kawaiiunicorn | 34ba1bf33ada81150e3f117fafb917c17e05fe5aaed19b3572375516aa24efe3

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 10:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_88b48a7e136845799e966a209e40caf3_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Size 12.9MB
Sample260815-m1s7asfc82
SHA256 34ba1bf33ada81150e3f117fafb917c17e05fe5aaed19b3572375516aa24efe3
MD5 88b48a7e136845799e966a209e40caf3
SHA1 52862c10b73c6aea1ce58f8412a7648ab0ef7539
SHA512 835f05bff5152406e7872e7dfa095d7ebfccf2f083ca9761d0697e77904841f500dfe8ccd97730f6a968c05b0866e9e3e45a32cb808a50bcfa97ead647850891
SSDEEP 196608:EP0vi/M5sv15fmmpLKHgKkL6qwSLTK+ZrYBB30Tdgr5ZjBxcO4TjV2VNAHPT1m+H:E8v4M5sv1FtAj29ThYMSJk2NETs+
TLSH
T1DCD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery kawaiiunicorn trojan

Malware Config

Signatures

Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
trojan kawaiiunicorn

Detects KawaiiUnicorn 49 IoCs

resource	yara_rule
behavioral2/memory/4860-0-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2512-169-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2292-168-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3816-252-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1312-266-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5324-318-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3224-334-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5452-361-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3292-360-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4668-575-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1064-576-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1160-574-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/800-573-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5368-572-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1780-571-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1476-570-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/620-563-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3344-556-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2428-706-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4956-727-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5996-651-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2308-608-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2860-607-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5480-650-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5592-606-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4328-649-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3756-648-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6520-809-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6388-987-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5756-1009-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7064-1078-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4688-1075-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4544-1008-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6484-883-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6476-882-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4496-808-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2204-766-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5388-764-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2508-763-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5052-564-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6572-1263-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6912-1350-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7192-1265-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6588-1264-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4348-1186-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6952-1759-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7120-2186-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2856-2234-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1640-2152-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 29 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c4ec-6.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x0003000000000436-11.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4f0-21.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4f3-31.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4f1-34.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4f2-39.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4f4-60.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4f8-69.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4f6-74.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4fa-89.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4f9-84.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4f7-71.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4f5-72.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4fc-103.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c501-116.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c500-125.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c502-132.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4fe-135.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4fd-170.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c504-175.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c506-162.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c508-143.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c503-138.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c50e-196.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c513-218.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c50c-217.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c517-233.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c518-236.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c519-237.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

UPX dump on OEP (original entry point) 29 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c4ec-6.dat	UPX
behavioral2/files/0x0003000000000436-11.dat	UPX
behavioral2/files/0x000d00000001c4f0-21.dat	UPX
behavioral2/files/0x000d00000001c4f3-31.dat	UPX
behavioral2/files/0x000d00000001c4f1-34.dat	UPX
behavioral2/files/0x000d00000001c4f2-39.dat	UPX
behavioral2/files/0x000d00000001c4f4-60.dat	UPX
behavioral2/files/0x000d00000001c4f8-69.dat	UPX
behavioral2/files/0x000d00000001c4f6-74.dat	UPX
behavioral2/files/0x000d00000001c4fa-89.dat	UPX
behavioral2/files/0x000d00000001c4f9-84.dat	UPX
behavioral2/files/0x000d00000001c4f7-71.dat	UPX
behavioral2/files/0x000d00000001c4f5-72.dat	UPX
behavioral2/files/0x000d00000001c4fc-103.dat	UPX
behavioral2/files/0x000d00000001c501-116.dat	UPX
behavioral2/files/0x000d00000001c500-125.dat	UPX
behavioral2/files/0x000d00000001c502-132.dat	UPX
behavioral2/files/0x000d00000001c4fe-135.dat	UPX
behavioral2/files/0x000d00000001c4fd-170.dat	UPX
behavioral2/files/0x000d00000001c504-175.dat	UPX
behavioral2/files/0x000d00000001c506-162.dat	UPX
behavioral2/files/0x000d00000001c508-143.dat	UPX
behavioral2/files/0x000d00000001c503-138.dat	UPX
behavioral2/files/0x000d00000001c50e-196.dat	UPX
behavioral2/files/0x000d00000001c513-218.dat	UPX
behavioral2/files/0x000d00000001c50c-217.dat	UPX
behavioral2/files/0x000d00000001c517-233.dat	UPX
behavioral2/files/0x000d00000001c518-236.dat	UPX
behavioral2/files/0x000d00000001c519-237.dat	UPX

Executes dropped EXE 12 IoCs

pid	Process
5632	Unicorn-52236.exe
5812	Unicorn-2096.exe
5496	Unicorn-55059.exe
1092	Unicorn-3139.exe
3536	Unicorn-29782.exe
2644	Unicorn-23237.exe
5112	Unicorn-54006.exe
2928	Unicorn-61105.exe
2452	Unicorn-46393.exe
1988	Unicorn-25418.exe
2736	Unicorn-38639.exe
4488	Unicorn-1882.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2096.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3139.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23237.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61105.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46393.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38639.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1882.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_88b48a7e136845799e966a209e40caf3_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52236.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29782.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54006.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25418.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
4860	2026-08-15_88b48a7e136845799e966a209e40caf3_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
5632	Unicorn-52236.exe
5812	Unicorn-2096.exe
5496	Unicorn-55059.exe
1092	Unicorn-3139.exe
3536	Unicorn-29782.exe
2644	Unicorn-23237.exe
5112	Unicorn-54006.exe
2928	Unicorn-61105.exe
2452	Unicorn-46393.exe
2736	Unicorn-38639.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 5632	4860	2026-08-15_88b48a7e136845799e966a209e40caf3_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe	89
PID 5632 wrote to memory of 5812	5632	Unicorn-52236.exe	90
PID 4860 wrote to memory of 5496	4860	2026-08-15_88b48a7e136845799e966a209e40caf3_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe	91
PID 5812 wrote to memory of 1092	5812	Unicorn-2096.exe	92
PID 5496 wrote to memory of 3536	5496	Unicorn-55059.exe	93
PID 5632 wrote to memory of 2644	5632	Unicorn-52236.exe	94
PID 3536 wrote to memory of 5112	3536	Unicorn-29782.exe	95
PID 2644 wrote to memory of 2928	2644	Unicorn-23237.exe	96
PID 1092 wrote to memory of 1988	1092	Unicorn-3139.exe	98
PID 5496 wrote to memory of 2452	5496	Unicorn-55059.exe	97
PID 5632 wrote to memory of 2736	5632	Unicorn-52236.exe	99
PID 4860 wrote to memory of 4488	4860	2026-08-15_88b48a7e136845799e966a209e40caf3_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe	100
PID 5812 wrote to memory of 1224	5812	Unicorn-2096.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-15_88b48a7e136845799e966a209e40caf3_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_88b48a7e136845799e966a209e40caf3_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52236.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52236.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2096.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2096.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3139.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25418.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55498.exe
        6⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21996.exe
        7⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61373.exe
        8⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46978.exe
        9⤵
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21509.exe
        10⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18554.exe
        11⤵
        
        PID:8584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27721.exe
        10⤵
        
        PID:9704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32068.exe
        9⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15094.exe
        10⤵
        
        PID:8436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52195.exe
        9⤵
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2416.exe
        8⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32832.exe
        9⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        9⤵
        
        PID:10288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39146.exe
        8⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41310.exe
        9⤵
        
        PID:11392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9923.exe
        8⤵
        
        PID:10828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54829.exe
        7⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59038.exe
        8⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9977.exe
        9⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2458.exe
        10⤵
        
        PID:8300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33099.exe
        10⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35335.exe
        9⤵
        
        PID:9264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38928.exe
        8⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47710.exe
        9⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45632.exe
        9⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29218.exe
        8⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33437.exe
        8⤵
        
        PID:11052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28403.exe
        7⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42754.exe
        8⤵
        
        PID:7620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24216.exe
        9⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57718.exe
        8⤵
        
        PID:11088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46848.exe
        7⤵
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41435.exe
        7⤵
        
        PID:3800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47932.exe
        6⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36781.exe
        7⤵
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57362.exe
        8⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48045.exe
        9⤵
        
        PID:9340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26451.exe
        8⤵
        
        PID:10008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62193.exe
        7⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40287.exe
        8⤵
        
        PID:9608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58661.exe
        7⤵
        
        PID:948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25004.exe
        6⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        7⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42723.exe
        8⤵
        
        PID:8560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6856.exe
        7⤵
        
        PID:8780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5265.exe
        6⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9747.exe
        7⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22836.exe
        8⤵
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40179.exe
        6⤵
        
        PID:3040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43801.exe
        5⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4590.exe
        6⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49334.exe
        7⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51913.exe
        8⤵
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42147.exe
        9⤵
        
        PID:7536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35631.exe
        9⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31326.exe
        8⤵
        
        PID:556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24647.exe
        7⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54106.exe
        8⤵
        
        PID:9288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6751.exe
        7⤵
        
        PID:9300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4964.exe
        6⤵
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56163.exe
        7⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45655.exe
        8⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9261.exe
        7⤵
        
        PID:8700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4724.exe
        6⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29467.exe
        7⤵
        
        PID:9380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23665.exe
        6⤵
        
        PID:9720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35024.exe
        5⤵
        
        PID:1316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56241.exe
        6⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25354.exe
        7⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1973.exe
        8⤵
        
        PID:9616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21194.exe
        7⤵
        
        PID:8140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51373.exe
        6⤵
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6851.exe
        7⤵
        
        PID:8220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55817.exe
        6⤵
        
        PID:9308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3760.exe
        5⤵
        
        PID:4464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63174.exe
        6⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33619.exe
        7⤵
        
        PID:10484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28449.exe
        6⤵
        
        PID:10612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64825.exe
        5⤵
        
        PID:7604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3223.exe
        5⤵
        
        PID:11144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53684.exe
      4⤵
      PID:1224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21996.exe
        5⤵
        
        PID:2556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16449.exe
        6⤵
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30642.exe
        7⤵
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6817.exe
        8⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48019.exe
        9⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10.exe
        8⤵
        
        PID:8928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37496.exe
        7⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3871.exe
        7⤵
        
        PID:10100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2416.exe
        6⤵
        
        PID:620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40101.exe
        7⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23178.exe
        8⤵
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51920.exe
        7⤵
        
        PID:972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55041.exe
        6⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56239.exe
        7⤵
        
        PID:10164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23494.exe
        6⤵
        
        PID:9804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39561.exe
        5⤵
        
        PID:244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55530.exe
        6⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47113.exe
        7⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64708.exe
        8⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19954.exe
        7⤵
        
        PID:9312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2743.exe
        6⤵
        
        PID:7404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36058.exe
        7⤵
        
        PID:6540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17592.exe
        6⤵
        
        PID:3332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3489.exe
        5⤵
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51693.exe
        6⤵
        
        PID:9640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3296.exe
        5⤵
        
        PID:9272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45523.exe
      4⤵
      PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53994.exe
        5⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5530.exe
        6⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48803.exe
        7⤵
        
        PID:10536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43161.exe
        6⤵
        
        PID:10388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30781.exe
        5⤵
        
        PID:7252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30723.exe
        6⤵
        
        PID:9696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17431.exe
        5⤵
        
        PID:5924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48275.exe
      4⤵
      PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63091.exe
        5⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2684.exe
        6⤵
        
        PID:8912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23851.exe
        5⤵
        
        PID:9736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21187.exe
      4⤵
      PID:2856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8979.exe
        5⤵
        
        PID:3704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8459.exe
      4⤵
      PID:5344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23237.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23237.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61105.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54429.exe
        5⤵
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33226.exe
        6⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51041.exe
        7⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38400.exe
        8⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55904.exe
        9⤵
        
        PID:7268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31709.exe
        10⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37115.exe
        9⤵
        
        PID:10964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47798.exe
        8⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37598.exe
        8⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9790.exe
        7⤵
        
        PID:124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36395.exe
        8⤵
        
        PID:11176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21660.exe
        7⤵
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4366.exe
        6⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44861.exe
        7⤵
        
        PID:7428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41957.exe
        7⤵
        
        PID:2908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33413.exe
        6⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42934.exe
        7⤵
        
        PID:11156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27226.exe
        6⤵
        
        PID:11400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22431.exe
        5⤵
        
        PID:3292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63698.exe
        6⤵
        
        PID:560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10844.exe
        7⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35326.exe
        8⤵
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21298.exe
        7⤵
        
        PID:9136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55255.exe
        6⤵
        
        PID:8244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21854.exe
        5⤵
        
        PID:6360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35134.exe
        6⤵
        
        PID:9316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43801.exe
      4⤵
      PID:5252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54476.exe
        5⤵
        
        PID:3816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49334.exe
        6⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35961.exe
        7⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57056.exe
        8⤵
        
        PID:7508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65222.exe
        9⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55860.exe
        8⤵
        
        PID:10528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43303.exe
        7⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27291.exe
        7⤵
        
        PID:360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22701.exe
        6⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42726.exe
        7⤵
        
        PID:9864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30949.exe
        6⤵
        
        PID:8268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24123.exe
        5⤵
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57388.exe
        6⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57689.exe
        7⤵
        
        PID:8676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41256.exe
        6⤵
        
        PID:9624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63209.exe
        5⤵
        
        PID:6976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12663.exe
        6⤵
        
        PID:9244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30489.exe
        5⤵
        
        PID:10040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63997.exe
      4⤵
      PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24830.exe
        5⤵
        
        PID:5620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-657.exe
        6⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9308.exe
        7⤵
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64703.exe
        7⤵
        
        PID:7136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-434.exe
        6⤵
        
        PID:8060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48397.exe
        6⤵
        
        PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40298.exe
        5⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-922.exe
        6⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62607.exe
        7⤵
        
        PID:10260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15507.exe
        6⤵
        
        PID:6200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18227.exe
        5⤵
        
        PID:9052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15327.exe
      4⤵
      PID:1780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27430.exe
        5⤵
        
        PID:7140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9866.exe
        6⤵
        
        PID:8012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25086.exe
        5⤵
        
        PID:9528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24996.exe
      4⤵
      PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47023.exe
        5⤵
        
        PID:5892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54951.exe
      4⤵
      PID:7788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38639.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38639.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21289.exe
      4⤵
      PID:1312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58462.exe
        5⤵
        
        PID:724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6080.exe
        6⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
        7⤵
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44122.exe
        6⤵
        
        PID:6472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45037.exe
        5⤵
        
        PID:6340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32414.exe
        6⤵
        
        PID:4768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3394.exe
        5⤵
        
        PID:10324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42410.exe
      4⤵
      PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44508.exe
        5⤵
        
        PID:7176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9311.exe
        6⤵
        
        PID:7444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28449.exe
        5⤵
        
        PID:11204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19904.exe
      4⤵
      PID:8088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27802.exe
        5⤵
        
        PID:10472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6105.exe
      4⤵
      PID:2148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36759.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36759.exe
    3⤵
    PID:2512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21996.exe
      4⤵
      PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55343.exe
        5⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39002.exe
        6⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13994.exe
        7⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19722.exe
        8⤵
        
        PID:4120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63724.exe
        6⤵
        
        PID:7684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62425.exe
        7⤵
        
        PID:604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1832.exe
        6⤵
        
        PID:8808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10776.exe
        5⤵
        
        PID:1344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54259.exe
        6⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28414.exe
        7⤵
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13508.exe
        6⤵
        
        PID:11000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3178.exe
        5⤵
        
        PID:8252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22061.exe
        5⤵
        
        PID:2692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65410.exe
      4⤵
      PID:3284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59422.exe
        5⤵
        
        PID:1476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52318.exe
        6⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6192.exe
        7⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45923.exe
        7⤵
        
        PID:11340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31827.exe
        6⤵
        
        PID:5980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32260.exe
        5⤵
        
        PID:6328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14007.exe
        6⤵
        
        PID:7488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31350.exe
        6⤵
        
        PID:1200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12667.exe
        5⤵
        
        PID:10140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49208.exe
      4⤵
      PID:4328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23739.exe
        5⤵
        
        PID:6252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8931.exe
        5⤵
        
        PID:6772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32868.exe
      4⤵
      PID:7632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18186.exe
        5⤵
        
        PID:2984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33162.exe
      4⤵
      PID:10988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61197.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61197.exe
    3⤵
    PID:1156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46210.exe
      4⤵
      PID:2308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14492.exe
        5⤵
        
        PID:6500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32669.exe
        6⤵
        
        PID:10796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58143.exe
        5⤵
        
        PID:624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6495.exe
      4⤵
      PID:6588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62134.exe
        5⤵
        
        PID:9440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37250.exe
      4⤵
      PID:10360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23074.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23074.exe
    3⤵
    PID:5592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52894.exe
      4⤵
      PID:2820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25809.exe
        5⤵
        
        PID:10056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40239.exe
      4⤵
      PID:9712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62667.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62667.exe
    3⤵
    PID:7040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28119.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28119.exe
    3⤵
    PID:9352
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55059.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55059.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29782.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29782.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54006.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34009.exe
        5⤵
        
        PID:1460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2691.exe
        6⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62655.exe
        7⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54902.exe
        8⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18821.exe
        9⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34692.exe
        9⤵
        
        PID:10512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
        8⤵
        
        PID:712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64048.exe
        8⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8057.exe
        7⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4521.exe
        8⤵
        
        PID:8408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64587.exe
        7⤵
        
        PID:9372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11269.exe
        6⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18529.exe
        7⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29026.exe
        8⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62607.exe
        8⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1188.exe
        7⤵
        
        PID:8744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49120.exe
        6⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2082.exe
        7⤵
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40603.exe
        6⤵
        
        PID:9676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9110.exe
        5⤵
        
        PID:4596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58965.exe
        6⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63719.exe
        7⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14018.exe
        8⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47884.exe
        7⤵
        
        PID:9872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20591.exe
        6⤵
        
        PID:8720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51730.exe
        5⤵
        
        PID:2508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49298.exe
        6⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60593.exe
        7⤵
        
        PID:10956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9419.exe
        6⤵
        
        PID:6968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30533.exe
        5⤵
        
        PID:6828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33816.exe
        5⤵
        
        PID:6420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14143.exe
      4⤵
      PID:1508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39401.exe
        5⤵
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22583.exe
        6⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54373.exe
        7⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47225.exe
        8⤵
        
        PID:9124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54936.exe
        7⤵
        
        PID:1404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38591.exe
        6⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50121.exe
        7⤵
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17628.exe
        6⤵
        
        PID:9420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11269.exe
        5⤵
        
        PID:4316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5701.exe
        6⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55193.exe
        7⤵
        
        PID:8148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10247.exe
        6⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39748.exe
        7⤵
        
        PID:2504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40421.exe
        6⤵
        
        PID:9508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29420.exe
        5⤵
        
        PID:6308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23598.exe
        6⤵
        
        PID:7804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2378.exe
        6⤵
        
        PID:6028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51428.exe
        5⤵
        
        PID:2704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12099.exe
      4⤵
      PID:300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6220.exe
        5⤵
        
        PID:2204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16408.exe
        6⤵
        
        PID:7376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8512.exe
        7⤵
        
        PID:2468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14059.exe
        6⤵
        
        PID:11032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59640.exe
        5⤵
        
        PID:7728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26035.exe
        5⤵
        
        PID:10600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13626.exe
      4⤵
      PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57230.exe
        5⤵
        
        PID:8048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54489.exe
      4⤵
      PID:9632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46393.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46393.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38093.exe
      4⤵
      PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42022.exe
        5⤵
        
        PID:4136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30258.exe
        6⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30118.exe
        7⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39389.exe
        8⤵
        
        PID:8308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58715.exe
        9⤵
        
        PID:10152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56088.exe
        7⤵
        
        PID:9500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45639.exe
        6⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8512.exe
        7⤵
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27794.exe
        6⤵
        
        PID:9664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26728.exe
        5⤵
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18987.exe
        6⤵
        
        PID:7100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25827.exe
        5⤵
        
        PID:8692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9904.exe
      4⤵
      PID:5684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45992.exe
        5⤵
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20170.exe
        6⤵
        
        PID:1284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6711.exe
        7⤵
        
        PID:9648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41604.exe
        6⤵
        
        PID:9044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
        5⤵
        
        PID:7172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41377.exe
        6⤵
        
        PID:7160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5916.exe
        5⤵
        
        PID:10080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-90.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-90.exe
      4⤵
      PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19786.exe
        5⤵
        
        PID:7596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8823.exe
        5⤵
        
        PID:3668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49417.exe
      4⤵
      PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7853.exe
        5⤵
        
        PID:6424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41352.exe
      4⤵
      PID:10392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31962.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31962.exe
    3⤵
    PID:5724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21996.exe
      4⤵
      PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28783.exe
        5⤵
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56189.exe
        6⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61745.exe
        7⤵
        
        PID:9656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29004.exe
        6⤵
        
        PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22622.exe
        5⤵
        
        PID:6712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54682.exe
        6⤵
        
        PID:8156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-837.exe
        6⤵
        
        PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42933.exe
        5⤵
        
        PID:9928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26240.exe
      4⤵
      PID:2608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37440.exe
        5⤵
        
        PID:2428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27679.exe
        6⤵
        
        PID:5204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56467.exe
        6⤵
        
        PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64465.exe
        5⤵
        
        PID:8184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9835.exe
        5⤵
        
        PID:11216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17111.exe
      4⤵
      PID:1080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43714.exe
        5⤵
        
        PID:6400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28445.exe
        6⤵
        
        PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19793.exe
        5⤵
        
        PID:9600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46272.exe
      4⤵
      PID:1140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1258.exe
      4⤵
      PID:1900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4325.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4325.exe
    3⤵
    PID:4792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24.exe
      4⤵
      PID:800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14492.exe
        5⤵
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63177.exe
        6⤵
        
        PID:8216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31827.exe
        5⤵
        
        PID:5960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54627.exe
      4⤵
      PID:6988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9482.exe
        5⤵
        
        PID:8972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10425.exe
      4⤵
      PID:9476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39610.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39610.exe
    3⤵
    PID:3756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55883.exe
      4⤵
      PID:4348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53888.exe
        5⤵
        
        PID:10092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33228.exe
      4⤵
      PID:9544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40038.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40038.exe
    3⤵
    PID:7776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25525.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25525.exe
    3⤵
    PID:10788
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1882.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1882.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51414.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51414.exe
    3⤵
    PID:4240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12919.exe
      4⤵
      PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64274.exe
        5⤵
        
        PID:880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11150.exe
        6⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22389.exe
        7⤵
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38184.exe
        6⤵
        
        PID:10048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43308.exe
        5⤵
        
        PID:7640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1366.exe
        6⤵
        
        PID:3580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28998.exe
        5⤵
        
        PID:9328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57075.exe
      4⤵
      PID:4956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47243.exe
        5⤵
        
        PID:8168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45700.exe
        6⤵
        
        PID:11128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22606.exe
        5⤵
        
        PID:11164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43771.exe
      4⤵
      PID:8540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43448.exe
        5⤵
        
        PID:11416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56858.exe
      4⤵
      PID:11428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6214.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6214.exe
    3⤵
    PID:2444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37165.exe
      4⤵
      PID:4192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50481.exe
        5⤵
        
        PID:6644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63527.exe
        6⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49576.exe
        7⤵
        
        PID:9520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33348.exe
        6⤵
        
        PID:11192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63890.exe
        5⤵
        
        PID:7008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16108.exe
        5⤵
        
        PID:2812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26531.exe
      4⤵
      PID:6896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18388.exe
        5⤵
        
        PID:10444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17799.exe
      4⤵
      PID:9808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41943.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41943.exe
    3⤵
    PID:4496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22521.exe
      4⤵
      PID:7516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2461.exe
      4⤵
      PID:6068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41882.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41882.exe
    3⤵
    PID:8628
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16338.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16338.exe
  2⤵
  PID:3404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24181.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24181.exe
    3⤵
    PID:1388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19485.exe
      4⤵
      PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45281.exe
        5⤵
        
        PID:6636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53421.exe
        6⤵
        
        PID:9280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10011.exe
        5⤵
        
        PID:3188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37667.exe
      4⤵
      PID:728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14033.exe
        5⤵
        
        PID:9024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17820.exe
      4⤵
      PID:10032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28207.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28207.exe
    3⤵
    PID:4472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33237.exe
      4⤵
      PID:8836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38565.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38565.exe
    3⤵
    PID:8284
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20045.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20045.exe
  2⤵
  PID:5452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12551.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12551.exe
    3⤵
    PID:4392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63968.exe
      4⤵
      PID:6244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14936.exe
        5⤵
        
        PID:9728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26072.exe
      4⤵
      PID:9248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42841.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42841.exe
    3⤵
    PID:6788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21185.exe
      4⤵
      PID:9972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31390.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31390.exe
    3⤵
    PID:10592
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50568.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50568.exe
  2⤵
  PID:6300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26496.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26496.exe
    3⤵
    PID:9016
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41531.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41531.exe
  2⤵
  PID:8772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-14143.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-14143.exe
Size 12.9MB
SHA256 27727b0f7bd8776340454776f559dcdc08a45d3d69e1ccae3c2084c1a288743d
MD5 cbd60085d18c754c0aacbd22360c1d9f
SHA1 cd9d8a48b5466acb5b9775cd4b1e5fadafcec07e
SHA512 90eba4f6557bfaad3890fab2ea42a981cb7bc7998305cb014f712e5edd7d6d5eca396cfde901023c7aa31bf6322c4b4037809189e5a2a10372629d859a64086c
SSDEEP 196608:EP0vi/M5Dv15fmmpLnHgKkL6qwSLTK+ZrYBB30Tdgr5ZjBxcO4TjV2VNAHPy1m+H:E8v4M5Dv1Ftjj29ThYMSJk2NEys+
TLSH
T17CD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-16338.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-16338.exe
Size 12.9MB
SHA256 a64d9a19c980bac082fbe798173a7b7c46ebce095e3ac6f5cd9557c1a1a84b50
MD5 0c0807991c60f894d8a28d01b0f592c9
SHA1 cd1ebb0924a814e28bb7849e876a531c066b97ed
SHA512 291d0f8363327481322d510724f0869cfca74958bc0d257903a1b010642529a87fd74a518df2e6ec96d4170dc2280a83b368835700052733314890ae8631e356
SSDEEP 196608:EP0vi/M5sv15fmmpLKHgKkL6qwSLTK+ZrYBB30Tdgr5ZjBxcO4TjV2VNAHPT1m+H:E8v4M5sv1FtAj29ThYMSJk2NETs+
TLSH
T197D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-1882.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-1882.exe
Size 12.9MB
SHA256 9941dbc3f5d75e953ddf2b9a4cdbab38db839e08a5a5d5aeb85876c31149c8ad
MD5 e29305c569d228a8a052f006b00a21f5
SHA1 cc620126c8ddaa94183a6fa8d60387db3613372a
SHA512 5d3d295f216dbb5b233531d5eeb19b902a66684924128ea51b735d8c53c81a04a4456d684d13cb820c78a28a727478ce21b7810c95b881b9fbe1a68f871e5de5
SSDEEP 196608:EP0vi/M5sv15fmmpLKHgKkL6qwSLTK+ZrYBB30Tdgr5ZjBxcO4TjV2VNAHPT1m+H:E8v4M5sv1FtAj29ThYMSJk2NETs+
TLSH
T16ED6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-2096.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-2096.exe
Size 12.9MB
SHA256 e3cf7504ec3047568ab4fb26121db2f5dd9bba0105ae33ad848adec52aaf5112
MD5 a434e72a3be4e7e97d48a7a968a23a8c
SHA1 cd0d129f18282d9d5bb044e4b8fe8278106b4743
SHA512 1ebca4079cc1e72cfbdb95848984b073028b1e429099847167032daaf1789f33b1282dc06ba3b4f9658dbaf7a3473b2a31ece34d176e1fd864352ccc4d2c0996
SSDEEP 196608:EP0vi/M5sv15fmmpLKHgKkL6qwSLTK+ZrYBB30Tdgr5ZjBxcO4CjV2VNAHPTzm+H:E8v4M5sv1FtAj29ThYMSJj2NET6+
TLSH
T1BDD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-21996.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-21996.exe
Size 12.9MB
SHA256 60f4b92f71bf6967322dbe1e09c76f78a9932ed7f90636f601fd072a47238f15
MD5 b3ab492fc66ba291f3880e352a229bae
SHA1 364f22f54b721a0fc5203d1b5b510434c9b044b6
SHA512 84e96e1884b448a78954e86d57fa8ae49adec065a7f3f20a13c80c0f86fc99c70c48a5c00e20bbe9a16e7a68d97bbf4a4f0649636281405bc0032d4ea95a2715
SSDEEP 196608:EP0vi/M5sv15fmmpL0HgKkL6qwSLTK+ZrYrB30Tdgr5ZjBxcO4TjV2VNAHPT1m+H:E8v4M5sv1Ftqj29ThSMSJk2NETs+
TLSH
T183D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-23237.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-23237.exe
Size 12.9MB
SHA256 d50047fe2251b6b3b61ef7080361389fdcf17153eab00852382da08510786882
MD5 008831a783c13a9f0435f350072a463b
SHA1 9192721a4094684d0f596e209a04549a0c27a243
SHA512 d215f7cfe8322aae66a5e66568c9a66311ffd30e06b907298e98a2523041cd33d15ffc04fe673bf5c6f86946205358d55ce0a684cac2d363a7cad1d9643b4d1f
SSDEEP 196608:EP0vi/M5sv15fmmpLKHgKkL6qwSLTK+ZrYBB30Tdgr5ZjBxcO4MjV2VNAHPT1m+H:E8v4M5sv1FtAj29ThYMSJN2NETs+
TLSH
T12AD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-24181.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-24181.exe
Size 12.9MB
SHA256 4c338f98aec73bc371d4ed6be98c97c6cf41982d05f18db58e405fe0cae914d1
MD5 e756fc35a5d02611edb6ba09914abc19
SHA1 c17abba8c283455b9224bbc1411ed86e71065532
SHA512 96f6b2fbb91ce5272b91d9a29eab3a38e3304ec5e72e6e7e88b46700e1ff792581f3c0c24adbbabc1e6a2812356f58fe774aaac1f255b8663f030643cb73e2ee
SSDEEP 196608:EP0vi/M5sv15fmmpLKHg5kL6qwSLTK+ZrYBB30Tdgr5ZjBxcO4TjV2VNAHPT1m+H:E8v4M5sv1FtAY29ThYMSJk2NETs+
TLSH
T16FD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-25418.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-25418.exe
Size 12.9MB
SHA256 eb6c52f06622025387952ced509efb21a4990be58686a760f15fce3e446f5f2c
MD5 ccffcacbf0afc8fa84877d343d880e9e
SHA1 6938fe0c09bda82419df5ac2f96b7b963eab35c8
SHA512 7323124636dfb2550fa4ab0864f3a7ef84d322d5210e3d8892c94e7b3fd5733fe5816d11bea500d90b40241b9224042b197c9d9dcc07772138122ee57a2ce3dd
SSDEEP 196608:EPfvi/M5sv15fmmpLKHgKkL6qwSLTK+ZrYBB30Tdgr5ZjBxcO4CjV2VNAHPTzmnH:Env4M5sv1FtAj29ThYMSJj2NET6n
TLSH
T1CAD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-2691.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-2691.exe
Size 12.9MB
SHA256 a9c61e2e8cb9c456a29db5ea68c9058f4f763836b4f15fd69cf421bf2f5156c8
MD5 155bca671bd0d156d8221ac3346de4a0
SHA1 b891722d39af0de1867da2d10be3caf39d34611b
SHA512 3978fa257aae2d7fd6faf63b8084e18411ae45a3e9b5fd169a701050de559eb23c297f27fe145c8f037788332d544a2d0ae28cd4b89c6ef3d5548438f7498720
SSDEEP 196608:EP0vi/M5Dv15fmmpLAHgKkL6qwSLTK+ZrYBB30Tdgr5ZjBxcO47jV2VNAHPT1m+H:E8v4M5Dv1FtOj29ThYMSJs2NETs+
TLSH
T11DD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-29782.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-29782.exe
Size 12.9MB
SHA256 c31f16aaa57615514162b8540a8bb589037005b6cf4632c819b6602b7aad2ccb
MD5 6ee101be9a995f1e981b97d578268f3f
SHA1 4909ed3dab6597a3b1f1b97c5fca00117242f933
SHA512 bd72a0bcc51964777381384db9733d34278f2c3cbbfc0ecef035b8b3754ddf24968e1e8b28ec875147e87495d93c36ef293165b42de76ea58c2953320f5b875d
SSDEEP 196608:EP0vi/M5Dv15fmmpLnHgKkL6qwSLTK+ZrYBB30Tdgr5ZjBxcO4TjV2VNAHPT1m+H:E8v4M5Dv1Ftjj29ThYMSJk2NETs+
TLSH
T15AD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-3139.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-3139.exe
Size 12.9MB
SHA256 413dd97bd283e7d9ac474122ef986b4475f4c9102e74afdedd8286c50df6dd51
MD5 2bfc0254390eb356974cf9f69c258592
SHA1 5d2adb8766692841089dd59bd11442f09eb867cb
SHA512 0e024992e894171186d96cd87154dab97e195b4a3ab456f6665b7ba9b1e5efa8ab113b2b1d2becdd77f422a270303a47eea74dbdf8c3290b26bbe519b7aa6498
SSDEEP 196608:EP0vi/M5sv15fmmpLKHgKkL6qwSLTK+ZrYBB30Tdgr5ZjBxcO4CjV2VNAHPTzmnH:E8v4M5sv1FtAj29ThYMSJj2NET6n
TLSH
T179D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-31962.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-31962.exe
Size 12.9MB
SHA256 af75064cb78e63e9575d197452d65a1c4482d4f7f2471a841f75e0871fc31213
MD5 af96e50716c1d90798cf2e19999ebac5
SHA1 79709b14410d2e3deff0f5cfda8fdcb975c6ea69
SHA512 d0adfb961934ca6e89fc1460c05df0152ef2e89824a2de045e65451256c510c63ecd98d4cb00d6499507cc249afca6c9bd137ee6f72f396e11bf8d9e633664e1
SSDEEP 196608:EP0vi/M5sv15fmmpL0HgKkL6qwSLTK+ZrYBB30Tdgr5ZjBxcO4TjV2VNAHPT1m+H:E8v4M5sv1Ftqj29ThYMSJk2NETs+
TLSH
T104D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-33226.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-33226.exe
Size 12.9MB
SHA256 59c64a8bf7ba1aac852c0153e4abe29c19d3f31c76cc5db648ad1ff29c5137c1
MD5 02152e86a1940f70bd79ff60a9af0e20
SHA1 67a6633dbdb583f05a1d12345031b1f335d8a7d8
SHA512 34c81e1e03e5da8d64b9fb5e99ae0d2a2a1364b0b7b21207d4897eb9fb839aceb077b4d83a2d21cfdf3cb34fa544eae121bbb24cde18294c5e5bdf13c7c04048
SSDEEP 196608:EP0vi/M5sv15fmmpLKHgKkL6qwSLsK+ZrYBB30Tdgr5ZjBxcO4sjV2VNAYPT1m+H:E8v4M5sv1FtAj29shYMSJt2NLTs+
TLSH
T118D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-34009.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-34009.exe
Size 12.9MB
SHA256 74d9f9bce5c228f457d30dff9cdf3c05e53a933f79f90773e5c9aa178bad049b
MD5 66f6bbd8b01b3f0a8c7211134c114e44
SHA1 8bbaff50d34caadfd3f380257f68a2bb4c006439
SHA512 ca583a5859aa331030b295c18654d7174c96badfcd349278e34868a75f7c14609bce8eb037ef9a817d5b6fcf067d2a47afd1569263ed688d9bccd393fb209334
SSDEEP 196608:EP0vi/M5Dv15fmmpLQHgKkL6qwSLTK+ZrYBB30Tdgr5ZjBxcO47jV2VNAHPT1m+H:E8v4M5Dv1Ftej29ThYMSJs2NETs+
TLSH
T111D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-35024.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-35024.exe
Size 12.9MB
SHA256 fd260246096bd61c42029bd0b224345aed598ada020fda836e804448257aa496
MD5 849655f611282653673b74208c10d540
SHA1 96a4eb576b2cb20142c063a4a805623d02504237
SHA512 d2971ee534479d65327d239659042d04a6c03a065ba31cd1e0a421c300e7465f9e4f0f22e9b5449948e7b5aaa7eb47c39a0d562f1ba9cfa5c88a3aa066801797
SSDEEP 196608:EP0vi/M5sv15fmmpLKHgKkL6qwSLTK+ZrYBB30Tdgr5ZjBxcO4CjV2VNAHPTzmnH:E8v4M5sv1FtAj29ThYMSJj2NET6n
TLSH
T1FDD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-36759.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-36759.exe
Size 12.9MB
SHA256 fd2d59ea351855ebcd0e46b38e4ec83919ed5f3fa404ba9fb54375335be50f04
MD5 29307abc696f96c7765afcb95a3617a6
SHA1 8ff59f0e7ed25dcdce8722a4abca86e913ea3eb2
SHA512 8bd1b33856aae4383245ba0329b9d4ae8b6ae2c11f9b24f8a13051087359ed990cf65f31830d0432f0a281a457127c5e7f16b65256604c60a96751def34e2b21
SSDEEP 196608:EP0vi/M5sv15fmmpLKHgKkL6qwSLTK+ZrYBB30Tdgr5ZjBxcO4C3V2VNAHPT1m+H:E8v4M5sv1FtAj29ThYMSJf2NETs+
TLSH
T19BD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-38093.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-38093.exe
Size 12.9MB
SHA256 c4d65c23c949f08250f165a18560f46c0f2f214f911500fd75159cfc29254284
MD5 46060b1f337d20fe813102ef0aca5cd7
SHA1 4956e2a2efd5870db7a21d69587d4057df342235
SHA512 fa7453f1c9a2ba88a43db932d1aa568baa204d8dbb3b442507086fe110593266a31bdaa764f5c81b1984f8440cf0c3808f2d0c06690a41c5242c8b6294a16f03
SSDEEP 196608:EP0v6/MNsv15fmmpLnHgKkL6qwSLTK+ZrYBB30Tdgr5ZjBxcO4TjV2VNAHPT1m+H:E8vgMNsv1Ftjj29ThYMSJk2NETs+
TLSH
T1F6D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-38639.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-38639.exe
Size 12.9MB
SHA256 e298881c5f5b5aa7d6b0d2fe4adf9a748bf27df5d44785ea169303a49ba0f8ed
MD5 65dc6e6f92528f9d2ec1aaf54661ab0b
SHA1 b8522fb316c1b9785adaf8e1d9ae2ce97296b692
SHA512 599b1ca31f3db283b1504cdc2d06a10e15dadf22da98c5cd8d72e92d5eef3cd2a458904e95df4b1879fba5a716350c348ed441d52d0dbbca61d47eb52a303042
SSDEEP 196608:EP0vi/M5sv15fmmpLKHgKkL6qwSmTK+ZrYBB30Tdgr5ZjBxcO4CjV2VNAHPT1m+H:E8v4M5sv1FtAj24ThYMSJj2NETs+
TLSH
T158D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-43801.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-43801.exe
Size 12.9MB
SHA256 dbb2fcf6642903976e6c0157333022a3e4f04e42f1e3a946c54298cbd100812b
MD5 cb88a3b14386d7f67da46925e937336a
SHA1 579e1ae022f46b4e9a6cba2ed8c73eb5eeaeec74
SHA512 ccf84d106009b1593677a484ae1db0c6b16b6c335601c1531bfbdc6f578fa03d7f897989f473f5512b9aa0de6951290fb895f83ff6c8537873a39e86639e8c88
SSDEEP 196608:EP0vB/M5sv15fmmpLKHgKkL6qwSLTK+ZrYBB30Tdgr5ZjBxcO4CjV2VNAHPTzmnH:E8vJM5sv1FtAj29ThYMSJj2NET6n
TLSH
T1F0D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-4590.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-4590.exe
Size 12.9MB
SHA256 cdd2a4c88a96cd3915fe819a1f5b07b5adaac9a10c4743bf2f09c8601046f8e5
MD5 a6f4d5a44a470ee621fd310f5296bf94
SHA1 94ad0f32e41f5f0bc83bab232160b365fdc93f92
SHA512 3ba770933b057b98e3aaa00a032353fefdb5fc6effd7c9eeabff2f58c422cbce7de74323487c580b8cdf79b20a93e65690c2105fd21445c12e2905f5a09609bc
SSDEEP 196608:EP0vi/M5sv15fmmpLKHgKVL6qwSL/K+ZrYBB30Tdgr5ZjBxcO4TjV2VNAHPT1m+H:E8v4M5sv1FtAjJ9/hYMSJk2NETs+
TLSH
T1DCD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-46393.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-46393.exe
Size 12.9MB
SHA256 842b878cfc5397ed2fa02e09150d57aa9064bdc4ca87a74e599a2f3ef5b31581
MD5 752afc03fbe89958940b3ea24a01937f
SHA1 0120d80f160a6da2df484c215cbf342a84744184
SHA512 5d1955bf5d9dc56d59ba0648a377e85a2f55e3901b74e1904da6f958e1161597682e55c5a9b85667c51be90a05247882866a3318e3b33f997e3dc14c3fe5a4f2
SSDEEP 196608:EP0vi/MNsv15fmmpLnHgKkL6qwSLTK+ZrYBB30Tdgr5ZjBxcO4TjV2VNAHPT1m+H:E8v4MNsv1Ftjj29ThYMSJk2NETs+
TLSH
T1F8D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-51414.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-51414.exe
Size 12.9MB
SHA256 c05eda448e78e1149b939b88fef736c1fe032da4ccf3132895efbb08880101bb
MD5 95ad21b854c98c66d5e3f89697ab45c9
SHA1 5eb9aa12acdb1bd8494005860ca62ed66819a90d
SHA512 706f76aa87843b24ae2b2ecf87f0c79f1e9ff6a7f542108043cd99bf6a96ccd5a8c80e9f40a7ccf73dbcf86db144a4d3423e6b665802ee71f90f38d27755bc09
SSDEEP 196608:EP0vi/M5sv15fmmpLKHgKkL6qwSL/K+ZrYBB30Tdgr5ZjBxcO4TjV2VNAHPT1m+H:E8v4M5sv1FtAj29/hYMSJk2NETs+
TLSH
T1DED6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-52236.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-52236.exe
Size 12.9MB
SHA256 b260c05814183b347602d5b67b09f6e825d79ab5db3f95358cebaf9bb28c6500
MD5 1f1f717dae37e3ee5967aca7e76ba3fc
SHA1 037f9a6864bcdd730c94345e31830ddaa733a1fa
SHA512 f44b7c27321fccc1d7c94c2ff55b04d92ecdbac5d2c7ff88d268920fd301efe28aa56ffde9fb732ea45818e25cebac149b6bd8ff3f72069f840fdc9015fb5661
SSDEEP 196608:EP0vi/M5sv15fmmpLKHgKkL6qwSLTK+ZrYBB30Tdgr5ZjBxcO4CjV2VNAHPT1m+H:E8v4M5sv1FtAj29ThYMSJj2NETs+
TLSH
T1BCD6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-53684.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-53684.exe
Size 12.9MB
SHA256 5924117cadb820574d54e74de66f2f9f756656e689366d09f72eb17fc0319be8
MD5 b6d8ab75c229e011257292442acfa3fa
SHA1 0ee0ff69a7305b63d7ebc77d1f7ec481c4b1e48a
SHA512 93581fea6021257f113d7c83a908eeefb2a4f1cf4ea21b56098095e5f885c51cfaf6af96e3ec6a2bb17a82c203dede8c01412f7511408f69c0707f19604deb31
SSDEEP 196608:EP0vi/M5sv15fmmpLKHgKkL6qwSLTK+ZrYBB30Tdgr5ZjBxcO4CjV2VNAHZTzm+H:E8v4M5sv1FtAj29ThYMSJj2NqT6+
TLSH
T118D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-54006.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-54006.exe
Size 12.9MB
SHA256 11a506dcea4ba520d59d679b61c55b6601ba3772c76f8a95abdf44f0f2847c40
MD5 0272aacd9bdef91a9d6b6fd5c0f69f9f
SHA1 cd44beb4b2946879cd40701a434d251beeebd6fc
SHA512 24ca1b9dcac1048872598a36b7fc3dca8372b1bb47aac3540436e45b252856bd8e373402092d1de14e8ae9108e0bce0ed1e5334269c51a623a3146ad0fe93333
SSDEEP 196608:EP0vi/M5Dv15fmmpLnHgKkL6qwSLTK+ZrYBB30Tdgr5ZjBxcO47jV2VNAHPT1m+H:E8v4M5Dv1Ftjj29ThYMSJs2NETs+
TLSH
T123D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-54429.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-54429.exe
Size 12.9MB
SHA256 cfb7c3445d18ad32c825fbf89ae3b67aa5424bc40e7874397c2882b69406a8f0
MD5 d322aa9001513dfb74d2f125ba3434a5
SHA1 3d9e6f66fbf0b2c7c8c73bbe81bd6b932d95555e
SHA512 3a85f80e1bbecf9677ed3616b31c867592dfbf5d8a03aa71402633e37b209e40ea9b7f748a127a46f71731d26245cc8a7df0c6d6ddc5bfcc28e790502bc92d4c
SSDEEP 196608:EP0vi/M5sv15fmmpLKHgKkL6qwSLTK+ZrYBB30Tdgr5ZjBxcO4sjV2VNAYPT1m+H:E8v4M5sv1FtAj29ThYMSJt2NLTs+
TLSH
T10ED6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-55059.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-55059.exe
Size 12.9MB
SHA256 04d7a9d440735883c3163f446b56083de336f5673beb6e349f0e1e0d45232673
MD5 a3d209359cf1caa4006e505ab63e35cb
SHA1 b7f6bd62922d5c9d52f494b136c3c50c35799ef1
SHA512 bc22ed244281b71a893a59a882c8c1c5f3eb648f16841c54b22196381fc6a40754b76831d058cbaa2edadd14455b54e5524ff08dee310d7e5d648b899cece742
SSDEEP 196608:EP0vi/M5sv15fmmpLnHgKkL6qwSLTK+ZrYBB30Tdgr5ZjBxcO4TjV2VNAHPT1m+H:E8v4M5sv1Ftjj29ThYMSJk2NETs+
TLSH
T146D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-55498.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-55498.exe
Size 12.9MB
SHA256 142a9570903a8e6c9e2ffc46add7992ac67a38ab65b0bfba438d94c76093749d
MD5 c02a467e468865dd7857aea596144925
SHA1 c6960fc055d172b315c92495c30cda2c053d1bb4
SHA512 52da8293d646089cc30cb1aec041fea591a4834bb98139a24099206506dadfd524f6180fa0e09b11f8e284a00e5a8d134c02ae1646de35bed28fe74f274a0cf0
SSDEEP 196608:EPfvi/M5sv15fmmpLKHgKkL6qwSLTK+ZrYBB30Tdgr5ZjBxcO4CMV2VNAHPTzmnH:Env4M5sv1FtAj29ThYMSJG2NET6n
TLSH
T105D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-61105.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-61105.exe
Size 12.9MB
SHA256 c04fdc6c2dd4c2931f9eca2e60a0296e10909634949e0b5c4786fd344faf7c5f
MD5 3b454332f6d78bbf8a5b3ded86620904
SHA1 68ebc90b6ea00d805ac802e183bffa177a015c3a
SHA512 af887b1a49fdfe13d7aa669f3802bd07ea69a0789c99a570f2054d73711e99506530d319b6ae3b8efac27d9543aea4022cd29bdc998941f5af92990087eb1117
SSDEEP 196608:EP0vi/M5sv15fmmpLKHgKkL6qwSLTK+ZrYBB30Tdgr5ZjBxcO4MjV2VNAYPT1m+H:E8v4M5sv1FtAj29ThYMSJN2NLTs+
TLSH
T174D6F125EAA44EB5F473913446A2DA66D2357C3A172087CF2398FA0A3F336D1643E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/620-563-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/800-573-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1064-576-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1160-574-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1312-266-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1476-570-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1640-2152-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1780-571-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2204-766-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2292-168-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2308-608-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2428-706-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2508-763-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2512-169-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2856-2234-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2860-607-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3224-334-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3292-360-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3344-556-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3756-648-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3816-252-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4328-649-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4348-1186-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4496-808-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4544-1008-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4668-575-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4688-1075-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4860-0-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4956-727-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5052-564-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5324-318-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5368-572-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5388-764-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5452-361-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5480-650-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5592-606-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5756-1009-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5996-651-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6236-2266-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6388-987-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6476-882-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6484-883-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6520-809-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6572-1263-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6588-1264-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6912-1350-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6952-1759-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7064-1078-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7120-2186-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7192-1265-0x0000000000400000-0x0000000000475000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads