kawaiiunicorn | 4718b46f51d82284cdf18b7e67d727831f04ac5c64186b50e2429972adbfcd20

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 17:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_1d16a822724ac5f12fa37dc9f26bea8e_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe
Size 4.9MB
Sample260905-vjf5eawsfv
SHA256 4718b46f51d82284cdf18b7e67d727831f04ac5c64186b50e2429972adbfcd20
MD5 1d16a822724ac5f12fa37dc9f26bea8e
SHA1 801b972dada9f8d85b06f57040cdc76f8d16b1cd
SHA512 afc82220a23b1009562afea6e4a433e13aad9a96ef04ae2d9b5d37913d9586b39c9bb1a089f6e48fc3e87141475ee7370acaeccde1f9cfb409e5cb71315d4e93
SSDEEP 98304:EPbisScCqzCtvWq/Zi6DYfnDKyMc0L/qHgWDuu/nimSqw:EPbvl/wn/Z1sfnmpLCHgWDL6qw
TLSH
T1A136E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery kawaiiunicorn trojan

Malware Config

Signatures

Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
trojan kawaiiunicorn

Detects KawaiiUnicorn 64 IoCs

resource	yara_rule
behavioral2/memory/4148-0-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/52-24-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4824-44-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2724-108-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3532-184-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1972-183-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/896-267-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1500-251-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2104-244-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1740-402-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5896-427-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2024-446-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4796-492-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1924-496-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3040-510-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1376-532-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5928-509-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5984-506-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1528-495-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5960-494-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2880-493-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4744-428-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2428-569-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4144-548-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2464-611-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/944-610-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1144-748-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6184-746-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1544-736-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1052-803-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6476-859-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6744-1224-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6564-1291-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6316-1290-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6936-1289-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/796-1287-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6200-1286-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4816-1284-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6216-1283-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2600-1282-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6720-1281-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6928-1280-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6628-1279-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6272-1278-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6964-1223-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6596-1222-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6752-1221-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6728-1220-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6712-1219-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6484-1218-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6684-1211-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6676-1210-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6704-1217-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6660-1136-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6492-888-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6304-887-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6508-886-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6540-860-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6376-802-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1448-801-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5480-800-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4580-1428-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7276-1480-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6844-1525-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 33 IoCs

resource	yara_rule
behavioral2/files/0x0006000000000405-6.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000e00000001c521-11.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000e00000001c522-21.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c525-28.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c527-41.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c526-45.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c528-46.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c529-59.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c52a-64.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c52b-72.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c52d-94.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c52e-88.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c530-90.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c52c-103.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c52f-106.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c531-112.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c537-148.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c532-165.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c536-178.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c53c-187.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c53b-196.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c53a-185.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c53e-182.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c539-175.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c533-159.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c53d-157.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c535-207.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c534-208.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c53f-235.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c546-221.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c548-214.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c543-234.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c544-222.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Executes dropped EXE 15 IoCs

pid	Process
4592	Unicorn-45124.exe
4600	Unicorn-38466.exe
52	Unicorn-37074.exe
1760	Unicorn-2114.exe
3580	Unicorn-31449.exe
3044	Unicorn-47231.exe
4824	Unicorn-15527.exe
2740	Unicorn-42436.exe
5980	Unicorn-10318.exe
5316	Unicorn-29307.exe
2808	Unicorn-13006.exe
5000	Unicorn-25524.exe
800	Unicorn-46691.exe
2640	Unicorn-48082.exe
2724	Unicorn-10924.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
11400	1528	WerFault.exe	169
14028	7040	WerFault.exe	252
15256	1528	WerFault.exe	169
8720	7040	WerFault.exe	252

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25524.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46691.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_1d16a822724ac5f12fa37dc9f26bea8e_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37074.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31449.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10318.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13006.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10924.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38466.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15527.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42436.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48082.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2114.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45124.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29307.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
4148	2026-09-04_1d16a822724ac5f12fa37dc9f26bea8e_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe
4592	Unicorn-45124.exe
4600	Unicorn-38466.exe
52	Unicorn-37074.exe
1760	Unicorn-2114.exe
3580	Unicorn-31449.exe
4824	Unicorn-15527.exe
3044	Unicorn-47231.exe
2740	Unicorn-42436.exe
5980	Unicorn-10318.exe
5316	Unicorn-29307.exe
2808	Unicorn-13006.exe
5000	Unicorn-25524.exe
800	Unicorn-46691.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 4592	4148	2026-09-04_1d16a822724ac5f12fa37dc9f26bea8e_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe	89
PID 4592 wrote to memory of 4600	4592	Unicorn-45124.exe	90
PID 4148 wrote to memory of 52	4148	2026-09-04_1d16a822724ac5f12fa37dc9f26bea8e_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe	91
PID 4600 wrote to memory of 1760	4600	Unicorn-38466.exe	92
PID 4592 wrote to memory of 3580	4592	Unicorn-45124.exe	93
PID 52 wrote to memory of 3044	52	Unicorn-37074.exe	94
PID 4148 wrote to memory of 4824	4148	2026-09-04_1d16a822724ac5f12fa37dc9f26bea8e_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe	95
PID 1760 wrote to memory of 2740	1760	Unicorn-2114.exe	96
PID 4600 wrote to memory of 5980	4600	Unicorn-38466.exe	97
PID 3580 wrote to memory of 5316	3580	Unicorn-31449.exe	98
PID 4148 wrote to memory of 2808	4148	2026-09-04_1d16a822724ac5f12fa37dc9f26bea8e_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe	99
PID 4824 wrote to memory of 5000	4824	Unicorn-15527.exe	100
PID 52 wrote to memory of 800	52	Unicorn-37074.exe	101
PID 3044 wrote to memory of 2640	3044	Unicorn-47231.exe	103
PID 4592 wrote to memory of 2724	4592	Unicorn-45124.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-04_1d16a822724ac5f12fa37dc9f26bea8e_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_1d16a822724ac5f12fa37dc9f26bea8e_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45124.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45124.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38466.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38466.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2114.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42436.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34180.exe
        6⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47527.exe
        7⤵
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62584.exe
        8⤵
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26425.exe
        9⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51495.exe
        10⤵
        
        PID:9496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1821.exe
        10⤵
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26175.exe
        9⤵
        
        PID:9444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40202.exe
        9⤵
        
        PID:12444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14596.exe
        9⤵
        
        PID:9136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39916.exe
        8⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11038.exe
        9⤵
        
        PID:10192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28817.exe
        9⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exe
        8⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40028.exe
        8⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29890.exe
        7⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-275.exe
        8⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34370.exe
        9⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15115.exe
        10⤵
        
        PID:13896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31396.exe
        9⤵
        
        PID:11464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4128.exe
        9⤵
        
        PID:14112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50768.exe
        8⤵
        
        PID:8948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58833.exe
        8⤵
        
        PID:12944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48582.exe
        7⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33488.exe
        8⤵
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3908.exe
        8⤵
        
        PID:12460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16432.exe
        8⤵
        
        PID:12620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64909.exe
        7⤵
        
        PID:10236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33831.exe
        7⤵
        
        PID:12968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27661.exe
        6⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17297.exe
        7⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25408.exe
        8⤵
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38578.exe
        8⤵
        
        PID:11688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25313.exe
        8⤵
        
        PID:8648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44136.exe
        7⤵
        
        PID:9592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45869.exe
        7⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43772.exe
        7⤵
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52199.exe
        6⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32725.exe
        7⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        7⤵
        
        PID:11588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53578.exe
        7⤵
        
        PID:9156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45947.exe
        6⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17856.exe
        7⤵
        
        PID:13880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46006.exe
        6⤵
        
        PID:11660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38326.exe
        6⤵
        
        PID:15280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49125.exe
        5⤵
        
        PID:4464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27927.exe
        6⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61022.exe
        7⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15236.exe
        8⤵
        
        PID:8788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55292.exe
        9⤵
        
        PID:14260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        8⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17641.exe
        8⤵
        
        PID:14244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44572.exe
        7⤵
        
        PID:8392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12702.exe
        8⤵
        
        PID:13980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9724.exe
        7⤵
        
        PID:10712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59443.exe
        7⤵
        
        PID:3304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51463.exe
        6⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12439.exe
        7⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25990.exe
        8⤵
        
        PID:13840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1168.exe
        7⤵
        
        PID:10740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15560.exe
        7⤵
        
        PID:15176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39750.exe
        6⤵
        
        PID:6280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25486.exe
        6⤵
        
        PID:11520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36304.exe
        6⤵
        
        PID:15156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31033.exe
        5⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32953.exe
        6⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54245.exe
        7⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29404.exe
        8⤵
        
        PID:9992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9989.exe
        8⤵
        
        PID:10760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10901.exe
        8⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30342.exe
        7⤵
        
        PID:9932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56943.exe
        7⤵
        
        PID:12852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57431.exe
        6⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42128.exe
        7⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4119.exe
        8⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7058.exe
        7⤵
        
        PID:12384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57662.exe
        7⤵
        
        PID:2372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42521.exe
        6⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24649.exe
        7⤵
        
        PID:3688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54671.exe
        6⤵
        
        PID:11972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34441.exe
        6⤵
        
        PID:9052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42994.exe
        5⤵
        
        PID:3212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63290.exe
        6⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17157.exe
        7⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14074.exe
        7⤵
        
        PID:11904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4128.exe
        7⤵
        
        PID:14128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19076.exe
        6⤵
        
        PID:9668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52859.exe
        6⤵
        
        PID:560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18390.exe
        6⤵
        
        PID:3548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30047.exe
        5⤵
        
        PID:6712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29134.exe
        6⤵
        
        PID:7224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        6⤵
        
        PID:11416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38119.exe
        6⤵
        
        PID:15184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33984.exe
        5⤵
        
        PID:8348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47579.exe
        5⤵
        
        PID:1904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8465.exe
        5⤵
        
        PID:15880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10318.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59753.exe
        5⤵
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4452.exe
        6⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48708.exe
        7⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12792.exe
        8⤵
        
        PID:10148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27940.exe
        8⤵
        
        PID:13740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30918.exe
        7⤵
        
        PID:9724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32547.exe
        7⤵
        
        PID:12240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10647.exe
        6⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51749.exe
        7⤵
        
        PID:8488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26766.exe
        7⤵
        
        PID:13560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56684.exe
        6⤵
        
        PID:10044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44356.exe
        6⤵
        
        PID:7324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44830.exe
        5⤵
        
        PID:5728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60192.exe
        6⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
        7⤵
        
        PID:9056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60149.exe
        8⤵
        
        PID:14252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        7⤵
        
        PID:11816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4128.exe
        7⤵
        
        PID:14120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5542.exe
        6⤵
        
        PID:9204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
        6⤵
        
        PID:11740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47675.exe
        5⤵
        
        PID:6484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50872.exe
        6⤵
        
        PID:6980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5905.exe
        6⤵
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58919.exe
        6⤵
        
        PID:16244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30011.exe
        5⤵
        
        PID:9488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23985.exe
        5⤵
        
        PID:14204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5491.exe
      4⤵
      PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48914.exe
        5⤵
        
        PID:936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59424.exe
        6⤵
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-633.exe
        7⤵
        
        PID:7436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7707.exe
        8⤵
        
        PID:13948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57037.exe
        7⤵
        
        PID:11092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46100.exe
        7⤵
        
        PID:14080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61764.exe
        6⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8151.exe
        7⤵
        
        PID:13956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18604.exe
        6⤵
        
        PID:10856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14841.exe
        6⤵
        
        PID:12660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8012.exe
        5⤵
        
        PID:6376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38288.exe
        6⤵
        
        PID:7736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24488.exe
        7⤵
        
        PID:13648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8926.exe
        6⤵
        
        PID:11128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20713.exe
        6⤵
        
        PID:15368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35880.exe
        5⤵
        
        PID:7796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17441.exe
        6⤵
        
        PID:14664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49760.exe
        5⤵
        
        PID:11872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36835.exe
        5⤵
        
        PID:14776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18424.exe
      4⤵
      PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33804.exe
        5⤵
        
        PID:2124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32647.exe
        6⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25765.exe
        7⤵
        
        PID:10052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52392.exe
        7⤵
        
        PID:12508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64290.exe
        7⤵
        
        PID:7300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26175.exe
        6⤵
        
        PID:7784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31779.exe
        6⤵
        
        PID:4248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8998.exe
        5⤵
        
        PID:6524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43232.exe
        6⤵
        
        PID:12560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51665.exe
        5⤵
        
        PID:10568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63720.exe
        5⤵
        
        PID:14188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37255.exe
      4⤵
      PID:6424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38537.exe
        5⤵
        
        PID:7972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29693.exe
        6⤵
        
        PID:2720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36113.exe
        5⤵
        
        PID:12328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57662.exe
        5⤵
        
        PID:14768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
      4⤵
      PID:9568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64984.exe
      4⤵
      PID:12312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46772.exe
      4⤵
      PID:15224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31449.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31449.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29307.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5399.exe
        5⤵
        
        PID:704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27661.exe
        6⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37250.exe
        7⤵
        
        PID:352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12091.exe
        8⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        9⤵
        
        PID:15676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17649.exe
        8⤵
        
        PID:10660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38311.exe
        8⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42495.exe
        7⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45951.exe
        8⤵
        
        PID:14160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32308.exe
        7⤵
        
        PID:10788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9990.exe
        7⤵
        
        PID:13024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-477.exe
        7⤵
        
        PID:13144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14783.exe
        6⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54624.exe
        7⤵
        
        PID:8360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49999.exe
        8⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52564.exe
        7⤵
        
        PID:11700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20796.exe
        7⤵
        
        PID:8588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48630.exe
        6⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34026.exe
        7⤵
        
        PID:15272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37261.exe
        6⤵
        
        PID:11680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23360.exe
        6⤵
        
        PID:14784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64361.exe
        5⤵
        
        PID:3828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16233.exe
        6⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14006.exe
        7⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23872.exe
        8⤵
        
        PID:9096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34571.exe
        9⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35070.exe
        8⤵
        
        PID:11632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42696.exe
        8⤵
        
        PID:14612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54743.exe
        7⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-368.exe
        7⤵
        
        PID:12492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58743.exe
        7⤵
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41395.exe
        6⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30478.exe
        7⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37696.exe
        7⤵
        
        PID:12484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41348.exe
        7⤵
        
        PID:14436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32811.exe
        6⤵
        
        PID:9332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62808.exe
        6⤵
        
        PID:4240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28576.exe
        5⤵
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47255.exe
        6⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17152.exe
        7⤵
        
        PID:9548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60805.exe
        7⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43252.exe
        7⤵
        
        PID:15564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10498.exe
        6⤵
        
        PID:9732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18410.exe
        6⤵
        
        PID:12748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60996.exe
        5⤵
        
        PID:6752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41085.exe
        6⤵
        
        PID:8312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11059.exe
        6⤵
        
        PID:11276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36666.exe
        6⤵
        
        PID:16280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24199.exe
        5⤵
        
        PID:9700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39340.exe
        5⤵
        
        PID:12452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4562.exe
        5⤵
        
        PID:5956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57293.exe
      4⤵
      PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47527.exe
        5⤵
        
        PID:2348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54608.exe
        6⤵
        
        PID:256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16477.exe
        7⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20674.exe
        8⤵
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22802.exe
        7⤵
        
        PID:10688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63635.exe
        7⤵
        
        PID:14056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50197.exe
        6⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46124.exe
        7⤵
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22896.exe
        7⤵
        
        PID:2100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17627.exe
        6⤵
        
        PID:8564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29176.exe
        6⤵
        
        PID:13092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10576.exe
        6⤵
        
        PID:16064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33865.exe
        5⤵
        
        PID:1832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26865.exe
        6⤵
        
        PID:8376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53383.exe
        6⤵
        
        PID:12028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-783.exe
        6⤵
        
        PID:7332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19822.exe
        5⤵
        
        PID:7516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38001.exe
        6⤵
        
        PID:14004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24853.exe
        5⤵
        
        PID:8704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24760.exe
        5⤵
        
        PID:12772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46256.exe
        5⤵
        
        PID:13004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41397.exe
      4⤵
      PID:5836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38956.exe
        5⤵
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49663.exe
        6⤵
        
        PID:8444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61526.exe
        6⤵
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37264.exe
        6⤵
        
        PID:9556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23387.exe
        5⤵
        
        PID:8060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54252.exe
        5⤵
        
        PID:13832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45298.exe
      4⤵
      PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10747.exe
        5⤵
        
        PID:7572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe
        6⤵
        
        PID:14104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19922.exe
        5⤵
        
        PID:11232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16377.exe
        5⤵
        
        PID:13628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13192.exe
      4⤵
      PID:7428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17820.exe
        5⤵
        
        PID:7596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51868.exe
      4⤵
      PID:2712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15371.exe
      4⤵
      PID:13924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10924.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10924.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33111.exe
      4⤵
      PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45332.exe
        5⤵
        
        PID:2504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56497.exe
        6⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31796.exe
        7⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34178.exe
        8⤵
        
        PID:8080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-450.exe
        9⤵
        
        PID:13996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        8⤵
        
        PID:9712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54652.exe
        8⤵
        
        PID:14036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59429.exe
        7⤵
        
        PID:8768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31893.exe
        7⤵
        
        PID:11896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60071.exe
        7⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43533.exe
        6⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5994.exe
        7⤵
        
        PID:9436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53519.exe
        7⤵
        
        PID:12428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56579.exe
        8⤵
        
        PID:16316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44710.exe
        7⤵
        
        PID:15592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
        6⤵
        
        PID:9460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61739.exe
        6⤵
        
        PID:12856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57244.exe
        5⤵
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18859.exe
        6⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51853.exe
        7⤵
        
        PID:8676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1407.exe
        7⤵
        
        PID:11776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13233.exe
        6⤵
        
        PID:10616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20378.exe
        6⤵
        
        PID:13204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44384.exe
        6⤵
        
        PID:9188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58914.exe
        5⤵
        
        PID:6744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59786.exe
        6⤵
        
        PID:14400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13866.exe
        5⤵
        
        PID:10888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34957.exe
        5⤵
        
        PID:13636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46956.exe
      4⤵
      PID:4224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55703.exe
        5⤵
        
        PID:3336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47255.exe
        6⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24583.exe
        7⤵
        
        PID:8464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28982.exe
        8⤵
        
        PID:15812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65221.exe
        7⤵
        
        PID:11888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21782.exe
        7⤵
        
        PID:7928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45257.exe
        6⤵
        
        PID:8068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28110.exe
        7⤵
        
        PID:14212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48147.exe
        6⤵
        
        PID:11864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53880.exe
        6⤵
        
        PID:15396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55101.exe
        5⤵
        
        PID:6628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
        6⤵
        
        PID:9140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10239.exe
        6⤵
        
        PID:12436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19090.exe
        6⤵
        
        PID:14688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58603.exe
        5⤵
        
        PID:9748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23509.exe
        5⤵
        
        PID:12472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23772.exe
        5⤵
        
        PID:8000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6594.exe
      4⤵
      PID:3040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48708.exe
        5⤵
        
        PID:6660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60974.exe
        6⤵
        
        PID:6548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2517.exe
        5⤵
        
        PID:10908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9963.exe
        5⤵
        
        PID:5828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52719.exe
      4⤵
      PID:6676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12433.exe
        5⤵
        
        PID:11016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27956.exe
      4⤵
      PID:9512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55013.exe
      4⤵
      PID:3556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35861.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35861.exe
    3⤵
    PID:1196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45332.exe
      4⤵
      PID:4656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8147.exe
        5⤵
        
        PID:2428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26425.exe
        6⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22191.exe
        7⤵
        
        PID:10340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61791.exe
        7⤵
        
        PID:11336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5036.exe
        7⤵
        
        PID:7964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55610.exe
        6⤵
        
        PID:10936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20378.exe
        6⤵
        
        PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41836.exe
        5⤵
        
        PID:4580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38532.exe
        6⤵
        
        PID:8252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4313.exe
        6⤵
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19494.exe
        6⤵
        
        PID:10184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43004.exe
        5⤵
        
        PID:10320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-286.exe
        5⤵
        
        PID:12988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4509.exe
      4⤵
      PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4634.exe
        5⤵
        
        PID:7144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62185.exe
        6⤵
        
        PID:9600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65491.exe
        6⤵
        
        PID:13308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7901.exe
        6⤵
        
        PID:16200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32288.exe
        5⤵
        
        PID:9028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12293.exe
        5⤵
        
        PID:14020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22131.exe
      4⤵
      PID:7284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63906.exe
        5⤵
        
        PID:14088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36316.exe
      4⤵
      PID:11188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63655.exe
      4⤵
      PID:12568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18996.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18996.exe
    3⤵
    PID:5252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46248.exe
      4⤵
      PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24370.exe
        5⤵
        
        PID:7276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9653.exe
        6⤵
        
        PID:13964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36393.exe
        5⤵
        
        PID:8712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27648.exe
        5⤵
        
        PID:7384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4909.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4909.exe
      4⤵
      PID:6960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17389.exe
        5⤵
        
        PID:13780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30725.exe
      4⤵
      PID:8660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11311.exe
      4⤵
      PID:2280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-362.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-362.exe
    3⤵
    PID:5480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55885.exe
      4⤵
      PID:6984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37539.exe
        5⤵
        
        PID:14196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30586.exe
      4⤵
      PID:10284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38606.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38606.exe
    3⤵
    PID:9036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12009.exe
      4⤵
      PID:4080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2355.exe
      4⤵
      PID:7748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62530.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62530.exe
    3⤵
    PID:11768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52833.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52833.exe
    3⤵
    PID:8020
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37074.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37074.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:52
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47231.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47231.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48082.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8606.exe
        5⤵
        
        PID:4120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-581.exe
        6⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14006.exe
        7⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63792.exe
        8⤵
        
        PID:14620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41525.exe
        7⤵
        
        PID:10008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13689.exe
        7⤵
        
        PID:13300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29382.exe
        7⤵
        
        PID:2360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34104.exe
        6⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62803.exe
        7⤵
        
        PID:12276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39266.exe
        7⤵
        
        PID:14292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1976.exe
        6⤵
        
        PID:8860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28107.exe
        6⤵
        
        PID:5644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42138.exe
        6⤵
        
        PID:14384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49460.exe
        5⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28179.exe
        6⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48563.exe
        7⤵
        
        PID:9692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61407.exe
        7⤵
        
        PID:13284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45432.exe
        7⤵
        
        PID:8040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49694.exe
        6⤵
        
        PID:9964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34493.exe
        6⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44109.exe
        6⤵
        
        PID:8616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63849.exe
        5⤵
        
        PID:6888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-597.exe
        6⤵
        
        PID:9792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6643.exe
        6⤵
        
        PID:5796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44321.exe
        6⤵
        
        PID:15944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32834.exe
        5⤵
        
        PID:10600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46084.exe
        5⤵
        
        PID:12796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53574.exe
        5⤵
        
        PID:11024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9161.exe
      4⤵
      PID:5876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39359.exe
        5⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9730.exe
        6⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25953.exe
        7⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52460.exe
        7⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49133.exe
        7⤵
        
        PID:13816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28453.exe
        6⤵
        
        PID:7176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31384.exe
        6⤵
        
        PID:10420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30445.exe
        6⤵
        
        PID:13800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44001.exe
        5⤵
        
        PID:6176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45178.exe
        6⤵
        
        PID:12596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43497.exe
        5⤵
        
        PID:10332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41319.exe
        5⤵
        
        PID:2396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18789.exe
      4⤵
      PID:1812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46248.exe
        5⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15984.exe
        6⤵
        
        PID:7840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42988.exe
        7⤵
        
        PID:16328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31894.exe
        6⤵
        
        PID:10088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9530.exe
        6⤵
        
        PID:2108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30403.exe
        5⤵
        
        PID:7448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38927.exe
        6⤵
        
        PID:12096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28439.exe
        5⤵
        
        PID:12140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35318.exe
        5⤵
        
        PID:9176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9273.exe
      4⤵
      PID:1552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7841.exe
        5⤵
        
        PID:6296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15006.exe
        6⤵
        
        PID:13908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55335.exe
        5⤵
        
        PID:8872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46209.exe
        5⤵
        
        PID:14180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44028.exe
      4⤵
      PID:7152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61184.exe
        5⤵
        
        PID:13824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5469.exe
      4⤵
      PID:10928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18108.exe
      4⤵
      PID:10784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46691.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46691.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42348.exe
      4⤵
      PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47527.exe
        5⤵
        
        PID:4632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46248.exe
        6⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12418.exe
        7⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42507.exe
        8⤵
        
        PID:9828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18812.exe
        8⤵
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17678.exe
        8⤵
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1344.exe
        7⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41676.exe
        7⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58919.exe
        7⤵
        
        PID:15416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62449.exe
        6⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22599.exe
        7⤵
        
        PID:13660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51665.exe
        6⤵
        
        PID:10560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60068.exe
        6⤵
        
        PID:2196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38385.exe
        5⤵
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3237.exe
        6⤵
        
        PID:14804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16034.exe
        6⤵
        
        PID:8204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22200.exe
        5⤵
        
        PID:11260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22841.exe
        5⤵
        
        PID:13612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31508.exe
      4⤵
      PID:1740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20914.exe
        5⤵
        
        PID:1448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24282.exe
        6⤵
        
        PID:8932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        6⤵
        
        PID:11408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4128.exe
        6⤵
        
        PID:14136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44463.exe
        5⤵
        
        PID:8924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28136.exe
        6⤵
        
        PID:13848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16543.exe
        5⤵
        
        PID:12164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39900.exe
        5⤵
        
        PID:12636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-913.exe
      4⤵
      PID:6148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45574.exe
        5⤵
        
        PID:9628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5491.exe
        5⤵
        
        PID:12640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29867.exe
        5⤵
        
        PID:856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21734.exe
      4⤵
      PID:10036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13212.exe
      4⤵
      PID:2776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31745.exe
      4⤵
      PID:9180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36218.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36218.exe
    3⤵
    PID:1972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37164.exe
      4⤵
      PID:1500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22263.exe
        5⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63290.exe
        6⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20691.exe
        7⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9272.exe
        8⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4328.exe
        7⤵
        
        PID:10948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20378.exe
        7⤵
        
        PID:13212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12017.exe
        7⤵
        
        PID:16172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58687.exe
        6⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41457.exe
        7⤵
        
        PID:13888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65427.exe
        6⤵
        
        PID:10352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35437.exe
        6⤵
        
        PID:14096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39724.exe
        5⤵
        
        PID:6952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59007.exe
        6⤵
        
        PID:14152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22365.exe
        5⤵
        
        PID:11252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49160.exe
        5⤵
        
        PID:13808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38276.exe
      4⤵
      PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22559.exe
        5⤵
        
        PID:6684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22599.exe
        6⤵
        
        PID:13716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
        5⤵
        
        PID:9564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48068.exe
        5⤵
        
        PID:15140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17196.exe
      4⤵
      PID:6704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62102.exe
        5⤵
        
        PID:9220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53519.exe
        5⤵
        
        PID:12320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39105.exe
        5⤵
        
        PID:7712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30535.exe
      4⤵
      PID:9504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29747.exe
      4⤵
      PID:932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56096.exe
      4⤵
      PID:10076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14340.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14340.exe
    3⤵
    PID:1700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57566.exe
      4⤵
      PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3124.exe
        5⤵
        
        PID:1872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46648.exe
        6⤵
        
        PID:8508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63792.exe
        7⤵
        
        PID:15572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34411.exe
        6⤵
        
        PID:11448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56257.exe
        6⤵
        
        PID:12792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43009.exe
        5⤵
        
        PID:8960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62614.exe
        6⤵
        
        PID:15668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22573.exe
        5⤵
        
        PID:11432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23507.exe
        5⤵
        
        PID:14228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32433.exe
      4⤵
      PID:6728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6186.exe
        5⤵
        
        PID:8012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51485.exe
        5⤵
        
        PID:3696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11431.exe
      4⤵
      PID:9428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21090.exe
      4⤵
      PID:3084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2642.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2642.exe
    3⤵
    PID:1528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35963
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35963
      4⤵
      PID:7040
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7040 -s 600
        5⤵
        Program crash
        
        PID:14028
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7040 -s 600
        5⤵
        Program crash
        
        PID:8720
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 732
      4⤵
      Program crash
      PID:11400
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 732
      4⤵
      Program crash
      PID:15256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34425.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34425.exe
    3⤵
    PID:6928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2019.exe
      4⤵
      PID:8696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53514.exe
      4⤵
      PID:1088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30433.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30433.exe
    3⤵
    PID:10000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17875.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17875.exe
    3⤵
    PID:12172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31329.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31329.exe
    3⤵
    PID:3520
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15527.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15527.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25524.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25524.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5399.exe
      4⤵
      PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45332.exe
        5⤵
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36344.exe
        6⤵
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20867.exe
        7⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41557.exe
        8⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19891.exe
        8⤵
        
        PID:11784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37242.exe
        8⤵
        
        PID:14672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61463.exe
        7⤵
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44708.exe
        8⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34129.exe
        8⤵
        
        PID:10872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35298.exe
        7⤵
        
        PID:11212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3963.exe
        7⤵
        
        PID:14064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33865.exe
        6⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18724.exe
        7⤵
        
        PID:796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41085.exe
        8⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52968.exe
        8⤵
        
        PID:12936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29278.exe
        7⤵
        
        PID:9072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20793.exe
        7⤵
        
        PID:11528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44831.exe
        7⤵
        
        PID:15232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10647.exe
        6⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41369.exe
        7⤵
        
        PID:14048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30670.exe
        6⤵
        
        PID:11244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54592.exe
        6⤵
        
        PID:14072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5054.exe
        5⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53778.exe
        6⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16664.exe
        7⤵
        
        PID:9040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
        7⤵
        
        PID:8272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20378.exe
        7⤵
        
        PID:13196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42552.exe
        7⤵
        
        PID:7416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1204.exe
        6⤵
        
        PID:9396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43540.exe
        6⤵
        
        PID:13756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35396.exe
        5⤵
        
        PID:6368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4041.exe
        6⤵
        
        PID:13856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7841.exe
        5⤵
        
        PID:7520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59304.exe
        6⤵
        
        PID:10488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15367.exe
        5⤵
        
        PID:11800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46110.exe
        5⤵
        
        PID:16260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46956.exe
      4⤵
      PID:2400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17987.exe
        5⤵
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23545.exe
        6⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12906.exe
        7⤵
        
        PID:8436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30025.exe
        8⤵
        
        PID:13988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2808.exe
        7⤵
        
        PID:12156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36091.exe
        7⤵
        
        PID:15240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33004.exe
        6⤵
        
        PID:9108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8509.exe
        7⤵
        
        PID:13872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15.exe
        6⤵
        
        PID:11472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38447.exe
        6⤵
        
        PID:14792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46850.exe
        5⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13591.exe
        6⤵
        
        PID:7272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48006.exe
        7⤵
        
        PID:13972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64432.exe
        6⤵
        
        PID:11484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39105.exe
        6⤵
        
        PID:14272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22344.exe
        5⤵
        
        PID:8368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26659.exe
        5⤵
        
        PID:11752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27280.exe
        5⤵
        
        PID:15288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31399.exe
      4⤵
      PID:5896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-493.exe
        5⤵
        
        PID:1544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45771.exe
        6⤵
        
        PID:8532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12325.exe
        6⤵
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49494.exe
        6⤵
        
        PID:16220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14421.exe
        5⤵
        
        PID:7564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3388.exe
        5⤵
        
        PID:11496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36475.exe
        5⤵
        
        PID:15696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53513.exe
      4⤵
      PID:6636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56950.exe
      4⤵
      PID:10356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37607.exe
      4⤵
      PID:11988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58195.exe
      4⤵
      PID:13380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61377.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61377.exe
    3⤵
    PID:1736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64932.exe
      4⤵
      PID:5976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33804.exe
        5⤵
        
        PID:2804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12802.exe
        6⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60115.exe
        7⤵
        
        PID:13792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59694.exe
        6⤵
        
        PID:9768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59683.exe
        6⤵
        
        PID:12500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16865.exe
        6⤵
        
        PID:7460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38328.exe
        5⤵
        
        PID:7304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5489.exe
        6⤵
        
        PID:14572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5235.exe
        5⤵
        
        PID:10956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41319.exe
        5⤵
        
        PID:12920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43316.exe
        5⤵
        
        PID:7336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54971.exe
      4⤵
      PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49175.exe
        5⤵
        
        PID:4584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38204.exe
        5⤵
        
        PID:10576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35454.exe
        5⤵
        
        PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18390.exe
        5⤵
        
        PID:8208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10647.exe
      4⤵
      PID:6200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63233.exe
        5⤵
        
        PID:8232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55190.exe
        5⤵
        
        PID:11960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53578.exe
        5⤵
        
        PID:9020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20804.exe
      4⤵
      PID:10016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28764.exe
        5⤵
        
        PID:13032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63790.exe
      4⤵
      PID:12220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59837.exe
      4⤵
      PID:7200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14754.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14754.exe
    3⤵
    PID:4820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56388.exe
      4⤵
      PID:2024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28781.exe
        5⤵
        
        PID:6392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38921.exe
        6⤵
        
        PID:8892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22242.exe
        6⤵
        
        PID:12120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38202.exe
        6⤵
        
        PID:15264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31930.exe
        5⤵
        
        PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23974.exe
        5⤵
        
        PID:12392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10425.exe
        5⤵
        
        PID:4832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27389.exe
      4⤵
      PID:6452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24723.exe
        5⤵
        
        PID:6908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7058.exe
        5⤵
        
        PID:12296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7901.exe
        5⤵
        
        PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24669.exe
      4⤵
      PID:10024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10146.exe
        5⤵
        
        PID:12820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24892.exe
        5⤵
        
        PID:8684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19554.exe
      4⤵
      PID:12420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31619.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31619.exe
    3⤵
    PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7566.exe
      4⤵
      PID:6824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25012.exe
        5⤵
        
        PID:14560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59694.exe
      4⤵
      PID:10388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42553.exe
      4⤵
      PID:10996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9153.exe
      4⤵
      PID:13180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1734.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1734.exe
    3⤵
    PID:6916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59900.exe
      4⤵
      PID:14580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1961.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1961.exe
    3⤵
    PID:8552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7919.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7919.exe
    3⤵
    PID:13940
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13006.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13006.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24943.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24943.exe
    3⤵
    PID:468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37164.exe
      4⤵
      PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3788.exe
        5⤵
        
        PID:1924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56300.exe
        6⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22018.exe
        7⤵
        
        PID:14236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12937.exe
        6⤵
        
        PID:9464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40607.exe
        6⤵
        
        PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24182.exe
        5⤵
        
        PID:6668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38558.exe
        6⤵
        
        PID:9476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42137.exe
        7⤵
        
        PID:6768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-818.exe
        6⤵
        
        PID:14172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38925.exe
        5⤵
        
        PID:8340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36960.exe
        5⤵
        
        PID:10636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37773.exe
        5⤵
        
        PID:14964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40907.exe
      4⤵
      PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59616.exe
        5⤵
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34370.exe
        6⤵
        
        PID:8904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45152.exe
        7⤵
        
        PID:13192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30327.exe
        6⤵
        
        PID:12112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39105.exe
        6⤵
        
        PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13264.exe
        5⤵
        
        PID:9580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3388.exe
        5⤵
        
        PID:12016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4513.exe
        5⤵
        
        PID:15444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40248.exe
      4⤵
      PID:6460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38428.exe
        5⤵
        
        PID:9800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27812.exe
        5⤵
        
        PID:15192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42268.exe
      4⤵
      PID:9676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3958.exe
        5⤵
        
        PID:2916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24762.exe
        5⤵
        
        PID:16236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10889.exe
      4⤵
      PID:12516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61155.exe
      4⤵
      PID:6324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46956.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46956.exe
    3⤵
    PID:896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-415.exe
      4⤵
      PID:5864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46248.exe
        5⤵
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62491.exe
        6⤵
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57461.exe
        7⤵
        
        PID:15216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36248.exe
        6⤵
        
        PID:13292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10721.exe
        5⤵
        
        PID:8968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26182.exe
        6⤵
        
        PID:13864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22573.exe
        5⤵
        
        PID:11576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23507.exe
        5⤵
        
        PID:12552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44110.exe
      4⤵
      PID:7064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51962.exe
        5⤵
        
        PID:8608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62751.exe
        5⤵
        
        PID:4132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7180.exe
        5⤵
        
        PID:14352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13647.exe
      4⤵
      PID:10400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26244.exe
      4⤵
      PID:11516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43486.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43486.exe
    3⤵
    PID:4564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46248.exe
      4⤵
      PID:1100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20307.exe
        5⤵
        
        PID:7860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30238.exe
        6⤵
        
        PID:15628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31868.exe
        5⤵
        
        PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9338.exe
        5⤵
        
        PID:8108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54795.exe
      4⤵
      PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35749.exe
        5⤵
        
        PID:13916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5666.exe
      4⤵
      PID:10824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27648.exe
      4⤵
      PID:15200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57981.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57981.exe
    3⤵
    PID:6596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21070.exe
      4⤵
      PID:9412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65299.exe
      4⤵
      PID:12604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45257.exe
      4⤵
      PID:14600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46348.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46348.exe
    3⤵
    PID:9452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47918.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47918.exe
    3⤵
    PID:12304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35849.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35849.exe
    3⤵
    PID:15208
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16012.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16012.exe
  2⤵
  PID:2104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20885.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20885.exe
    3⤵
    PID:4324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45563.exe
      4⤵
      PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29160.exe
        5⤵
        
        PID:7536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33388.exe
        6⤵
        
        PID:7916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8842.exe
        5⤵
        
        PID:10680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22122.exe
        5⤵
        
        PID:16228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8609.exe
      4⤵
      PID:8280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30923.exe
        5⤵
        
        PID:15640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1167.exe
      4⤵
      PID:12132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44970.exe
      4⤵
      PID:15148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8147.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8147.exe
    3⤵
    PID:2464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29523.exe
      4⤵
      PID:6564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26747.exe
        5⤵
        
        PID:9392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42138.exe
        5⤵
        
        PID:11736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36838.exe
        5⤵
        
        PID:15956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59585.exe
      4⤵
      PID:10964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59390.exe
      4⤵
      PID:13932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53455.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53455.exe
    3⤵
    PID:8024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23471.exe
      4⤵
      PID:13048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2102.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2102.exe
    3⤵
    PID:9308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62586.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62586.exe
    3⤵
    PID:13748
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60956.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60956.exe
  2⤵
  PID:5792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54416.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54416.exe
    3⤵
    PID:944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33415.exe
      4⤵
      PID:3236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61083.exe
        5⤵
        
        PID:14144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-379.exe
      4⤵
      PID:10916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56432.exe
      4⤵
      PID:13728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57898.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57898.exe
    3⤵
    PID:2600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41827.exe
      4⤵
      PID:9008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58395.exe
        5⤵
        
        PID:14012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56259.exe
      4⤵
      PID:11364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11279.exe
      4⤵
      PID:16212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40103.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40103.exe
    3⤵
    PID:9468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41319.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41319.exe
    3⤵
    PID:12048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2122.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2122.exe
    3⤵
    PID:16308
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49716.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49716.exe
  2⤵
  PID:3004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45283.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45283.exe
    3⤵
    PID:6228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52998.exe
      4⤵
      PID:14220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60270.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60270.exe
    3⤵
    PID:7192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38119.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38119.exe
    3⤵
    PID:15660
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52383.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52383.exe
  2⤵
  PID:6844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63522.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63522.exe
    3⤵
    PID:4840
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44293.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44293.exe
  2⤵
  PID:10584
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60980.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60980.exe
  2⤵
  PID:12928
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26288.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26288.exe
  2⤵
  PID:15168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1528 -ip 1528
1⤵
PID:12364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 7040 -ip 7040
1⤵
PID:4852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-10318.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-10318.exe
Size 4.9MB
SHA256 0ed4c798cf7aae6723d2029a45ffad7e66ec1cc1e8e5e45e4a57a0d07fb2da9b
MD5 73f01909b673efdda7d64388d9f6494f
SHA1 45628823253beb78e34fa208db2d706a0c1fa75f
SHA512 71952d2ffe1f9fcaa3a261bfaa9596179d0da6f75f545b9735344c468b11094c3f4eb5698265d97e69c8707987b9879538d0858020da7976f055b7097a16ab58
SSDEEP 98304:EPbisScCqzCtvWq/Zi6DYfnDKyMx0LNqHgWDuu/nimSqw:EPbvl/wn/Z1sfnmULUHgWDL6qw
TLSH
T17936E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-10924.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-10924.exe
Size 4.9MB
SHA256 f12b8e27f6fb3747eb407f30db44dfd1b5a9e5365f297f97d4964b48b4b2e2cb
MD5 6eb3f398d3c49f191b3c2603994c97f0
SHA1 6418ef868a409897b5781c1e25f1dd89425af1cc
SHA512 31814b587b3f6e4db206fa9c171b2947b6ea1b6e27a53b16ab7f9ec1e7434f8f7fd2b7ea4d933b1ebec50dd6cf696871cc46d53516e08feac37067160a6716f7
SSDEEP 98304:EPbisScCqzCtvWq/Zi6DYfnDKyMc0L6qHgWDuu/nimSqw:EPbvl/wn/Z1sfnmpLPHgWDL6qw
TLSH
T11F36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-13006.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-13006.exe
Size 4.9MB
SHA256 6c108ddbefe758cc154f9dd66dc5c8f146e160204e9590f12846f8062c181bca
MD5 d3131c6201cdee6601df2aba930497b5
SHA1 9e5ea8ae3e0aece97ab09819baa7856edb766c6d
SHA512 4dce259d9963edefff8a50df175985473c3e57d3d74a6168d0d42a0a6587205123bfaadf17f7b608f81fd4d3d411f47dc63eb8aff3ebb42536d71aa4742a3963
SSDEEP 98304:EPbisScCqzCtvWq/Zi6DYWnDKyMc0L/qHgWDuu/nimSqw:EPbvl/wn/Z1sWnmpLCHgWDL6qw
TLSH
T15E36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-15527.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-15527.exe
Size 4.9MB
SHA256 e47de4a1c133c700482a6bafa7f0d9824127158c5cc3c559215d4eb7542ffefa
MD5 d7e8af5f03745a190d269cb21db27da8
SHA1 4b336d38e893ad1c03bdeaa95045521f4c6ff46e
SHA512 ce23f33a2b17f8f9e69e1c3c11085e299df7569b49c8fd348fbbe803d594026f8d43578cd028d582e485ec43f422ad0d738812d3f816593ffe397ea59ddbe74b
SSDEEP 98304:EPxisScCqzCtvWq/Zi6DYfnDKyMc0L/qHgWDuu/nimSqw:EPxvl/wn/Z1sfnmpLCHgWDL6qw
TLSH
T10636E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-2114.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-2114.exe
Size 4.9MB
SHA256 b842f15116f13ca703fbf0856ccebca246a2c0ea641fac5549572dee0ac9a61b
MD5 576def31523e949aa45ce7817f0285fd
SHA1 851a8d7283d088113350057aa0259a0effec8ee4
SHA512 1d997f6a8800b321168cdfec5e0fed9435302782f530ecc97f54f77985ab0fe90a2adce58e06e06eb10116dc255117e76adb0c6e5d2dede0b3cb0d3aac0e1b39
SSDEEP 98304:EPbisScCqzCtvWq/Zi6DYfnDKyMx0L6qHgWDuu/nimSxw:EPbvl/wn/Z1sfnmULPHgWDL6xw
TLSH
T11636E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-24943.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-24943.exe
Size 4.9MB
SHA256 5d1a658878f1bf9db6044fe49aafa6884696be8d15b2eeea8ffeecbda2a3c3b8
MD5 74bc7ac3551adea21493b90ef7ae2f30
SHA1 96d466862872444a1bee9f3ea5a9f370b7e09d12
SHA512 22a31982abadcb1b259108594613a1cc4676d02fcece2ec4ab8f7dd16bc0c17c7956f839d704f3c23af3a0bc6043f174c8a0c512117c47656a7259e8ff74d77a
SSDEEP 98304:EPbisScCqzCtvWq/Yi6DYWnDKyMc0L/qHgWDuu/nimSqw:EPbvl/wn/Y1sWnmpLCHgWDL6qw
TLSH
T1E636E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-25524.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-25524.exe
Size 4.9MB
SHA256 9c97a0983a5b0169ea22770883488650d4917beaf32e9035d6aaf39d59ff4098
MD5 97870179d3603bdc849a681ba5ccf257
SHA1 612d5ef6c71cc7be0121fcac196e82ff76c8cba8
SHA512 c594098b54bb3851af1796d0d38a28161f17140d74dfa0a9a3021f42d09c00247830d8c8cc1e5155d8fb44a087085d44e3b9a8c09489def2e0b4c6a9d06af3e9
SSDEEP 98304:EPxisScCqzCtvWq/Fi6DYfnDKyMc0L/qHgWDuu/nimSqw:EPxvl/wn/F1sfnmpLCHgWDL6qw
TLSH
T1B736E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-27927.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-27927.exe
Size 4.9MB
SHA256 21be076dd5df24d7e097ba616c87032d37fc2d75c2d848b948f85a69a29c19dc
MD5 8a0a7d1b4f0f94311ef14246077279b2
SHA1 24657572d9cf83ec81b319eb65f2e2515e306ba5
SHA512 1f4b36919404ef0c04ed247f9eb44a022c5d810544e8630c89ea9301e1f2ae5ac0abc2cadb6f982b64498a35d6604822563e3cc3a064aa2505b8739f6811ad3a
SSDEEP 98304:EPbisScCqWCtvWq/Zi6DYfnDKyME0L6qHgWDuu/nimSxw:EPbvl6wn/Z1sfnmZLPHgWDL6xw
TLSH
T17336E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-29307.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-29307.exe
Size 4.9MB
SHA256 47b6255497d9cbbd2fb327e1b4cfa8cf8394ea1d2e06d2c0f7aa4fea5d462952
MD5 da76578561b9780d940ed494fc13df3e
SHA1 0b6658fab161adb43638f4605af95c60325115bb
SHA512 2a6bfa2db4f83ebc5ba78307fe7c603510d4ff27eaed7b5f814b9025a456b4ffe8a6960930c4ed2a3646dc11416b6a78b76cca17b0fb6954585282b2f8c322e2
SSDEEP 98304:EPbisScCqzCtvWq/Zi6OYfnDKyMc0L6qHgWDuu/niDSqw:EPbvl/wn/Z1ffnmpLPHgWDLdqw
TLSH
T1D636E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-31449.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-31449.exe
Size 4.9MB
SHA256 f5491c7734559aabf1150cfc23ab42e4fde44418761455507f136afdf1b56acf
MD5 82a1adcee93ad68db0cbf492e8bde49e
SHA1 0ab080e71b39beccc0873cd7e6989e647c515158
SHA512 cb1100804c50956cb7dc8e19348f06d439d86c00fcd053e27308fed2abfbe05b8763f3738f1bffa4d9f7a29357867474f5249f1ae66b060e0bbc94dd6cd87ac8
SSDEEP 98304:EPbisScCqzCtvWq/Zi6DYfnDKyMc0L6qHgWDuu/niDSqw:EPbvl/wn/Z1sfnmpLPHgWDLdqw
TLSH
T1F736E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-33111.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-33111.exe
Size 4.9MB
SHA256 6435dc3096f4cf9b031a83cf856a8c0f01b3ed39d92369a176e274774d44aa7d
MD5 e9c7b038d9a385603ad8e85a030b03c7
SHA1 98f6a10975c3ac4f99d30b7ef99c7bb6f8c4cbba
SHA512 06b2be45164b7c34f41112ec464de4a8866815c2d7614b110255f59dfc19affc33b96b26ac9c7cb57f92a1fb3879cfee966517070e104d55074728d6640e9074
SSDEEP 98304:EPbisScCqzCtvWq/Zi6DYfnDKyMc0L6qHgWDuu/nimSQw:EPbvl/wn/Z1sfnmpLPHgWDL6Qw
TLSH
T12236E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-34180.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-34180.exe
Size 4.9MB
SHA256 fb63392242e5d7bdca56ad120cde60b6236ea02670cb7537313d5f30e3b3fee2
MD5 2c82763931c9e246045790fa4035da65
SHA1 2b017d74e1649638c80971a0a6011994b89a6d95
SHA512 94a229df27d28585b2e729447064848d3034ad1c88e61cc3c639b262c99c1466178dd29d6868941cb94e72993172445fc781d69f5e47a316e453285baa9b32db
SSDEEP 98304:EPXisScCqzCtvWq/Zi6DYfnDKyMx0L7qHgWDuu/nimSxw:EPXvl/wn/Z1sfnmULmHgWDL6xw
TLSH
T13136E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-35861.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-35861.exe
Size 4.9MB
SHA256 f1028a3c8ea939299de07d3b465a1d391af78c5d34c9825922a0d65792a753e4
MD5 abe86c7ef48590968ad1e462418689db
SHA1 3325a48cb280578cc8f9feff0eb1fc6a569a7329
SHA512 027765521361f81302aa9e645e86b84fa05b1ff76fd389d2df588a41fbef59db2ccc57d4100d8635c2f31b4b81f043cbf9eb2f284f1a2f74519b95225643bdaf
SSDEEP 98304:EPbisScCqzCtvWq/Zi6DYfnDKyMc0L6qHgmDuu/nimSqw:EPbvl/wn/Z1sfnmpLPHgmDL6qw
TLSH
T1CA36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-36218.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-36218.exe
Size 4.9MB
SHA256 f6ce0d3c83159f23adc24cfc90e9bbd6102397f101a073f81cfb9d46b48c2f91
MD5 61b875b9bc837f9863ba946c300fd57e
SHA1 dbe5b354ceab97f9e9404b095a591e88aff33608
SHA512 d785fd1a78b933bb3a7de9500e97226712af1d770426b5380cef080ee639c985b5fb2e2949648d35c24e7fdbe84a2d87e4ff277f1ff60f0c9d0d6141bc2fc14c
SSDEEP 98304:EPbisScCqzCtvWq/Zi6yYfnDKyMc0L/qHgWDuu/nimSqw:EPbvl/wn/Z1rfnmpLCHgWDL6qw
TLSH
T13436E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-37074.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-37074.exe
Size 4.9MB
SHA256 b76dd3f87d8dfe8b55436364151933f2d5cda2571eafd43caa5b4b40bf5c660a
MD5 d758820f23e1f7871e2bdd3f542fe0cc
SHA1 c7929a17a0469eaa0149ef866ea8dac0314fd661
SHA512 e29a33070eae9b48b7f4603524d8543e0478246c16b3fa1a6ee5c8045417650661b2fd118bb82934a14d6a17f63200ab3e851ae1ed547ef4a11e9df0e6211460
SSDEEP 98304:EPbisScCqzCtvWq/Zi6DYfnDKyMc0L/qHgWDuu/nimSqw:EPbvl/wn/Z1sfnmpLCHgWDL6qw
TLSH
T17636E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-37164.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-37164.exe
Size 4.9MB
SHA256 30976d88c9fc3c8d38385e4a5c6cf81183c558eb64551a8742880647a5700d00
MD5 e27bec3be914e2d459a72a054f6feb73
SHA1 8e6015018d812776073bc0f9fefc615c3953c954
SHA512 7b290a0e78bc66892f0d7dcd543e84516247cdaf07913d0f39f48a6453131fd091c1c61a82f23f5668d5fa9a548c6a8cb0b1745700487e74daf2507a9960d46e
SSDEEP 98304:EybisScCqzCtvWq/Zi6yYfnDKyMc0L/qHgWDuu/nimSqw:Eybvl/wn/Z1rfnmpLCHgWDL6qw
TLSH
T13E36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-38466.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-38466.exe
Size 4.9MB
SHA256 486fb307c9856fd80f7b66b5463ef407eb63fff7605213bc6bd370ce72dff20b
MD5 3f974a1c1375b45cbb4a32ffdcf680eb
SHA1 1ca9016fa2e95b24a2874cc69da43b8d77ecbcf5
SHA512 3f746f9df7d2b4474cd10728743ad16c0c9851374da529bd1ddc1bbbe3e2c580eb0b0e71106192aec0112b3f4a11351df08fa8cfe2f687861b640875534febfb
SSDEEP 98304:EPbisScCqzCtvWq/Zi6DYfnDKyMx0L6qHgWDuu/nimSqw:EPbvl/wn/Z1sfnmULPHgWDL6qw
TLSH
T1DF36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-42348.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42348.exe
Size 4.9MB
SHA256 9326fd70a634e90b4684bfb44e4f07a7bdf3e12fbffc7859586b0e2cf4fdde74
MD5 2c84a47c91c3bbacc9073c8e9744d7bd
SHA1 553402a15543c061666267f94bd56bcb8329a303
SHA512 38c87c4d6db044a302389c0f67c0ea0d61dab8ab1b9f17a829ec312dd334a36dcaac21440a199fb567ad65950c11574559920a220f085ac9413b548e8155e40a
SSDEEP 98304:EPYisScCqzCtvWq/Zi6DYfnDKyMc0L/qHgWDuu/nimSqw:EPYvl/wn/Z1sfnmpLCHgWDL6qw
TLSH
T1D736E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-42436.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42436.exe
Size 4.9MB
SHA256 b2d2e95f32ae501b4dbc72b338e9553adcb1d3920fa4d657cf5b839a08a92b87
MD5 6d49da2a5d673024bf3d6fd0fda88a13
SHA1 9d371d4eed2be3809b8a415dfcf48f7533e8c4dd
SHA512 53cd321d1468cf11bb8e09ad033b38cb708450d058607d041d9b2f1358670e45314f5ae8820515789cc5a5b1ffbd90abade45e22b4580ac749f7f74343c715ef
SSDEEP 98304:EPbisScCqzCtvWq/Zi6DYfnDKyMx0L7qHgWDuu/nimSxw:EPbvl/wn/Z1sfnmULmHgWDL6xw
TLSH
T12036E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-45124.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-45124.exe
Size 4.9MB
SHA256 e734044f2ee9810b55737d5f6164df6f0a1f2b59f18f11f462b4861a6fa4921a
MD5 2161caa455d77954b56c626f5e8f6c7d
SHA1 b7d3a7796d0995ea5ff07ddfb0e3f8ac25f57663
SHA512 852d0ec5dee7a5e864f0146e1059c30771499109e30f4b0730b144eac74203ca0307ffe48cfbc4debcdf47f1b6a96ce90170f5b91de606417ecb0673e045c519
SSDEEP 98304:EPbisScCqzCtvWq/Zi6DYfnDKyMc0L6qHgWDuu/nimSqw:EPbvl/wn/Z1sfnmpLPHgWDL6qw
TLSH
T11836E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-45332.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-45332.exe
Size 4.9MB
SHA256 512d7679fef5ad12350e6c2ec080cf140375f8272dd1bfd81cf1f9264cf9561b
MD5 192890c58dc680815f44c27a81a0ded2
SHA1 11be867897648515135ea751a7978109c62eae16
SHA512 1450f126645cd68e41764b73c0895a512b13b3573105cc0a382f72ff8baabcb423a656abd09b864109beca3cbced5f9a50c3b97d5bce981787521dbb6420645b
SSDEEP 98304:EPbisScCqzCtvWq/Zi6DYfnDKyMc0L6qHgWDuu/zimSQw:EPbvl/wn/Z1sfnmpLPHgWDLmQw
TLSH
T1B436E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-46691.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-46691.exe
Size 4.9MB
SHA256 d1f2398af9715f0ae646e5c85b410ab842cc4eb8eb179d1213c9b14b34310218
MD5 fab9d1a0d9cf4f5de281f1f27303d826
SHA1 e9f892aac69a6954ad22a002a3acb17d96010ff2
SHA512 84745e78f9f4846a1d6651dbb4c799052221ec177ab2497106a45d157fd6f89b61eb77289b5fc4514252a2e938a068731acc640d966af16f0b6c4310c8042789
SSDEEP 98304:EPcisScCqzCtvWq/Zi6DYfnDKyMc0L/qHgWDuu/nimSqw:EPcvl/wn/Z1sfnmpLCHgWDL6qw
TLSH
T10536E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-46956.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-46956.exe
Size 4.9MB
SHA256 52e8ff127669e40bd4bad0da913a1978ecce60916a7121116bef4bca5b641c61
MD5 72892e2b0d1a8c823648f6e4cc5882bd
SHA1 0877add26df3ca070cb34682cb9d7770c058d0c5
SHA512 986776851416d9ce111ac0c9ac0dc6cdae0918b473fd56a3ccaf7e2000cc613f7773948859c3b3f1184a964c7af4a5f82e5bc0644fc81b1c492e6b457e033a9d
SSDEEP 98304:EPbisScCqzCtvWq/Zi6DYfnDKyMc0LrqHgWDuu/nimSqw:EPbvl/wn/Z1sfnmpLWHgWDL6qw
TLSH
T10F36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-47231.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-47231.exe
Size 4.9MB
SHA256 d2d107be282ede5fda7b21661ec9cb1c0af0e987acc2d9a0eee3f491134e3803
MD5 98a78bce37a4e6d3affcd2ca5f967f75
SHA1 22d0b43d3ff690a8bde912c6ac4c2ea897965d98
SHA512 a5220275e4ba5eaf412f832e721bcbc3598a29d7ce5bc32c6641c58d14d7667f8d7dfefc4bb6326cb204138ebcadd5150a9d1f07fa89d4e499727401e999f726
SSDEEP 98304:EPbisScCqzCtvWq/Zi6DYfnDKyMc0LsqHgWDuu/nimSqw:EPbvl/wn/Z1sfnmpLNHgWDL6qw
TLSH
T17436E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-48082.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-48082.exe
Size 4.9MB
SHA256 acd05f81e081143e3e43b268a52ac26daec42d3ce9f7314d5bcbc3139cd0e070
MD5 ce475f5434459dc1cdbbb6b3f7791051
SHA1 6277d84895a7ec6a006dd8bcc5cff9166734cdc7
SHA512 854cdc8c30eaf2f2f0ad1a5bdcc74f742c02b889b1075c725cd95c06953edf68bc8dece4c92a993d07e31e88b7fade5994b66292915d3d6218f65f18592e172b
SSDEEP 98304:EPbisScCqzCtvWq/Zi6DYfnDKyMc0LgqHgWDuu/nimSqw:EPbvl/wn/Z1sfnmpLZHgWDL6qw
TLSH
T13036E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-49125.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-49125.exe
Size 4.9MB
SHA256 65666ce12589629013eb53d2f333b2c885d39c60fa5b034413010fe781ccbd38
MD5 50a34683162db6bbf4da197d72be478d
SHA1 c2e6747c617280ce401081308df2d0480958be48
SHA512 aae948b201db5d7e051cf4cf04bae0b72a9db6026953ec7c6bcea16243fca1590a0cbb3c85e055eede344e8fdbedc238898e44bb1318e18a90dae402388d37e4
SSDEEP 98304:EPbisScCqWCtvWq/Zi6DYfnDKyMx0L6qHgWDuu/nimSxw:EPbvl6wn/Z1sfnmULPHgWDL6xw
TLSH
T1FE36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-5399.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-5399.exe
Size 4.9MB
SHA256 d0af3c84c63744b7aa31fe57c0ff8a62705e65daf2a025241c64c7765344138a
MD5 c470229d6b682ba76718bd41c2b087cc
SHA1 a2aafb1ae4c9f9f747581252f3a32697e411c728
SHA512 7c0ea9140fbe75e73dd41db0673972d3f06853d1de5e4b52b90c641d5697a68af999b45c46f45accbe30f9b44b45bdd9f6f06f2a2097dfb4a7a6288c98d9f487
SSDEEP 98304:EPbisScCqzCtvWq/Zi6OYfnDKyMc0L6qHgWDuu/niDSqw:EPbvl/wn/Z1ffnmpLPHgWDLdqw
TLSH
T19E36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-5491.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-5491.exe
Size 4.9MB
SHA256 5b6ce07c07f7e325e63c98f44134cc4fa45993ee5b9a432299de12ebcdeec4d1
MD5 dd81bc8a712180b3c752d2c012491a69
SHA1 e4fb3e845bc5b22c3ed075252908395c5462574c
SHA512 c77c547b7dc22fd8dcf1254e445adcc8957c21ca71105c8efc3e9fe68b7694a303eb174e8ff318bd70b9eb09d8c3f3db76c20876f000fb793aa1bd9d24ac3ba3
SSDEEP 98304:EPbisScCqzCtvWq/Zi6DYfnDKyMx0L6qHgWDuu/nimPqw:EPbvl/wn/Z1sfnmULPHgWDLXqw
TLSH
T10A36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-57293.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-57293.exe
Size 4.9MB
SHA256 885eeddbcae4dae197d725793f67ef329c43b6eb1db4846cfbab9bf77e30be0b
MD5 ff065df0ba1bb4c66e307c7bb05cbb54
SHA1 b40875fe0860001435616b95a423b777f0b7873a
SHA512 402c27dbedb5a311821bc6ded86eb6c3e2b4a2a0d6ff1484c6ebf91d555e30ed8f565199179adcaf4f19ed1162f3a63da73e276ad367592e240bba736fc79487
SSDEEP 98304:EPbisScCqzCtvWR/Zi6DYfnDKyMc0L6qHgWDuu/niDSqw:EPbvl/wU/Z1sfnmpLPHgWDLdqw
TLSH
T1C336E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-59753.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-59753.exe
Size 4.9MB
SHA256 f94730bb08d2f8ed0b65c7c4312444e414814a1147b3de037f887aa620d7f2b6
MD5 128384283acaa7c6924635ca033a0702
SHA1 5040ef9dd57ff71ac00c0a2e5ceca7be0461088b
SHA512 0848187676cb5280f784cacdf1ecb334f2a40e5da72a06c8743000748fbd15e266c3685c2f043146cb01786a48c1978e5ace988cbbbe35d644c0a19c39b3a4fd
SSDEEP 98304:EPbisScCqzCtvWq/Zi6DYfnDKyMx0LNKHgWDuu/nimSqw:EPbvl/wn/Z1sfnmUL0HgWDL6qw
TLSH
T11336E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-61377.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-61377.exe
Size 4.9MB
SHA256 f97761f656adec7a1839c788a78cef43d5e8d176f44f81d76fbcc4aa99a5b7a3
MD5 483b4a4882fd033678442572431e0e91
SHA1 8ad851f44dd5d5b097fd2863cea6f282972edb37
SHA512 7327f4e52d7055b16b6cb85e22197ce9d758522fdb0ca4844c433abb70d168917bb352ea039ec692e2705c45780904c9273b24cd61387b04636faa4874b7db85
SSDEEP 98304:EPxisScCqzCtvWq/Si6DYfnDKyMc0L/qHgWDuu/nimSqw:EPxvl/wn/S1sfnmpLCHgWDL6qw
TLSH
T12F36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-8606.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-8606.exe
Size 4.9MB
SHA256 d698b92d580035a527b3eac24c7165c437653bc3b2bcdd98a1c30376e999eb7c
MD5 92f9324738108e34e3c039297d7581f8
SHA1 601c46d2863c8e2974c72ea32013c0568618a242
SHA512 12910465d6b27427a77d04d2045f2534bc9a8bf0a3e15e7ef4fc2f3f8634d7ba5b2f255f1b0c26c679ddf6129d76bca79375f82c2cdf3ec6cc3999bdaca66909
SSDEEP 98304:EPbisScCqzCtvWq/Zi6DYfnDKyMN0LgqHgWDuu/nimSqw:EPbvl/wn/Z1sfnmULZHgWDL6qw
TLSH
T13A36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-9161.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-9161.exe
Size 4.9MB
SHA256 5e24bda3be7a0c4d27d083940174de0ca2745aa61cd408dd91084aadae255c4e
MD5 caaf862d3c4ef5f1cf8421b9d8a4fd4d
SHA1 321ddb11ed8145126d6703abddc04eb2b76204c9
SHA512 aaa5fd2e229780c6e9629916216d7e916e81e495b5a8a38bd7c6e50b722642a056882eefac357cca55f9414e617d985db729af1a41f8dd2e9f09fd1bcf8fea01
SSDEEP 98304:EPbisScCqzCtvWq/Zi6DYfnDKyMc0LEqHgWDuu/nimSqw:EPbvl/wn/Z1sfnmpLlHgWDL6qw
TLSH
T13D36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9A60A2B337F1657EB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/52-24-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/796-1287-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/896-267-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/944-610-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1052-803-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1144-748-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1376-532-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1448-801-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1500-251-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1528-495-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1544-736-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1680-1561-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1740-402-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1924-496-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1972-183-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2024-446-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2076-1556-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2104-244-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2392-1520-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2428-569-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2464-611-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2600-1282-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2724-108-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2880-493-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3040-510-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3236-1526-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3408-1486-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3532-184-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4144-548-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4148-0-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4580-1428-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4584-1528-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4744-428-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4796-492-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4816-1284-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4824-44-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5480-800-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5752-1521-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5896-427-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5928-509-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5960-494-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5984-506-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6176-1484-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6184-746-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6200-1286-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6216-1283-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6228-1527-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6272-1278-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6296-1551-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6304-887-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6316-1290-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6344-1523-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6360-1579-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6376-802-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6400-1427-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6440-1354-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6476-859-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6484-1218-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6492-888-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6508-886-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6524-1522-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6540-860-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6564-1291-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6568-1559-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6596-1222-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6628-1279-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6660-1136-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6676-1210-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6684-1211-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6704-1217-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6712-1219-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6720-1281-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6728-1220-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6744-1224-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6752-1221-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6824-1524-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6844-1525-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6916-1558-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6928-1280-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6936-1289-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6952-1555-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6960-1582-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6964-1223-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6992-1554-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7040-1430-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7144-1485-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7152-1553-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7232-1589-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7276-1480-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7284-1557-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7304-1483-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7516-1574-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7536-1575-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7572-1425-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7608-1562-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7860-1576-0x0000000000400000-0x0000000000475000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads