70LJFHgSKuu/nijsDw:EEBci3Mn/Y15fjm6LXHgSKLPDw
TLSH
T1F536E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-19379.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-19379.exe
Size 4.9MB
SHA256 c4558c82837ca7d59fd375de2089b9f1366213bf23ab58d79ddc5af8e5eaab79
MD5 bda014b93b252e12e9fa1b112aeef26d
SHA1 2ba1a6d2c4a2144a2f5814c5d6f07efb6fe9853a
SHA512 8e366b0fc7da5aa39f422aaf7bfed836f44dc6be05164f2a246a79fce0f920187a5bcafd772e5ded5658dd4faf12c288c2aee34d4f44147ba25615c491a7ddd6
SSDEEP 98304:EEBi/Bc6qzCtDWq/Yi6pLfGDKyM60LIFHgSbuu/nijsNw:EEBci3Mn/Y15fGmTLeHgSbLPNw
TLSH
T16F36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-34076.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-34076.exe
Size 4.9MB
SHA256 2f0a76453e525d4b17848796ee25c079261a507785133cde374370e0aaeb3ba0
MD5 b2ed052824644510c0ad72d42096d42d
SHA1 27931d19fd3b3ee0aff20ef37e3c09f04b3e180b
SHA512 df625a79267ff181341c303e39ea95ef1fdbb241691eea544f144e864a33be272655683835802d51a2b3f7d45dc7e978c112e8322011304596b87293c60648a1
SSDEEP 98304:EEBi/Bc6qzCtDWq/Yi6pLfjDKyM60LJFHgSKuu/nijuDw:EEBci3Mn/Y15fjmTLXHgSKL9Dw
TLSH
T1A736E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-35844.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-35844.exe
Size 4.9MB
SHA256 29165caa1bfc7fd398d18fcf6dc3a202eed4bdb31caf4c7ac59d739b5aaf2d0d
MD5 2b2ece9abaa9263197eb7332081d672e
SHA1 598e6ef042c8ccf2fc527745cb36d33dba28cfb0
SHA512 ffa18d10125bbb32b357b2cb5cf7d1fe33f21fc6cc608dfeaa2d3f68c2755acd8207f2f114228cf0a03fa5c312349bd6943bebaa26dc3ec08c0cfd7d09af1689
SSDEEP 98304:EEBi/Bc66zCtDWq/Yi6pLfjDKyM60LJFHgSKuu/niIufw:EEBcinMn/Y15fjmTLXHgSKL4fw
TLSH
T1BA36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-3672.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-3672.exe
Size 4.9MB
SHA256 b69bbeb49d05ddca2ac9efb701dda54362354c82d608f8a6f90763396d575ee2
MD5 550820a01286dbc9bc88a1fe14cd0279
SHA1 13c14d0b8208936c98c1591c77bcef2b570ed6e5
SHA512 89c15e14a4ea4daaca4d7d789b4a50ae628566297038d6b7f6c436a0515dc12c9afc519b6ed0ca2f78b81b108d47e62004b815c5a109f1213e3b72b9cb06d3c9
SSDEEP 98304:EEBi/Bc6qzCtDWq/Yi6pLfjDKyM60LJFHgSKuu/nijsNw:EEBci3Mn/Y15fjmTLXHgSKLPNw
TLSH
T19236E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-39795.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-39795.exe
Size 4.9MB
SHA256 e61a4d9c301779d17b04855d762c48051e7c321638e2c82387a96b230e2b3538
MD5 adcdd4e4a5b7d07160447b285d8e9cb8
SHA1 8fec8fc638efc9b4d7e04b26d11b46d189ff0e8a
SHA512 7ebe246a97172849c9f14c8d8e067d07da2a843b9b81976442fcab5c5f89108b9481d9391ce6153f1d5f144cd4d2ceeeda5af158b3730ead60ed8875e8dd6a21
SSDEEP 98304:EEBi/Bc6qzCtDWq/Yi6pLfjDKyM60LJFHg3Kuu/nijuDw:EEBci3Mn/Y15fjmTLXHg3KL9Dw
TLSH
T1BD36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-42256.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42256.exe
Size 4.9MB
SHA256 8b81116379355e12590aefabe94be8135ee86cd83aaf2b07b65099016bec1705
MD5 f6eec59c38180290876b84274f49de4d
SHA1 c73fd92c96a66a1430de593195376e5417a200a4
SHA512 d62faadd1baccf3d76da6032923afe58844b26fef3e059793c89cf3c1d2e662287b47c7692fdb3af7b94b7fb8b948325a11ae9baf91f2af07d1ac487ccb99a84
SSDEEP 98304:EEBi/Bc6qzCtDWq/Yi6pLfjDKyM60LIFHgSbuu/nijsNw:EEBci3Mn/Y15fjmTLeHgSbLPNw
TLSH
T10136E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-42351.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42351.exe
Size 4.9MB
SHA256 12697fe1f31cb1437820472cd4368e4582d24cd0e4803fb888ba49a424236971
MD5 e5964e54a19a1398ced35575a2894f27
SHA1 b48b88c734cba0b129b845b83f3bf0dcd28446c3
SHA512 8b35a8b4e27dfe86d39719eb051848ec24c6a9205849afcae2b3c926e332c5e3449475e6f3e4450e321c9a4f4d5a51deb0f7cc0d9f3e368a65e4346eeb1ec6a9
SSDEEP 98304:EEBi/Bc6qzCtDWq/Yi6pLfjDKyMU0LJCHgSKuu/nijsDw:EEBci3Mn/Y15fjmRLEHgSKLPDw
TLSH
T12E36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-44812.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-44812.exe
Size 4.9MB
SHA256 b2ee87f6a922ec2e79300cfa69b81ee8cf44b6533c46ecb02b4cb969762a1886
MD5 7e7eeb709c98504dec11171ab7d3fb93
SHA1 a07971a664502e14d6a0ad379da811827b198395
SHA512 a9429bc19a0379c02d2620b21b1663e312c0b3d0184265903142b6f6efac6977c98a1b4fa34517304504839a2dbbdd4398e29971d55fcf5f9e7c7464c86b1d0d
SSDEEP 98304:EEBi/Bc6qzCtDWq/Yi6pLfjDKyM60L0FHgSKu3/nijsNw:EEBci3Mn/Y15fjmTL6HgSKKPNw
TLSH
T12136E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-49747.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-49747.exe
Size 4.9MB
SHA256 21c9e9b1714c2a468947ddf2e88e836b9aed5163a7cd6872ed246168f9212d23
MD5 bbdcef95676523f974ae0e13b1a31542
SHA1 3003feae4d21d3640ef7d019f1e9292678507fa4
SHA512 b607dee398b9a9af78a2e6ffa055c51ae92c09b59b570d9a0affe0b1dd41355bc8c9ab070e0a2b7f49b108a019d9e2231d0345dca72d2b550dca34090fa03e59
SSDEEP 98304:EEBi/Bc6qzCtDWq/Yi6pLfjDKyM60LJUHgSKuu/nijsDw:EEBci3Mn/Y15fjmTLSHgSKLPDw
TLSH
T1A636E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-53046.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-53046.exe
Size 4.9MB
SHA256 ac5c2ca7342c88ef1f3a87b1f4b2eb8165ae60001cb3085aa4052c32d3759d04
MD5 ed17c8338da65b1987bffd3671a270e7
SHA1 b0fe123e2cfebf0a2772bce90731fe14e5c581ff
SHA512 5c6392d2e3e4ddaf1ca08dffbf72fad18e4d90a27b79c4a32f0e45a477fbb11cb4bbc94853a6ebac008b30b7d4768d1435c7031424b5a83eae7ddea35276e847
SSDEEP 98304:EEBi/Bc6qzCtDWq/Yi6pLfjDKyM60LlFHgSKuu/nijsNw:EEBci3Mn/Y15fjmTLTHgSKLPNw
TLSH
T13A36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-53531.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-53531.exe
Size 4.9MB
SHA256 a2a5367be4dac8bf402ac8ba9ca1389af422131c46fc37e7d9ac62837a04c858
MD5 46d70ccf3d6123f250e8a9f02fcd322b
SHA1 e7d334d619a66bdfe1ee8869d633c0c4219792aa
SHA512 bbe97d4d234c2910ac8bea461c1a5d69dca0f8a976d41ffa754f64f9610c0be981c9ed69c92e08577004f94f30b75322621c0f8560a2e7b9e32849777c911e19
SSDEEP 98304:EEBi/Bc6qzCtDWq/Yi6pLfjDKyM60L0FHgSKuu/nijsNw:EEBci3Mn/Y15fjmTL6HgSKLPNw
TLSH
T1DA36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-56087.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-56087.exe
Size 4.9MB
SHA256 d4284372f87cd33b51947f21fee6f4f7c53f54902e7a62c01fae03ebedc8d0b3
MD5 2c5bb0e38f25af43f692fd0417427788
SHA1 46506110d7b662837e854106a356a330f2a6acd4
SHA512 ac54667e353b9c8ca0ab86ea2f8b5756c65db40315b0437f5228bb10dde180379f41d4a5e7b2b1aa7ce9a2298c44dfc2438112396c472dc58b9c3d0b049f9ea9
SSDEEP 98304:EEpi/Bc6qzCtDWq/Yi6pLfjDKyM60LJFHgSKuu/nijuDw:EEpci3Mn/Y15fjmTLXHgSKL9Dw
TLSH
T11D36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-57030.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-57030.exe
Size 4.9MB
SHA256 21e06ea7f8702f5a6463acaab2413b0f9759072bcf2f230219be48645aab9ff1
MD5 ac4dde293826210aba0fa11ced3a96ab
SHA1 0df1e606319ef8861f590b3b09015f751adbbd98
SHA512 a45a1e9c217e15b48b2c9c26636cf73d32304161a374aa62bd47ab0cee700a3cb385c11ecf40e35090071505e68bb0b959853929f54d4efb92d668b12a01e267
SSDEEP 98304:EEBi/Bk6qzCtDWq/Yi6pLfjDKyM60LJFHgSKu7/nijsNw:EEBca3Mn/Y15fjmTLXHgSK+PNw
TLSH
T1BE36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-58299.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-58299.exe
Size 4.9MB
SHA256 c961eebb85345a8b3658e13e980c94233e72af408605c053a48abad2613827ca
MD5 a4f0088fae280a02d8728f63d23fdcc8
SHA1 f3c470e2b4e428422c7eebff2483ac26e8cea688
SHA512 0b2ded53db9ddf524cb47f601f0ed01002b049616b1bf731932c9356c1d3fa52f9a82de75684c8d3b5d33b3ea9b98265a3cd15b07c88df8b29b5b055e1ad35a3
SSDEEP 98304:EEBi/Bk6qzCtDWq/Yi6pLfjDKyM60LJFHgSKu7inijsNw:EEBca3Mn/Y15fjmTLXHgSK+QNw
TLSH
T15936E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-59661.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-59661.exe
Size 4.9MB
SHA256 6f05f308bdad583fa825df135b4019708a0b885306d9b52a71a1732edc6b860b
MD5 aa37c258a86ee8f071d93539cc62ee2a
SHA1 99a0be910bf31875d35f8f8dee0a7b5b7df83ac5
SHA512 6094f5f59c7d52bff438ec5da7e4116709750f22698b4c56df15a588548f765bce6b2936a3c96db9a775e643c0d9ecf28ea60b28092091ffed49925959219676
SSDEEP 98304:EEBi/Bc66zCtDWq/Yi6pLfjDKyM60LJFHgSKuu/niIuDw:EEBcinMn/Y15fjmTLXHgSKL4Dw
TLSH
T16136E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-61952.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-61952.exe
Size 4.9MB
SHA256 141049dcc5ff5c1808b883f61e2791c30ea5c4e19612a4ab082d06e008c6c5a6
MD5 63bb33cae2b94182cd5d154df9f8d1d5
SHA1 6390ef9f235f5fc94464d573bbca2f83af24c184
SHA512 256f2f2a147e294222ac4ee19c56db5e7b53956bff2b8b07cadf4ffed7136f1dd32a71280b9310c9bf50a05ac333e4e689f729ca105707a7c305baa1a1fe589d
SSDEEP 98304:EEBi/Bc6qzCtDWq/8i6pLfjDKyM60LJFHgSKuu/nijsNw:EEBci3Mn/815fjmTLXHgSKLPNw
TLSH
T11C36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-62217.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-62217.exe
Size 4.9MB
SHA256 9f6cf5e539dcadf5eec5dd0da25b9e3c32fa7bda443b419319f47dfbeb7db080
MD5 9fceab9488a7eeb6a8af0545d10a05ac
SHA1 cb58ca8d3636ed2c920ca665bf0a0279d5baecdf
SHA512 91144766d0bc5301fbfa465a5ac71839e530b708cc05037a9b4669b6f25f19123653d1fd7c556d066640c9d7b6658a0a15281c42a8c4243f838169f27d8929b5
SSDEEP 98304:EEBi/Bc6qzCtDWq/Yi6pLfjDKyM60LJFHg3KuH/nijuDw:EEBci3Mn/Y15fjmTLXHg3KK9Dw
TLSH
T10636E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-63104.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-63104.exe
Size 4.9MB
SHA256 569512391abca9f19e10e828f6a3e8576a076e98609ecfe5bbc568b81d258898
MD5 70951275cd594a64688c773a1d2d8468
SHA1 4418117ad766986139adc9c935f14264e4fd545d
SHA512 eeb2fa71abf76b4149c7e809c0a070b2cd4b6efedaec66ceac54984c8bc4237a12340e09bca0ff421a73ed9b33076e72d709aeedd7f47cfb910f28dcd965c361
SSDEEP 98304:EEBi/Bc6qzCtDWq/Yi6OLfjDKyM60LIFHgSKuu/nijsNw:EEBci3Mn/Y1MfjmTLeHgSKLPNw
TLSH
T14736E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-63130.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-63130.exe
Size 4.9MB
SHA256 98f1a755175a9a7ca1eca9c73d71d714b9e8953db48ead0957bc21d5409e2c76
MD5 753919f3a544a4b1cff09954f9942e17
SHA1 9dead27a77e20d47d79602ef4a63c151b747fcf5
SHA512 2aac04457b3f5f112405f678bb4777f1816be41a658fe2f6bda9afc9b7761af1bde89e1ee610e6dfe5f0bea9094b3b5c1cf737a92dacb766520cd251623662c6
SSDEEP 98304:EEEi/Bk6qzCtDWq/Yi6pLfjDKyM60LJFHgSKuu/nijsNw:EEEca3Mn/Y15fjmTLXHgSKLPNw
TLSH
T18936E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-8657.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
Size 4.9MB
SHA256 f141c89e54dc1efbfc87671fd10326a4b124e9fa8da8ecab2ccd6b737dda1569
MD5 0ced864c8a2432119ab8af3fbf3e7958
SHA1 a8df6fb1a566e88eb6f74adc5df8fd95b943bf9f
SHA512 9758d3ee15604b1599e3db25a7777cedb81f1658ec3a621cac651d71e909ba7ad1d4f8dbba0dc1e19545e12e57d2ed5dbe9c89423704262134f893f927f69d17
SSDEEP 98304:EEFi/Bc6qzCtDWq/Yi6pLfjDKyM70LJFHgSKuu/nijsDw:EEFci3Mn/Y15fjm6LXHgSKLPDw
TLSH
T19E36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-8720.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-8720.exe
Size 4.9MB
SHA256 bd87a6f6ce27dcd2c08b8755ae473b6df0a8886436e58ac6642ea809f9848fb4
MD5 4b48074965444dd3ce670933021dcc8f
SHA1 646f6af613ba794ba3bc27e24ce761d371c9f9cc
SHA512 b36c3d98662c9dea464b51c5fec90a576213e6a9afd99968ee65f8cbf53167e44876f6777f1066dfe865e83f5da14bd5998a59a19c801410da3f4d9a5991edc4
SSDEEP 98304:EEBi/Bc6qzCtDWq/Yi6pLfjDKyM60LJCHgSKuu/nijsDw:EEBci3Mn/Y15fjmTLEHgSKLPDw
TLSH
T19A36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1076-1355-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1204-104-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1312-1171-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1396-193-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1588-1276-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1720-384-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1956-381-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2344-420-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2716-270-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3316-670-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3336-1242-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3372-1275-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3376-1570-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3596-403-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3664-566-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4080-1349-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4432-405-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4492-572-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4536-539-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4588-192-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4844-571-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4940-0-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5332-565-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5344-382-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5364-280-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5600-1344-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5904-1350-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5952-271-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6204-1608-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6212-1356-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6224-1078-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6256-1354-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6260-1569-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6272-1070-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6280-916-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6288-917-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6312-918-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6320-921-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6352-1073-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6372-1081-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6440-1475-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6444-1473-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6460-1074-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6488-1427-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6496-1352-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6528-919-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6540-920-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6564-1241-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6580-1279-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6584-1076-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6616-1169-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6624-1291-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6672-1079-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6732-1568-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6784-1277-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6796-1287-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6808-1351-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6816-1286-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6820-1610-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6828-1168-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6864-1172-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6872-1173-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6900-1508-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6920-1474-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6964-1237-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6972-1175-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6980-1231-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7000-986-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7008-1238-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7044-1289-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7048-1272-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7060-1170-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7132-1472-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7164-1167-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7176-1345-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7192-1428-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7212-1476-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7388-1471-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7428-1510-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7492-1498-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7508-1495-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7520-1497-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7540-1496-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7608-1509-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7860-1609-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7920-1493-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7928-1429-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/8036-1648-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/8056-1470-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/8096-1477-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/8108-1494-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/8116-1649-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/8128-1430-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/8140-1431-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/8148-1432-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/8164-1469-0x0000000000400000-0x0000000000475000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads