kawaiiunicorn | 88d79d57e3a1853c060933a3cded217941e0c5ad554b67ea3f882a22a66483a5

Analysis

max time kernel
148s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 20:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_e769be52ca9d1b7875e6afe6561dfff1_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe
Size 4.9MB
Sample260809-zhbkravgrh
SHA256 88d79d57e3a1853c060933a3cded217941e0c5ad554b67ea3f882a22a66483a5
MD5 e769be52ca9d1b7875e6afe6561dfff1
SHA1 bb742eb64bd85f1c1d78b69c5c57faa9bc6a8874
SHA512 2f6985f56642db52e7ff7df1894d5c13c98899d5115e9efd8b199b2373a8d8796993b3e15f43c52bc388050370e29144781ef7a36f7ce8a2b7eff316b8fedc84
SSDEEP 98304:EPcFsQcCqzCtDWq/di6pLz7ZKyMc0W2qHgWWuu/nJmHqw:EPcmP/Mn/d15z7gpWDHgWWL+qw
TLSH
T19336E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery kawaiiunicorn trojan

Malware Config

Signatures

Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
trojan kawaiiunicorn

Detects KawaiiUnicorn 64 IoCs

resource	yara_rule
behavioral2/memory/3676-0-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4108-17-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5716-31-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5740-75-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4220-144-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4852-241-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4552-305-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3920-319-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1936-339-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4632-337-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2484-341-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5940-335-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5704-340-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3900-358-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4740-414-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5576-444-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5728-501-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5668-566-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5048-475-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3296-555-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5744-678-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4424-721-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4396-723-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6176-884-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2016-885-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6788-919-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6072-942-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6796-1011-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6552-1010-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6528-1000-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7120-998-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7080-997-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6780-996-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7016-995-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6284-994-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6312-993-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6924-941-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1812-940-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6932-922-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6880-921-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2432-918-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6988-914-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6536-883-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5440-799-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7160-1092-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6596-1140-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7816-1128-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7420-1127-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/8060-1139-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6376-1126-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7124-1152-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6984-1156-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7052-1125-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7240-1124-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6892-1123-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7256-1122-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7248-1121-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6832-1120-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6748-1119-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6412-1118-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4452-1091-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2192-800-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1560-722-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5952-679-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 27 IoCs

resource	yara_rule
behavioral2/files/0x0003000000008f2c-6.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000e00000001c4e0-11.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4e3-20.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4e4-30.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4e5-33.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4e6-44.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4e7-50.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4e8-57.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4eb-72.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4ea-78.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4e9-82.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4ed-88.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4ec-89.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4f2-124.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4f5-114.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4ee-126.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4f1-153.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4f3-135.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4f4-133.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4f7-134.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4ef-162.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4f8-168.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4f0-171.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4f6-170.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4fc-180.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4fb-191.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4f9-221.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Executes dropped EXE 13 IoCs

pid	Process
1568	Unicorn-29861.exe
4108	Unicorn-6015.exe
3256	Unicorn-540.exe
5716	Unicorn-53161.exe
5684	Unicorn-2569.exe
3884	Unicorn-39155.exe
4588	Unicorn-8027.exe
620	Unicorn-18782.exe
5996	Unicorn-4483.exe
5740	Unicorn-10613.exe
3696	Unicorn-13882.exe
3856	Unicorn-12258.exe
5348	Unicorn-14951.exe

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8027.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4483.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10613.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13882.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_e769be52ca9d1b7875e6afe6561dfff1_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2569.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39155.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18782.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12258.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14951.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29861.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53161.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3676	2026-08-09_e769be52ca9d1b7875e6afe6561dfff1_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe
1568	Unicorn-29861.exe
4108	Unicorn-6015.exe
3256	Unicorn-540.exe
5684	Unicorn-2569.exe
5716	Unicorn-53161.exe
3884	Unicorn-39155.exe
4588	Unicorn-8027.exe
620	Unicorn-18782.exe
5996	Unicorn-4483.exe
5740	Unicorn-10613.exe
3696	Unicorn-13882.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 1568	3676	2026-08-09_e769be52ca9d1b7875e6afe6561dfff1_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe	88
PID 1568 wrote to memory of 4108	1568	Unicorn-29861.exe	89
PID 3676 wrote to memory of 3256	3676	2026-08-09_e769be52ca9d1b7875e6afe6561dfff1_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe	90
PID 4108 wrote to memory of 5716	4108	Unicorn-6015.exe	91
PID 1568 wrote to memory of 5684	1568	Unicorn-29861.exe	92
PID 3256 wrote to memory of 3884	3256	Unicorn-540.exe	93
PID 3676 wrote to memory of 4588	3676	2026-08-09_e769be52ca9d1b7875e6afe6561dfff1_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe	94
PID 5684 wrote to memory of 620	5684	Unicorn-2569.exe	95
PID 5716 wrote to memory of 5740	5716	Unicorn-53161.exe	97
PID 1568 wrote to memory of 5996	1568	Unicorn-29861.exe	96
PID 4108 wrote to memory of 3696	4108	Unicorn-6015.exe	98
PID 3884 wrote to memory of 3856	3884	Unicorn-39155.exe	99
PID 3256 wrote to memory of 5348	3256	Unicorn-540.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-08-09_e769be52ca9d1b7875e6afe6561dfff1_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_e769be52ca9d1b7875e6afe6561dfff1_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29861.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29861.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6015.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6015.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53161.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10613.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63296.exe
        6⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8698.exe
        7⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19903.exe
        8⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5294.exe
        9⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58177.exe
        10⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60268.exe
        9⤵
        
        PID:8336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34906.exe
        9⤵
        
        PID:11272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5095.exe
        10⤵
        
        PID:11088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23254.exe
        8⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46309.exe
        9⤵
        
        PID:8832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51338.exe
        10⤵
        
        PID:13296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61794.exe
        9⤵
        
        PID:11844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37218.exe
        10⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46080.exe
        9⤵
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8466.exe
        8⤵
        
        PID:8724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61298.exe
        7⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27421.exe
        8⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47373.exe
        9⤵
        
        PID:10576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50423.exe
        8⤵
        
        PID:8504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62043.exe
        8⤵
        
        PID:11780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5194.exe
        7⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16268.exe
        8⤵
        
        PID:9228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26511.exe
        8⤵
        
        PID:9364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17154.exe
        7⤵
        
        PID:9096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22651.exe
        7⤵
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36964.exe
        6⤵
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55268.exe
        7⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17054.exe
        8⤵
        
        PID:256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17996.exe
        9⤵
        
        PID:10448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32857.exe
        8⤵
        
        PID:10964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54253.exe
        8⤵
        
        PID:13872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63523.exe
        7⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56288.exe
        7⤵
        
        PID:9584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6316.exe
        6⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7624.exe
        7⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61721.exe
        7⤵
        
        PID:9704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60147.exe
        6⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
        7⤵
        
        PID:9072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26463.exe
        6⤵
        
        PID:9212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51011.exe
        7⤵
        
        PID:1308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65475.exe
        6⤵
        
        PID:1304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13773.exe
        5⤵
        
        PID:2244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-530.exe
        6⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21849.exe
        7⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24153.exe
        8⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8478.exe
        9⤵
        
        PID:10544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17466.exe
        9⤵
        
        PID:14308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38093.exe
        8⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53296.exe
        7⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57487.exe
        8⤵
        
        PID:10560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40517.exe
        8⤵
        
        PID:13860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20033.exe
        7⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7975.exe
        8⤵
        
        PID:13592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9718.exe
        7⤵
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47914.exe
        7⤵
        
        PID:11512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23472.exe
        6⤵
        
        PID:600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49534.exe
        7⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20487.exe
        8⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57191.exe
        8⤵
        
        PID:10376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22302.exe
        7⤵
        
        PID:7840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64503.exe
        8⤵
        
        PID:10776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1431.exe
        8⤵
        
        PID:13836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1881.exe
        7⤵
        
        PID:10496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4852.exe
        7⤵
        
        PID:6464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31727.exe
        6⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11114.exe
        7⤵
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41904.exe
        8⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43755.exe
        7⤵
        
        PID:12140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23801.exe
        7⤵
        
        PID:13700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29407.exe
        6⤵
        
        PID:8256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30840.exe
        6⤵
        
        PID:13496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19637.exe
        5⤵
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16670.exe
        6⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51758.exe
        7⤵
        
        PID:10524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60076.exe
        6⤵
        
        PID:9492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3516.exe
        6⤵
        
        PID:3092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11823.exe
        5⤵
        
        PID:2192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22573.exe
        6⤵
        
        PID:9828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-898.exe
        5⤵
        
        PID:3564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58033.exe
        5⤵
        
        PID:4492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13882.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54370.exe
        5⤵
        
        PID:3612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7567.exe
        6⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10473.exe
        7⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49918.exe
        8⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61493.exe
        9⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40596.exe
        10⤵
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36557.exe
        8⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48143.exe
        7⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32241.exe
        8⤵
        
        PID:10184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31483.exe
        7⤵
        
        PID:9312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44162.exe
        7⤵
        
        PID:12148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31147.exe
        6⤵
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4116.exe
        7⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15385.exe
        8⤵
        
        PID:10568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36147.exe
        7⤵
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32981.exe
        7⤵
        
        PID:11344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19283.exe
        6⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56252.exe
        7⤵
        
        PID:9428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38057.exe
        7⤵
        
        PID:2868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56672.exe
        6⤵
        
        PID:2328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5247.exe
        5⤵
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49534.exe
        6⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8919.exe
        7⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19086.exe
        8⤵
        
        PID:10476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56252.exe
        8⤵
        
        PID:12368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36277.exe
        7⤵
        
        PID:10312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40776.exe
        6⤵
        
        PID:7736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50964.exe
        7⤵
        
        PID:10656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12313.exe
        7⤵
        
        PID:13024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64403.exe
        6⤵
        
        PID:10300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13932.exe
        6⤵
        
        PID:14008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54802.exe
        5⤵
        
        PID:1652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62235.exe
        6⤵
        
        PID:10224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27257.exe
        5⤵
        
        PID:10292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28932.exe
        5⤵
        
        PID:7652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26439.exe
      4⤵
      PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16613.exe
        5⤵
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24563.exe
        6⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51270.exe
        7⤵
        
        PID:10120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6132.exe
        6⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50693.exe
        6⤵
        
        PID:10272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42221.exe
        5⤵
        
        PID:5836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33668.exe
        6⤵
        
        PID:10508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54415.exe
        6⤵
        
        PID:12952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19867.exe
        5⤵
        
        PID:7172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37482.exe
        5⤵
        
        PID:12216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9903.exe
      4⤵
      PID:1868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58579.exe
        5⤵
        
        PID:2016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65297.exe
        6⤵
        
        PID:5556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4316.exe
        6⤵
        
        PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50263.exe
        5⤵
        
        PID:9456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60859.exe
        5⤵
        
        PID:2360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13570.exe
      4⤵
      PID:6224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39916.exe
        5⤵
        
        PID:9500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22579.exe
      4⤵
      PID:10000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2569.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2569.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18782.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51044.exe
        5⤵
        
        PID:1460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8698.exe
        6⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34978.exe
        7⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17054.exe
        8⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5598.exe
        9⤵
        
        PID:9288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54041.exe
        8⤵
        
        PID:10068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45999.exe
        8⤵
        
        PID:12960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35973.exe
        7⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59770.exe
        7⤵
        
        PID:10972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20265.exe
        6⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45258.exe
        7⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11436.exe
        8⤵
        
        PID:9452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34502.exe
        7⤵
        
        PID:9888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37073.exe
        6⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29719.exe
        7⤵
        
        PID:9860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58224.exe
        7⤵
        
        PID:796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36890.exe
        6⤵
        
        PID:8760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54370.exe
        5⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26919.exe
        6⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34869.exe
        7⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41449.exe
        8⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33263.exe
        9⤵
        
        PID:9444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45889.exe
        9⤵
        
        PID:11252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3936.exe
        8⤵
        
        PID:10188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56202.exe
        7⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30056.exe
        8⤵
        
        PID:9592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11078.exe
        8⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3697.exe
        7⤵
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60481.exe
        7⤵
        
        PID:2340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16949.exe
        6⤵
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4993.exe
        7⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30056.exe
        8⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29925.exe
        7⤵
        
        PID:9044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56946.exe
        7⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12531.exe
        7⤵
        
        PID:14124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21421.exe
        6⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59438.exe
        7⤵
        
        PID:8520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58146.exe
        7⤵
        
        PID:11944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49334.exe
        6⤵
        
        PID:1044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1328.exe
        5⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13462.exe
        6⤵
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-232.exe
        7⤵
        
        PID:7892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32852.exe
        7⤵
        
        PID:10584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43070.exe
        7⤵
        
        PID:14168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61555.exe
        6⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38863.exe
        7⤵
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8067.exe
        6⤵
        
        PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5029.exe
        5⤵
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30056.exe
        6⤵
        
        PID:9132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28224.exe
        5⤵
        
        PID:8416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54139.exe
        5⤵
        
        PID:11912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31178.exe
      4⤵
      PID:864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16613.exe
        5⤵
        
        PID:1980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24755.exe
        6⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4500.exe
        7⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22983.exe
        8⤵
        
        PID:7376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55292.exe
        8⤵
        
        PID:7656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22250.exe
        7⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2976.exe
        7⤵
        
        PID:11940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34663.exe
        6⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56013.exe
        7⤵
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32532.exe
        8⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40880.exe
        7⤵
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32332.exe
        6⤵
        
        PID:6048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56973.exe
        6⤵
        
        PID:776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19087.exe
        5⤵
        
        PID:3216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20404.exe
        6⤵
        
        PID:7380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21612.exe
        6⤵
        
        PID:9268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23510.exe
        5⤵
        
        PID:7420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45412.exe
        6⤵
        
        PID:7400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63771.exe
        5⤵
        
        PID:9744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10482.exe
      4⤵
      PID:4164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12694.exe
        5⤵
        
        PID:2992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57977.exe
        6⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5354.exe
        7⤵
        
        PID:10792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5276.exe
        6⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59631.exe
        7⤵
        
        PID:11664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15997.exe
        5⤵
        
        PID:7220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13631.exe
        6⤵
        
        PID:11100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17466.exe
        6⤵
        
        PID:14316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57906.exe
        5⤵
        
        PID:10200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34353.exe
        5⤵
        
        PID:2908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43156.exe
      4⤵
      PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51947.exe
        5⤵
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30549.exe
        6⤵
        
        PID:8108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36604.exe
        6⤵
        
        PID:12256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29925.exe
        5⤵
        
        PID:8952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33640.exe
        5⤵
        
        PID:13580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22596.exe
      4⤵
      PID:6996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3050.exe
        5⤵
        
        PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28264.exe
      4⤵
      PID:9252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46642.exe
        5⤵
        
        PID:8032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57437.exe
      4⤵
      PID:12296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13592.exe
      4⤵
      PID:14100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4483.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4483.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33639.exe
      4⤵
      PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8698.exe
        5⤵
        
        PID:2600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34018.exe
        6⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62533.exe
        7⤵
        
        PID:252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33310.exe
        8⤵
        
        PID:10236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20080.exe
        7⤵
        
        PID:9148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9526.exe
        7⤵
        
        PID:1952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48060.exe
        6⤵
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29833.exe
        7⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44171.exe
        7⤵
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46962.exe
        7⤵
        
        PID:6288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46261.exe
        6⤵
        
        PID:7248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19723.exe
        6⤵
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48993.exe
        6⤵
        
        PID:5284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10068.exe
        5⤵
        
        PID:2484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28647.exe
        6⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46361.exe
        7⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63714.exe
        8⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24431.exe
        9⤵
        
        PID:10468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24108.exe
        8⤵
        
        PID:11172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60268.exe
        7⤵
        
        PID:8768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55410.exe
        7⤵
        
        PID:11460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18135.exe
        6⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16590.exe
        7⤵
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35348.exe
        6⤵
        
        PID:7560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58780.exe
        5⤵
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21530.exe
        6⤵
        
        PID:7476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37684.exe
        5⤵
        
        PID:8424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62833.exe
        5⤵
        
        PID:11908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26744.exe
        5⤵
        
        PID:9440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54370.exe
      4⤵
      PID:5816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60250.exe
        5⤵
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3924.exe
        6⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35915.exe
        7⤵
        
        PID:10140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42058.exe
        7⤵
        
        PID:9764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47186.exe
        6⤵
        
        PID:8268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24022.exe
        5⤵
        
        PID:6880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39895.exe
        6⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31831.exe
        7⤵
        
        PID:9564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35364.exe
        7⤵
        
        PID:14268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25670.exe
        6⤵
        
        PID:10424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46593.exe
        5⤵
        
        PID:7960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62605.exe
        5⤵
        
        PID:13656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20378.exe
      4⤵
      PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57894.exe
        5⤵
        
        PID:6560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3776.exe
        5⤵
        
        PID:8260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48415.exe
        5⤵
        
        PID:9812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53545.exe
      4⤵
      PID:6552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39792.exe
      4⤵
      PID:8640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33374.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33374.exe
    3⤵
    PID:4220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8698.exe
      4⤵
      PID:1836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64744.exe
        5⤵
        
        PID:1936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28647.exe
        6⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22399.exe
        7⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65058.exe
        8⤵
        
        PID:7928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60268.exe
        7⤵
        
        PID:8696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61030.exe
        7⤵
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33835.exe
        6⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27171.exe
        7⤵
        
        PID:11092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9919.exe
        6⤵
        
        PID:8796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4697.exe
        5⤵
        
        PID:4584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56174.exe
        6⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30954.exe
        7⤵
        
        PID:10440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57492.exe
        6⤵
        
        PID:472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11149.exe
        5⤵
        
        PID:6268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28951.exe
        6⤵
        
        PID:11384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11254.exe
        5⤵
        
        PID:9300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1328.exe
      4⤵
      PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19192.exe
        5⤵
        
        PID:5596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50694.exe
        6⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25801.exe
        7⤵
        
        PID:10516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15821.exe
        7⤵
        
        PID:10020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50149.exe
        6⤵
        
        PID:11116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53963.exe
        5⤵
        
        PID:8264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38278.exe
      4⤵
      PID:6368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50606.exe
        5⤵
        
        PID:9660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17274.exe
        5⤵
        
        PID:9304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43793.exe
      4⤵
      PID:8972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6116.exe
      4⤵
      PID:8276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48777.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48777.exe
    3⤵
    PID:5504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63675.exe
      4⤵
      PID:4132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49944.exe
        5⤵
        
        PID:5112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15299.exe
        6⤵
        
        PID:7108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50009.exe
        6⤵
        
        PID:8436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5548.exe
        5⤵
        
        PID:3212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51374.exe
        6⤵
        
        PID:10432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60921.exe
        5⤵
        
        PID:9052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35231.exe
      4⤵
      PID:2400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58470.exe
        5⤵
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37835.exe
        6⤵
        
        PID:10640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52644.exe
        5⤵
        
        PID:10164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48256.exe
      4⤵
      PID:6924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56553.exe
        5⤵
        
        PID:9820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28265.exe
        5⤵
        
        PID:12292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25899.exe
      4⤵
      PID:8680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30902.exe
      4⤵
      PID:2028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8635.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8635.exe
    3⤵
    PID:5040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14147.exe
      4⤵
      PID:1416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15442.exe
        5⤵
        
        PID:7256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37451.exe
        6⤵
        
        PID:10092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7637.exe
        5⤵
        
        PID:10532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47684.exe
      4⤵
      PID:7816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20223.exe
        5⤵
        
        PID:1236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57906.exe
      4⤵
      PID:9184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50672.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50672.exe
    3⤵
    PID:2724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6589.exe
      4⤵
      PID:7124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3159.exe
        5⤵
        
        PID:9516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30548.exe
      4⤵
      PID:10172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31204.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31204.exe
    3⤵
    PID:8120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59843.exe
      4⤵
      PID:10056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41790.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41790.exe
    3⤵
    PID:10664
- C:\Users\Admin\AppData\Local\Temp\Unicorn-540.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-540.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39155.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39155.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12258.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33639.exe
        5⤵
        
        PID:2912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56830.exe
        6⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47100.exe
        7⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37090.exe
        8⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53299.exe
        9⤵
        
        PID:8356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49880.exe
        10⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26983.exe
        9⤵
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53419.exe
        10⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56261.exe
        8⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31317.exe
        8⤵
        
        PID:10404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41266.exe
        7⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51763.exe
        8⤵
        
        PID:460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36464.exe
        8⤵
        
        PID:11292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45291.exe
        8⤵
        
        PID:12556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41467.exe
        7⤵
        
        PID:8820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48417.exe
        7⤵
        
        PID:11392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23389.exe
        6⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62087.exe
        7⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25497.exe
        8⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21634.exe
        9⤵
        
        PID:9880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14752.exe
        9⤵
        
        PID:8380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53408.exe
        8⤵
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54448.exe
        7⤵
        
        PID:1368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36417.exe
        7⤵
        
        PID:10144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51873.exe
        6⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33473.exe
        7⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36687.exe
        7⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46962.exe
        7⤵
        
        PID:14324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46096.exe
        6⤵
        
        PID:6892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32547.exe
        6⤵
        
        PID:9280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36263.exe
        7⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32457.exe
        6⤵
        
        PID:11604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        5⤵
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43421.exe
        6⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47671.exe
        7⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22080.exe
        8⤵
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21960.exe
        8⤵
        
        PID:11196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59951.exe
        8⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40086.exe
        7⤵
        
        PID:8420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33702.exe
        7⤵
        
        PID:11368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7829.exe
        6⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21292.exe
        7⤵
        
        PID:13976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4621.exe
        6⤵
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4757.exe
        6⤵
        
        PID:12196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13197.exe
        5⤵
        
        PID:2004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20461.exe
        6⤵
        
        PID:6128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38773.exe
        6⤵
        
        PID:10784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33640.exe
        6⤵
        
        PID:13792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60814.exe
        5⤵
        
        PID:8936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11487.exe
        5⤵
        
        PID:11520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57721.exe
        6⤵
        
        PID:11736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43810.exe
        5⤵
        
        PID:6572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13773.exe
      4⤵
      PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4360.exe
        5⤵
        
        PID:700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48081.exe
        6⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23310.exe
        7⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3460.exe
        8⤵
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4815.exe
        9⤵
        
        PID:14052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26682.exe
        8⤵
        
        PID:9092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9059.exe
        7⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12727.exe
        7⤵
        
        PID:12804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60128.exe
        6⤵
        
        PID:7700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7226.exe
        6⤵
        
        PID:10728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24131.exe
        5⤵
        
        PID:3396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8291.exe
        6⤵
        
        PID:9792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31690.exe
        6⤵
        
        PID:11496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49224.exe
        5⤵
        
        PID:7300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3543.exe
        6⤵
        
        PID:10076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11612.exe
        5⤵
        
        PID:10612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38407.exe
        5⤵
        
        PID:12612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23803.exe
      4⤵
      PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43997.exe
        5⤵
        
        PID:4816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20487.exe
        6⤵
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1763.exe
        7⤵
        
        PID:10672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26272.exe
        6⤵
        
        PID:10392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48607.exe
        6⤵
        
        PID:14332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32224.exe
        5⤵
        
        PID:7204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10917.exe
        6⤵
        
        PID:10552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46998.exe
        5⤵
        
        PID:10716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37510.exe
      4⤵
      PID:3496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57051.exe
        5⤵
        
        PID:6596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12671.exe
        6⤵
        
        PID:10416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27533.exe
        5⤵
        
        PID:9728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33237.exe
      4⤵
      PID:7416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64970.exe
        5⤵
        
        PID:9816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27252.exe
      4⤵
      PID:11200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14951.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14951.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32570.exe
      4⤵
      PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16613.exe
        5⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51205.exe
        6⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4500.exe
        7⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43486.exe
        8⤵
        
        PID:8512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19744.exe
        8⤵
        
        PID:11400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58612.exe
        8⤵
        
        PID:13720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62182.exe
        7⤵
        
        PID:9628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10917.exe
        7⤵
        
        PID:12632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe
        6⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25505.exe
        7⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36246.exe
        7⤵
        
        PID:10284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46080.exe
        7⤵
        
        PID:14080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50293.exe
        6⤵
        
        PID:1364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15003.exe
        5⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37173.exe
        6⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19257.exe
        7⤵
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11716.exe
        7⤵
        
        PID:1092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47186.exe
        6⤵
        
        PID:936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37073.exe
        5⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14451.exe
        6⤵
        
        PID:9872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40799.exe
        5⤵
        
        PID:10024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44879.exe
      4⤵
      PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14832.exe
        5⤵
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31509.exe
        6⤵
        
        PID:10208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54140.exe
        6⤵
        
        PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48234.exe
        5⤵
        
        PID:6848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59205.exe
        6⤵
        
        PID:13688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58176.exe
        5⤵
        
        PID:10724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47072.exe
        5⤵
        
        PID:11140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23092.exe
      4⤵
      PID:2256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61851.exe
        5⤵
        
        PID:10320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43138.exe
      4⤵
      PID:7836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31738.exe
        5⤵
        
        PID:11060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41178.exe
      4⤵
      PID:3068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9034.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9034.exe
    3⤵
    PID:996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16613.exe
      4⤵
      PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26893.exe
        5⤵
        
        PID:3736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38250.exe
        6⤵
        
        PID:7856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60476.exe
        6⤵
        
        PID:12156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18083.exe
        5⤵
        
        PID:9468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60283.exe
        5⤵
        
        PID:13704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17141.exe
      4⤵
      PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51563.exe
        5⤵
        
        PID:6072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49921.exe
        6⤵
        
        PID:9696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63953.exe
        6⤵
        
        PID:6304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11451.exe
        5⤵
        
        PID:4156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59631.exe
      4⤵
      PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13823.exe
        5⤵
        
        PID:10804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7160.exe
        5⤵
        
        PID:13608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18240.exe
      4⤵
      PID:9800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16347.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16347.exe
    3⤵
    PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41283.exe
      4⤵
      PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8400.exe
        5⤵
        
        PID:6496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23362.exe
        6⤵
        
        PID:10488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55904.exe
        5⤵
        
        PID:10108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15202.exe
      4⤵
      PID:10384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33421.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33421.exe
    3⤵
    PID:3336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31727.exe
      4⤵
      PID:8100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3159.exe
        5⤵
        
        PID:9320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12842.exe
      4⤵
      PID:10748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12151.exe
      4⤵
      PID:4376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63713.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63713.exe
    3⤵
    PID:8944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49968.exe
      4⤵
      PID:13052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-151.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-151.exe
    3⤵
    PID:13040
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8027.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8027.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37723.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37723.exe
    3⤵
    PID:2384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16613.exe
      4⤵
      PID:988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14832.exe
        5⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64643.exe
        6⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10917.exe
        7⤵
        
        PID:10112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21040.exe
        6⤵
        
        PID:9788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59168.exe
        5⤵
        
        PID:7240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40466.exe
        6⤵
        
        PID:10592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35348.exe
        5⤵
        
        PID:10100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6150.exe
      4⤵
      PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38079.exe
        5⤵
        
        PID:10132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43111.exe
      4⤵
      PID:7908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6039.exe
        5⤵
        
        PID:10648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28265.exe
        5⤵
        
        PID:13868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58374.exe
      4⤵
      PID:10812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62284.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62284.exe
    3⤵
    PID:3308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48574.exe
      4⤵
      PID:1332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42417.exe
        5⤵
        
        PID:7536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2033.exe
        5⤵
        
        PID:2588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40942.exe
      4⤵
      PID:7296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13.exe
      4⤵
      PID:12184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13663.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13663.exe
    3⤵
    PID:4424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60559.exe
      4⤵
      PID:6376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8675.exe
        5⤵
        
        PID:7360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4955.exe
        6⤵
        
        PID:6204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7440.exe
        5⤵
        
        PID:2876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64512.exe
      4⤵
      PID:9372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63673.exe
        5⤵
        
        PID:4228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22162.exe
      4⤵
      PID:4328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17315.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17315.exe
    3⤵
    PID:6856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34654.exe
      4⤵
      PID:10980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47623.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47623.exe
    3⤵
    PID:8588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9428.exe
      4⤵
      PID:13900
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20052.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20052.exe
  2⤵
  PID:2180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6564.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6564.exe
    3⤵
    PID:3404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27150.exe
      4⤵
      PID:8360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41685.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41685.exe
    3⤵
    PID:7480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41178.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41178.exe
    3⤵
    PID:2068
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34324.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34324.exe
  2⤵
  PID:3920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52959.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52959.exe
    3⤵
    PID:5980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26099.exe
      4⤵
      PID:6780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17934.exe
        5⤵
        
        PID:10736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59869.exe
        5⤵
        
        PID:7784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36687.exe
      4⤵
      PID:8660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30233.exe
        5⤵
        
        PID:13848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51793.exe
      4⤵
      PID:2488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-279.exe
      4⤵
      PID:852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38604.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38604.exe
    3⤵
    PID:6908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61467.exe
      4⤵
      PID:8888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18841.exe
      4⤵
      PID:10276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53356.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53356.exe
    3⤵
    PID:10156
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19133.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19133.exe
  2⤵
  PID:5048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50556.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50556.exe
    3⤵
    PID:7016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37446.exe
      4⤵
      PID:11412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50423.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50423.exe
    3⤵
    PID:1268
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64761.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64761.exe
  2⤵
  PID:2920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18297.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18297.exe
    3⤵
    PID:1448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17959.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17959.exe
    3⤵
    PID:1772
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50202.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50202.exe
  2⤵
  PID:8648
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6150.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6150.exe
  2⤵
  PID:1768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-10613.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-10613.exe
Size 4.9MB
SHA256 e76f721f9a0137a27d0ecc9ee2d6550d3f5b6bf78c4d35d71d5e15a83d731778
MD5 76d5af06ba01d965a4b16beaf18cc16d
SHA1 5b840d81bcc6850d507b46e332bf854a2aae7a51
SHA512 b1e6a9c0f58c89272345f44797bb6bcf61d32831460ee7eeb501345bfc8fe01760949cf650d883ac3ecae4dc0faf2bbd6e1a2d65ee54a436d5db537586567370
SSDEEP 98304:eP8FsQcCqzCtDWq/di6LLz7ZKyMc0W2qHg/Wuu/nJmHqw:eP8mP/Mn/d1Hz7gpWDHg/WL+qw
TLSH
T18436E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-12258.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-12258.exe
Size 4.9MB
SHA256 1d3deb3a64075e4799b51c0765da6a54607cc66aca5d1be401de2b5b84134ba3
MD5 ffbd95cbdde3b0fe18b70b471b22532e
SHA1 155dd8b04b5f34759a22608dc6c75ad86816afe9
SHA512 fb3d50cb540d14fddd11c343e82b87e95cd1c469648f5cad148795d507aaacc11ef29837f29266ff0d4cb6a8e35cd035d837970933d2408c4d0a8dfb68844bd0
SSDEEP 98304:EPDFsQcCqzCtDWq/di6pLzkZKyMT0W2qHgWWuu/nJmHqw:EPDmP/Mn/d15zkgGWDHgWWL+qw
TLSH
T17B36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-13773.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-13773.exe
Size 4.9MB
SHA256 995132f78751d25b38b14afc4fd614cd7386e40acb5045c641400f534b1fc209
MD5 8b90ed4805af203f19e39158be9b3393
SHA1 57887f3ad1ad3dd323ddf5958d776dd9467fd5ec
SHA512 c3431e09b437d1e2adeca07664fd8e4a1fce0e13a431ab31ffacb0f2878213a02d60b3bb73a9e4ab07e7f3e9c2111d845bfa41b9ce8676ca916b955ac5667555
SSDEEP 98304:ePcFsQcCqzCtDWq/di6LLz7ZKyMc0WXqHg/Wuu/nJmHqw:ePcmP/Mn/d1Hz7gpWaHg/WL+qw
TLSH
T1A136E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-13882.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-13882.exe
Size 4.9MB
SHA256 69355d0684b4305b43a7df862b487390275e8b4125856cd1609ba736db9ad0a3
MD5 2dca429fdd98cf95fb66cecb6e1dbc15
SHA1 beb99587c3bf34e10546335191af3d055be3a242
SHA512 7d6915058a231d7612940932b32704a5e7292a915387ab7ccb1d85eb93d560e836d75aea6b2febf3f8e50e2843d5a7c3b096dcb9c01bf93bb9e025f1edf33b86
SSDEEP 98304:ePcFsQcCqzCtDWq/di6LLz7ZKyMc0WpqHgWWuu/nJmHqw:ePcmP/Mn/d1Hz7gpW4HgWWL+qw
TLSH
T1B436E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-14951.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-14951.exe
Size 4.9MB
SHA256 6caea45fabaf1b1524ad52530c5910e6b3cf01afcf4e89d182c959594d4a617c
MD5 4e22041145affec2661986011fc1e269
SHA1 261a994a9d8ee3e98640ed03b41b1394724ff9d3
SHA512 6ea933ec135b815d7d03d157cffbeb7c1ce61264b895eb2f031ff6f410d3c6d3245034ec05cb2007d483ab4c51963f24cc9f6dc223721974bfc2a1e433e9e9c2
SSDEEP 98304:EPcFsQcCqzCtDWq/di6pLzkZKyMc0WRqHgWWuu/nJmHqw:EPcmP/Mn/d15zkgpWgHgWWL+qw
TLSH
T14736E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-18782.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-18782.exe
Size 4.9MB
SHA256 529e09e33c306a8eb673cea737702e012284f2b66179baa9140b5cf0e4094735
MD5 e7768d5f324538c217d7fede604547e6
SHA1 d878c0ff9783ea57b0afd8650aa93f30887f5f8e
SHA512 c5753c18767386a7aa7bb10b92359df6a6867c28bca44843dcd34fc67c3f1297f9876154c9bc9b357c125311fc25931ae7f18aafedd11c009d4551541acd0940
SSDEEP 98304:EPcFsQcKqzCtDWq/di6LLz77KyMc0W2qHgWWuu/nJmHqw:EPcmPnMn/d1Hz7upWDHgWWL+qw
TLSH
T13236E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-20052.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-20052.exe
Size 4.9MB
SHA256 6467aab667e6786365351e17f92f8d71a9f592a8144bb4aa3a46b56f86120109
MD5 506ba505447973cc991ef0b657bffc84
SHA1 68bfd7befa66375e54cf36c8fa20b74831827f37
SHA512 4dd297e3ce3517bd950f7291168d9f864210470bb840680e18f41de7e418e2fb3077fd0057624eda1b95eb2b4b12b2885510183d7de1b65f80b2efe39aecaf9d
SSDEEP 98304:EPcFsQcCqzCtDWq/di6pLz7ZKyMK0W2qHgWWuu/nJmHqw:EPcmP/Mn/d15z7gDWDHgWWL+qw
TLSH
T13236E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-2569.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-2569.exe
Size 4.9MB
SHA256 f81ace38d8c87d29674297fda039e0fb3acdcca98cac3090abbe4366c3de059d
MD5 70de7b6f0a209c55f7af0f556c7b3faa
SHA1 d66ddcbd5f94f634fe7bce94e1b27cfd40f45c22
SHA512 0e776fc1e635a6b06050e69e617b41504f4a845da803318c6e3cb16ee0cd98b78c512d4cee588486022f3e25242d59cc007212697ad1a51b3ffc9f220ef7352f
SSDEEP 98304:EPcFsQcCqzCtDWq/di6LLz77KyMc0W2qHgWWuu/nJmHqw:EPcmP/Mn/d1Hz7upWDHgWWL+qw
TLSH
T14F36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-26439.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-26439.exe
Size 4.9MB
SHA256 37c47b50b57a29a373855e777806d48d616cd97485089dc5b3c5747de3b96d0b
MD5 d3ef111d664eba08679e1dda8ce5a2a4
SHA1 5353a54ac47af0a410e33314a6a7c01889983d38
SHA512 7111a502580ea1d2f7c8c49f38563f4672840441728b89e1fcb6d940bec13906c23c06b32f50b2ab0cfe76cccf136072a17fcd5e256fac4a68bf621383e22b4b
SSDEEP 98304:ePcFsQcCqzrtDWq/di6LLz7ZKyMc0W2qHgWWuu/nJmHqw:ePcmP/Bn/d1Hz7gpWDHgWWL+qw
TLSH
T1E136E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-29861.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-29861.exe
Size 4.9MB
SHA256 325acaa17a4fb50441b8a31448779adc1c7b565b5464b48d7d8a38ae73ef61f5
MD5 9191434b71f5e73b1012c40373e924d4
SHA1 5982472b201760af1cbcdd3671b1caeda7289fe6
SHA512 057c078c56286d3b2b964855a2c2ce0248ed527349790a6fe465ce7d696e7b57968875a81af7d16ff2e003d7b939052ce8777e603f819a3194218e433969909f
SSDEEP 98304:EPcFsQcCqzCtDWq/di6LLz7ZKyMc0W2qHgWWuu/nJmHqw:EPcmP/Mn/d1Hz7gpWDHgWWL+qw
TLSH
T11836E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-31178.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-31178.exe
Size 4.9MB
SHA256 439e4c2421b53801fd120b6c0f6a4b8535b92962afb7cbe9cac8bba42a2b44cc
MD5 99f5740a6e165a2e031cd7f013265e7a
SHA1 cb4f784d3c274ed0a6f9a2cdc4c27992d933aba0
SHA512 40f58058c929dd3dbc62c3c4ad9a4b9fa483fdf06e53024bfdf2312326721c6a42bb59ecd57982aef859c03d25bc01630db6f58418008a6d53a469f5318aa690
SSDEEP 98304:EPcFsQcCqzCtDWq/di6LLz77KyMc0WlqHgWWuu/nJmHqw:EPcmP/Mn/d1Hz7upWsHgWWL+qw
TLSH
T1CE36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-32570.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-32570.exe
Size 4.9MB
SHA256 c16b528835dcb7947e7e762981748fbe7f2cfee4d45dc227feb49e53cbfb9266
MD5 a55f558b4ae23babd223c774ade02825
SHA1 aa124e107f2ef15650841bd6b510da830a2f604b
SHA512 fbebc0207fd2003354bb12411f59b39c4e4ab6c5887181e19b257c0da04c48b37c9d3a5fd21cf6d2059a2e9b1c8149ee05e15f09dc8e6354024765c12a939389
SSDEEP 98304:EPcFsQcCqzCtDWq/di6pLzbZKyMc0WRqHgWWuu/nJmHqw:EPcmP/Mn/d15zbgpWgHgWWL+qw
TLSH
T17136E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-33374.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-33374.exe
Size 4.9MB
SHA256 5541b3ce416975d4919a9b6f0fa60af6c2b5ed2a29a571efae113a32e0f36ef4
MD5 5284a4e7737eb8788ce6c4ea8784e07d
SHA1 7b8d9c77a5bd88e268efaca7a3fa6bbf6848b5f4
SHA512 b0c21d97dfe33f03319c89801840c59a7d8cc668c1d69330be4942ba5536073fc06e0565510f5f3789c8741669ec3bb02bcd8bc61f998b4a2e7f93eb2d59f20c
SSDEEP 98304:EPcFsQcCqzCtDWq/di6LLz7ZKyMc0W25HgWWuu/nJmHqw:EPcmP/Mn/d1Hz7gpWUHgWWL+qw
TLSH
T15036E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-33639.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-33639.exe
Size 4.9MB
SHA256 9367cf2ac51dea3a9e53cd034256682e0a1bc891d69dcd1ee431bcab9f2f0ccd
MD5 6106886697c47790ff99a98f4c79a612
SHA1 0295a7ea0960e3d11cd0ddefe50eaac1b7b52842
SHA512 beafe340881cd960b994dfaea502e8de6db5e8911ae8a138221d9e487040a722f81d05b576551eb65bf1ff0085a057ffef495ebbd8f5791beef0cb553074064f
SSDEEP 98304:EPDFsQcCqzCtDWq/di6pLzkZKyMZ0W2qHgWWuu/nJmHqw:EPDmP/Mn/d15zkgQWDHgWWL+qw
TLSH
T1EC36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-36964.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-36964.exe
Size 4.9MB
SHA256 dbe8fe4b68190e741991b9940cec3da7288224b8e985bc5cf306a7854f2107f3
MD5 11f66fc8f4bd3ad677cf65535d96b97b
SHA1 acc36856e52aa379e17f80383b11688114cde67d
SHA512 0c36d5dc3152417cacd599c916083027b18eb83f8681460170e735cfda7d5a32fd3a49bee06605097290859cc706d894d1b11f6a1edde58a968d20f3552c060e
SSDEEP 98304:eP8FsQcCqzCtDWq/di6LLz7ZKyMc0W2qHg/Wuu/nJmHqZ:eP8mP/Mn/d1Hz7gpWDHg/WL+qZ
TLSH
T10336E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-37723.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-37723.exe
Size 4.9MB
SHA256 0cacbc4909d5cc40a111d812611918aac9b09608feda0bd1afc7a4158a2137ce
MD5 7ec1d0be23e688f59d78b458f75db6a8
SHA1 3e71e0c7ba5b5b725c86ed29d72b32416034c0e6
SHA512 cc61226c7d6ec7b4de206985e2b66b33da069546b332f0fe1aaee8a8c74d3b0db3ef0625f950a5a107ff89d4cbc430ea2fcee8e4f06da959bcef59eec9111151
SSDEEP 98304:EPcFsQcCqzCtDWq/di6pLz7ZKyMS0W2qHgWWuu/nJmHxw:EPcmP/Mn/d15z7g7WDHgWWL+xw
TLSH
T1ED36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-39155.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-39155.exe
Size 4.9MB
SHA256 ffd6654d41d41e5dd60dc4bcb753dfdea0c50ead25c4492cb4a80a5c8ba0cea7
MD5 2e63fb5bd7bed37f87d57b813d030795
SHA1 eb7a360117f0fb74105e189ca5bb31fefa24cc06
SHA512 43658e40a3b99792692a0953d0b6342770754143bdb87e9b07b8df327c0b91276b6597be4b53736dae1d3eed049776016d14d781506184673198c855d0e21815
SSDEEP 98304:EPcFsQcCqzCtDWq/di6pLzkZKyMT0W2qHgWWuu/nJmHqw:EPcmP/Mn/d15zkgGWDHgWWL+qw
TLSH
T11636E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-4483.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-4483.exe
Size 4.9MB
SHA256 b14ee3ab54d0c7b3691f2f696d6cd3224ad4f1ce83115adab0cdee0ae9bf7eae
MD5 fdde3548f28744c4892e95676f1a4445
SHA1 73ee3cfe171cd82fb3d9f1acdbeb923e96d510c5
SHA512 b1e9b78416bfa52bffd83e916176de0df0f5cf4810b85c994fea36abe44170cf5924eb92e944dc3a338ae4a1adfd9543bcfc1c14e88c791270a6e7fb316917ba
SSDEEP 98304:EPcFsQcCqzCtDWq/di6LLz7ZKyMc0W2qHgWWuu/nJmOqw:EPcmP/Mn/d1Hz7gpWDHgWWLXqw
TLSH
T1B036E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-51044.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-51044.exe
Size 4.9MB
SHA256 6c0f54c604e313f4534797d3c6fd0c427d7d82e62396514c9965ff3b19de2a82
MD5 ada32913646cffa5facd5d08cd0ea6a1
SHA1 923b4bd2cbc0d0904d8d7c933969d76019dd8cda
SHA512 df223dad269ce6ce2857fbd83cd309d11fc2e8470557bd6a758e6a374ebdb9f57c12e6f51b5f872870071f95bdaebe5808156c0bd4cd20fb5f6eb9c2e0dbd6c9
SSDEEP 98304:EPcFsQcKqzYtDWq/di6LLz77KyMc0W2qHgWWuu/nJmHqw:EPcmPnyn/d1Hz7upWDHgWWL+qw
TLSH
T18D36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-53161.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-53161.exe
Size 4.9MB
SHA256 1ee6a84493349e712930dfdc2327254ea4d862143d376370285c0da641991404
MD5 6d82f1ab66bab2586474e6ba7d871cce
SHA1 2ac2ee1af0c5f25d81a930e73b383d5973378043
SHA512 439521572362e0f1872844fa5b0cc6ed0a0e55369c2614e4d29be25513fc5d1512c2f9a1b1ba85a848881423d12228fa93f82d0d775c7be90e6321b28794f81a
SSDEEP 98304:ePcFsQcCqzCtDWq/di6LLz7ZKyMc0W2qHg/Wuu/nJmHqw:ePcmP/Mn/d1Hz7gpWDHg/WL+qw
TLSH
T10D36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-540.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-540.exe
Size 4.9MB
SHA256 3a8e01d1be52bc7611f531541daee9aa065b6b44f5fef30fd332451c279e469a
MD5 55e54af2e99a979ddd1a163935f24ba9
SHA1 f2edf54914a62d4368c6d4ae40e54ea0ade9ad81
SHA512 138e81349ffe94b7adda83c9aee0585e8739077b23483d9f21d2558a7ed918356ef5120b387e6336939c7046718800fbe6d206314acd9262b81a71fdbeabf839
SSDEEP 98304:EPcFsQcCqzCtDWq/di6pLzkZKyMc0W2qHgWWuu/nJmHqw:EPcmP/Mn/d15zkgpWDHgWWL+qw
TLSH
T19F36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-54370.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-54370.exe
Size 4.9MB
SHA256 313d1d1a0a212aa973de2a543666f6e921c66bcbf31628b2eb139cd00909db5c
MD5 e0a172754a096767dcd10b5aa645f914
SHA1 29b9a36f921f27b3c780b28221884256e79d8f28
SHA512 250377d36106b535edafb1a6dfc0968e0150288744969d660737638223387b3c773d026c04378074e36925b96a228f621c34c8ea3564e13a7141a625d98fba9e
SSDEEP 98304:ePcFsQcCqzCtDWq/di6LLz7ZKyMR0WpqHgWWuu/nJmHqw:ePcmP/Mn/d1Hz7gQW4HgWWL+qw
TLSH
T18E36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-6015.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-6015.exe
Size 4.9MB
SHA256 4bad849573f635e6df87a106d7fa6fd88faace6e93c0d6ed664869cc50103357
MD5 427014ecf0300bc389ea54d389511470
SHA1 099f682854c4c3406fc7b5fdc6bbe7cc6eea57eb
SHA512 c30e28b96d38b21d5ab8232d3507cc6d1a4a1d94ad1c17d8c1eacc75af0f686f011c60bbbfdf04d0ee707e027f5336c0ca395654723d370890d1ac5b4250e8d7
SSDEEP 98304:ePcFsQcCqzCtDWq/di6LLz7ZKyMc0W2qHgWWuu/nJmHqw:ePcmP/Mn/d1Hz7gpWDHgWWL+qw
TLSH
T1B936E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-63296.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-63296.exe
Size 4.9MB
SHA256 96b0bc0486aea8fd99b63bc4a637ee91cc9040a2e37cc896eafa4608a452b9d9
MD5 b28f206960273cb8aac00e86f75adfd7
SHA1 6bea1ae66585a1af922b175337f9af041640c054
SHA512 416cbe979efa040b380a33839f1562179557b1c98797db8345f5250f06c37d25e3d1fecca6d87db784ff1549a4e5eac19cee1ffed3622d5946d3a41b439fed58
SSDEEP 98304:eP8FsQcCqzCtDWq/di6LLz7ZKyMc0W2qHg/Wuu/nJWHqw:eP8mP/Mn/d1Hz7gpWDHg/WLOqw
TLSH
T1F736E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-8027.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-8027.exe
Size 4.9MB
SHA256 3df952f3b0c23f6b7d56616827089bd268bd454f9dcf7504fa20f4ce5a5e8a7f
MD5 316dea114650950cb7ff2ab104759535
SHA1 b8978e803391a8dbedf0c1ba16be07f4bac75180
SHA512 8796d05e76fc791613446346a6c2a959dbc5533e658fb19252c619f334fbcb70f9d2fdef9151c254cce6160ab07e717edf4d64182ebb18762d91acef01149b42
SSDEEP 98304:EPcFsQcCqzCtDWq/di6pLz7ZKyMc0W2qHgWWuu/nJmHxw:EPcmP/Mn/d15z7gpWDHgWWL+xw
TLSH
T18436E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-8698.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-8698.exe
Size 4.9MB
SHA256 86750696062ede780e3cb8cc28956329b7e70f3db9f43e77ba00064a7b991e22
MD5 daf0331662d4f3c9770e3eb6e13d08b2
SHA1 e7fd70020e82a5d361d73befc03f1a1574c0d600
SHA512 1bfdccbd5e85a2e803a413296697d0793c50f4fbb84e3446f2ff6f68dd6c9d2a965e0a650981c33472c461ccf29106f17d54a93ded54fe797d7ad9e38ae9050d
SSDEEP 98304:eP8FsQcCqzCtDWq/di6LLz7ZKyMc0W2qHg/Wuu/n6WHqw:eP8mP/Mn/d1Hz7gpWDHg/WLnqw
TLSH
T12336E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-9034.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-9034.exe
Size 4.9MB
SHA256 b9ab3d6cd74730fb2c6466f1e6eccbbd50fe50550fed58d20522172105806a0e
MD5 d445fd315df5189b004098a560ae1878
SHA1 0fb6e86b9e7b523cf5013db83ddfeac985523363
SHA512 44686c9c107e5b49c276e0e3bbb31889d14d9d36b7dc36211df8285789f3f78ca2c6481eea2eca76b887864256bc3813841c3b4350e620af9848c0d07fe3e725
SSDEEP 98304:EPcFsQcCqzCtDWq/di6pLzkZKyMc0W2qHgWWuu/nJmHqw:EPcmP/Mn/d15zkgpWDHgWWL+qw
TLSH
T1CA36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1560-722-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1568-1889-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1812-940-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1936-339-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2016-885-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2192-800-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2432-918-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2484-341-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2992-674-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3256-2349-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3296-555-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3676-0-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3676-1231-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3872-677-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3900-358-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3920-319-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4108-2250-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4108-17-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4220-144-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4296-1586-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4396-723-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4424-721-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4452-1091-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4552-305-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4632-337-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4740-414-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4852-241-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5048-475-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5440-799-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5576-444-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5668-566-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5704-340-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5716-31-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5728-501-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5736-587-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5740-75-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5744-678-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5940-335-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5952-679-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6072-942-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6176-884-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6284-994-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6312-993-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6376-1126-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6412-1118-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6528-1000-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6536-883-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6552-1010-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6596-1140-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6748-1119-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6780-996-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6788-919-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6796-1011-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6832-1120-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6880-921-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6892-1123-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6924-941-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6932-922-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6984-1156-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6988-914-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7016-995-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7052-1125-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7080-997-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7120-998-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7124-1152-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7160-1092-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7240-1124-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7248-1121-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7256-1122-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7420-1127-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7736-1168-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7816-1128-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7840-1174-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7892-1229-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/8060-1139-0x0000000000400000-0x0000000000475000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads