kawaiiunicorn | c6ff6fca3aadd80017b9bc893fb00b7b0dc9a56745e52258a8e6adadf5c13275

Analysis

max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_38855e874390f224b290da692e7996cc_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe
Size 5.1MB
Sample261001-tknefaxt6p
SHA256 c6ff6fca3aadd80017b9bc893fb00b7b0dc9a56745e52258a8e6adadf5c13275
MD5 38855e874390f224b290da692e7996cc
SHA1 e088c30890db9cdc813c28aa3ce9d3f6c5b913b0
SHA512 21b284d4f50afce411deb9208e3bbcf5de6d1193ab06dd1fc085d62d1a95a66a1c7ae12d0aad0e12215981c8eea6d0322782af49fe314e0f7496a3770a425c65
SSDEEP 98304:iPgisOcCFzQtDWq/xW6pLfhDKyMi0LbqHgWKu2/nim7q2Hv:iPgvZWqn/x55fhmrLGHgWKTDq2P
TLSH
T12F36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9B60A2B337F1657EA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery kawaiiunicorn trojan

Malware Config

Signatures

Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
trojan kawaiiunicorn

Detects KawaiiUnicorn 64 IoCs

resource	yara_rule
behavioral2/memory/1876-0-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4364-49-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1368-81-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5380-118-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5612-235-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4092-234-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5068-218-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5932-217-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1676-216-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2956-266-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3752-265-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1420-279-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5824-280-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3264-378-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3280-451-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3528-613-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2192-650-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6924-934-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1380-822-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5012-767-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4348-731-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4340-730-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2776-729-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2508-728-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5956-727-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2720-725-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3908-676-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6064-677-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1968-675-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5364-603-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4560-612-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4956-609-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3848-558-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1976-559-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/2104-557-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1016-545-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3132-544-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5836-543-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4824-541-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1624-540-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/4712-539-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/3152-532-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/1720-537-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5460-403-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6456-941-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6464-940-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6972-966-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6728-965-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6944-964-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6232-939-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6208-938-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6960-1001-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7016-1112-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6780-1105-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6744-1100-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6316-1097-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7164-1096-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6044-1065-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/5388-1063-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6532-1062-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7068-1061-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6596-1059-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/7600-1157-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral2/memory/6588-1154-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 30 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c61a-6.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c61b-11.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c61e-19.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c61f-29.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c621-33.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c622-43.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c623-47.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c624-59.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c626-65.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c625-69.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c628-78.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c627-80.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c62b-99.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c629-113.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c62c-119.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c634-162.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c62f-135.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c62d-167.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c62e-166.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c630-169.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c632-175.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c63d-222.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c638-219.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c63c-209.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c63b-204.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c63e-202.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c635-198.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c636-196.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c637-190.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000b00000001c7da-2205.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Executes dropped EXE 10 IoCs

pid	Process
2652	Unicorn-59656.exe
3748	Unicorn-40663.exe
692	Unicorn-21866.exe
5492	Unicorn-3927.exe
4884	Unicorn-25094.exe
2848	Unicorn-50113.exe
4364	Unicorn-10241.exe
4664	Unicorn-46387.exe
236	Unicorn-3408.exe
3524	Unicorn-58317.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
7144	1420	WerFault.exe	131
4704	1420	WerFault.exe	131

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59656.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40663.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21866.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3927.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46387.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_38855e874390f224b290da692e7996cc_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50113.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10241.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3408.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58317.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1876	2026-09-30_38855e874390f224b290da692e7996cc_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe
2652	Unicorn-59656.exe
3748	Unicorn-40663.exe
692	Unicorn-21866.exe
5492	Unicorn-3927.exe
4884	Unicorn-25094.exe
4364	Unicorn-10241.exe
2848	Unicorn-50113.exe
4664	Unicorn-46387.exe
236	Unicorn-3408.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 2652	1876	2026-09-30_38855e874390f224b290da692e7996cc_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe	88
PID 2652 wrote to memory of 3748	2652	Unicorn-59656.exe	89
PID 1876 wrote to memory of 692	1876	2026-09-30_38855e874390f224b290da692e7996cc_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe	90
PID 3748 wrote to memory of 5492	3748	Unicorn-40663.exe	91
PID 2652 wrote to memory of 4884	2652	Unicorn-59656.exe	92
PID 692 wrote to memory of 2848	692	Unicorn-21866.exe	93
PID 1876 wrote to memory of 4364	1876	2026-09-30_38855e874390f224b290da692e7996cc_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe	94
PID 5492 wrote to memory of 4664	5492	Unicorn-3927.exe	95
PID 4884 wrote to memory of 236	4884	Unicorn-25094.exe	96
PID 3748 wrote to memory of 3524	3748	Unicorn-40663.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-09-30_38855e874390f224b290da692e7996cc_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_38855e874390f224b290da692e7996cc_agent-tesla_cobalt-strike_cryptbot_elex_glassworm_icedid_loki-bot_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59656.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59656.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40663.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40663.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3927.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46387.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34274.exe
        6⤵
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37083.exe
        7⤵
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20140.exe
        8⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15578.exe
        9⤵
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57221.exe
        9⤵
        
        PID:10096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32679.exe
        9⤵
        
        PID:11796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17259.exe
        8⤵
        
        PID:8416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51190.exe
        8⤵
        
        PID:10956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48598.exe
        7⤵
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58064.exe
        8⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42446.exe
        8⤵
        
        PID:11020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60553.exe
        8⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39848.exe
        7⤵
        
        PID:8804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41793.exe
        7⤵
        
        PID:9812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10336.exe
        7⤵
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34317.exe
        6⤵
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7934.exe
        7⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15296.exe
        8⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10054.exe
        7⤵
        
        PID:9620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46417.exe
        7⤵
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9310.exe
        6⤵
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42087.exe
        6⤵
        
        PID:8444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19449.exe
        6⤵
        
        PID:4520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47949.exe
        5⤵
        
        PID:1792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24592.exe
        6⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55692.exe
        7⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22823.exe
        8⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40477.exe
        9⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62224.exe
        10⤵
        
        PID:11576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28860.exe
        9⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19355.exe
        10⤵
        
        PID:11612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39872.exe
        9⤵
        
        PID:11216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3289.exe
        8⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7211.exe
        9⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41990.exe
        8⤵
        
        PID:9320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27267.exe
        8⤵
        
        PID:12168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1011.exe
        7⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34556.exe
        8⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19554.exe
        9⤵
        
        PID:8460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34726.exe
        10⤵
        
        PID:10372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34994.exe
        9⤵
        
        PID:10344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57340.exe
        9⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9776.exe
        8⤵
        
        PID:8796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35928.exe
        8⤵
        
        PID:10152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27637.exe
        8⤵
        
        PID:12212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27247.exe
        7⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12037.exe
        8⤵
        
        PID:12088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50599.exe
        7⤵
        
        PID:9032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11783.exe
        8⤵
        
        PID:10832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47897.exe
        7⤵
        
        PID:11200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35826.exe
        6⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36637.exe
        7⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46969.exe
        8⤵
        
        PID:8240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49878.exe
        8⤵
        
        PID:10008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63881.exe
        7⤵
        
        PID:7900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5720.exe
        7⤵
        
        PID:9432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40958.exe
        7⤵
        
        PID:6860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10086.exe
        6⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58012.exe
        7⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55727.exe
        8⤵
        
        PID:11708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44699.exe
        7⤵
        
        PID:4184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14960.exe
        6⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37445.exe
        7⤵
        
        PID:11428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26443.exe
        6⤵
        
        PID:7564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2384.exe
        6⤵
        
        PID:13128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37704.exe
        5⤵
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53419.exe
        6⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63720.exe
        7⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53684.exe
        8⤵
        
        PID:8216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57221.exe
        8⤵
        
        PID:9504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30614.exe
        8⤵
        
        PID:11760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15.exe
        7⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22196.exe
        7⤵
        
        PID:10480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24674.exe
        7⤵
        
        PID:4984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64467.exe
        6⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18402.exe
        7⤵
        
        PID:8036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23543.exe
        8⤵
        
        PID:12228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9472.exe
        7⤵
        
        PID:11092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36968.exe
        6⤵
        
        PID:7840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20438.exe
        6⤵
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10336.exe
        6⤵
        
        PID:11372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32926.exe
        5⤵
        
        PID:4712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17618.exe
        6⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2909.exe
        7⤵
        
        PID:10700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17973.exe
        6⤵
        
        PID:8628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53577.exe
        6⤵
        
        PID:6444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13887.exe
        5⤵
        
        PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33727.exe
        5⤵
        
        PID:9800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22988.exe
        5⤵
        
        PID:10176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58317.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2277.exe
        5⤵
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43834.exe
        6⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16087.exe
        7⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41873.exe
        8⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35620.exe
        9⤵
        
        PID:8312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35513.exe
        9⤵
        
        PID:9740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21976.exe
        8⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26311.exe
        8⤵
        
        PID:9792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53803.exe
        7⤵
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53160.exe
        8⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36843.exe
        9⤵
        
        PID:11424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27977.exe
        8⤵
        
        PID:10184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58405.exe
        7⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40626.exe
        8⤵
        
        PID:11560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7999.exe
        7⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20050.exe
        7⤵
        
        PID:1500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22562.exe
        6⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32610.exe
        7⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9029.exe
        8⤵
        
        PID:8864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29888.exe
        8⤵
        
        PID:10912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39467.exe
        7⤵
        
        PID:9100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3442.exe
        7⤵
        
        PID:11168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47367.exe
        6⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35821.exe
        7⤵
        
        PID:11524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29489.exe
        6⤵
        
        PID:1468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33205.exe
        5⤵
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43798.exe
        6⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8131.exe
        7⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12267.exe
        8⤵
        
        PID:1424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26961.exe
        8⤵
        
        PID:10224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25855.exe
        8⤵
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52485.exe
        7⤵
        
        PID:8228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22244.exe
        7⤵
        
        PID:10604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22199.exe
        6⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58152.exe
        7⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57221.exe
        7⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11356.exe
        7⤵
        
        PID:11896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58436.exe
        6⤵
        
        PID:8248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24845.exe
        6⤵
        
        PID:11116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47673.exe
        5⤵
        
        PID:1220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54810.exe
        6⤵
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23695.exe
        7⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2525.exe
        8⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
        7⤵
        
        PID:2636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59828.exe
        6⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52624.exe
        7⤵
        
        PID:10420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11921.exe
        6⤵
        
        PID:8604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27585.exe
        6⤵
        
        PID:12012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44322.exe
        5⤵
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4784.exe
        6⤵
        
        PID:7384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31537.exe
        6⤵
        
        PID:10900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27047.exe
        5⤵
        
        PID:7304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64942.exe
        5⤵
        
        PID:10628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46941.exe
        5⤵
        
        PID:12604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65415.exe
      4⤵
      PID:3752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33191.exe
        5⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19865.exe
        6⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10150.exe
        7⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57221.exe
        7⤵
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28761.exe
        7⤵
        
        PID:7348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38307.exe
        6⤵
        
        PID:7892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18740.exe
        6⤵
        
        PID:10048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16181.exe
        6⤵
        
        PID:12620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58930.exe
        5⤵
        
        PID:1472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16544.exe
        6⤵
        
        PID:7660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10822.exe
        6⤵
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62530.exe
        6⤵
        
        PID:1800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14305.exe
        5⤵
        
        PID:7508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55504.exe
        6⤵
        
        PID:12276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29842.exe
        5⤵
        
        PID:10144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47804.exe
        5⤵
        
        PID:2548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16636.exe
      4⤵
      PID:3760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58842.exe
        5⤵
        
        PID:6588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12447.exe
        6⤵
        
        PID:2080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9888.exe
        5⤵
        
        PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41325.exe
        5⤵
        
        PID:2436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2704.exe
      4⤵
      PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59474.exe
        5⤵
        
        PID:4416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20873.exe
      4⤵
      PID:9496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19449.exe
      4⤵
      PID:12060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25094.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25094.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3408.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2277.exe
        5⤵
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30513.exe
        6⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36590.exe
        7⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43710.exe
        8⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65495.exe
        9⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57221.exe
        9⤵
        
        PID:9964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9641.exe
        8⤵
        
        PID:7308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26311.exe
        8⤵
        
        PID:9492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39604.exe
        8⤵
        
        PID:11792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4493.exe
        7⤵
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38308.exe
        8⤵
        
        PID:8188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33292.exe
        8⤵
        
        PID:9732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28716.exe
        7⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11284.exe
        7⤵
        
        PID:10964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44789.exe
        7⤵
        
        PID:7324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44436.exe
        6⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27073.exe
        7⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44556.exe
        8⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12576.exe
        8⤵
        
        PID:8516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13490.exe
        8⤵
        
        PID:10512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35681.exe
        7⤵
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5419.exe
        7⤵
        
        PID:10588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35411.exe
        7⤵
        
        PID:7400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35333.exe
        6⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36087.exe
        7⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28037.exe
        8⤵
        
        PID:11352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9769.exe
        7⤵
        
        PID:10936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12002.exe
        6⤵
        
        PID:7200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2619.exe
        6⤵
        
        PID:10160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41373.exe
        5⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42428.exe
        6⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60513.exe
        7⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15688.exe
        8⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61087.exe
        8⤵
        
        PID:10492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34140.exe
        7⤵
        
        PID:7436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40230.exe
        7⤵
        
        PID:9288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50029.exe
        7⤵
        
        PID:11828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20694.exe
        6⤵
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39822.exe
        7⤵
        
        PID:11728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57858.exe
        6⤵
        
        PID:6296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27585.exe
        6⤵
        
        PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43397.exe
        5⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22906.exe
        6⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2345.exe
        7⤵
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39303.exe
        8⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60708.exe
        7⤵
        
        PID:9592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28595.exe
        7⤵
        
        PID:10792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40533.exe
        6⤵
        
        PID:7236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48311.exe
        6⤵
        
        PID:10892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48406.exe
        5⤵
        
        PID:1160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20052.exe
        6⤵
        
        PID:7272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16916.exe
        7⤵
        
        PID:12284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64901.exe
        6⤵
        
        PID:8928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42333.exe
        6⤵
        
        PID:10424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22688.exe
        5⤵
        
        PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50033.exe
        5⤵
        
        PID:10436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47949.exe
      4⤵
      PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41997.exe
        5⤵
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53554.exe
        6⤵
        
        PID:1420
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 708
        7⤵
        Program crash
        
        PID:7144
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 708
        7⤵
        Program crash
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41275.exe
        6⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35755.exe
        7⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26553.exe
        8⤵
        
        PID:12064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4652.exe
        7⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38502.exe
        7⤵
        
        PID:10188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42837.exe
        6⤵
        
        PID:6412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31108.exe
        6⤵
        
        PID:9536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18919.exe
        6⤵
        
        PID:12532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16283.exe
        5⤵
        
        PID:4244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45874.exe
        6⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-150.exe
        7⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10906.exe
        8⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14548.exe
        7⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57704.exe
        7⤵
        
        PID:3360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4981.exe
        6⤵
        
        PID:7044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39633.exe
        6⤵
        
        PID:9628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12224.exe
        5⤵
        
        PID:4956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36907.exe
        6⤵
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60330.exe
        7⤵
        
        PID:12708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22134.exe
        6⤵
        
        PID:10596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25769.exe
        6⤵
        
        PID:6348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3585.exe
        5⤵
        
        PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60294.exe
        5⤵
        
        PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43478.exe
        5⤵
        
        PID:10756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37704.exe
      4⤵
      PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53419.exe
        5⤵
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39491.exe
        6⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26762.exe
        7⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5005.exe
        7⤵
        
        PID:10856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24693.exe
        6⤵
        
        PID:8644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20463.exe
        6⤵
        
        PID:10800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2952.exe
        5⤵
        
        PID:6552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21376.exe
        5⤵
        
        PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52343.exe
        5⤵
        
        PID:4324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59568.exe
      4⤵
      PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20057.exe
        5⤵
        
        PID:6924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47149.exe
        6⤵
        
        PID:10864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42704.exe
        6⤵
        
        PID:12816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34397.exe
        5⤵
        
        PID:8984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20463.exe
        5⤵
        
        PID:10620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44951.exe
      4⤵
      PID:6988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17224.exe
        5⤵
        
        PID:8156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57221.exe
        5⤵
        
        PID:4148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46004.exe
        5⤵
        
        PID:12972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9931.exe
      4⤵
      PID:8332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3149.exe
      4⤵
      PID:10520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29455.exe
      4⤵
      PID:10180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65083.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65083.exe
    3⤵
    PID:1368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59402.exe
      4⤵
      PID:908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8629.exe
        5⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45874.exe
        6⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21209.exe
        7⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41550.exe
        8⤵
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44185.exe
        7⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53577.exe
        7⤵
        
        PID:7000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13595.exe
        6⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6609.exe
        7⤵
        
        PID:11448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18387.exe
        6⤵
        
        PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49636.exe
        5⤵
        
        PID:2192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10238.exe
        6⤵
        
        PID:7972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13152.exe
        6⤵
        
        PID:9672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21719.exe
        6⤵
        
        PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45333.exe
        5⤵
        
        PID:7572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40305.exe
        5⤵
        
        PID:11160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54819.exe
        6⤵
        
        PID:10404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23422.exe
        5⤵
        
        PID:7740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35826.exe
      4⤵
      PID:4448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11940.exe
        5⤵
        
        PID:704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50015.exe
        6⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32709.exe
        7⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26494.exe
        7⤵
        
        PID:10244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-482.exe
        6⤵
        
        PID:7748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19591.exe
        6⤵
        
        PID:10444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27710.exe
        5⤵
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51036.exe
        6⤵
        
        PID:11572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29274.exe
        5⤵
        
        PID:8816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59084.exe
        5⤵
        
        PID:11108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6002.exe
      4⤵
      PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7491.exe
        5⤵
        
        PID:4368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60404.exe
      4⤵
      PID:8508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23418.exe
      4⤵
      PID:11084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23149.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23149.exe
    3⤵
    PID:476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43881.exe
      4⤵
      PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64322.exe
        5⤵
        
        PID:4340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61790.exe
        6⤵
        
        PID:6556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9556.exe
        6⤵
        
        PID:10216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51930.exe
        5⤵
        
        PID:7520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-127.exe
        5⤵
        
        PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64301.exe
      4⤵
      PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43762.exe
        5⤵
        
        PID:3552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2416.exe
        6⤵
        
        PID:12072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12897.exe
        5⤵
        
        PID:10572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10880.exe
      4⤵
      PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45498.exe
      4⤵
      PID:9600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45720.exe
      4⤵
      PID:11832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exe
      4⤵
      PID:13200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40597.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40597.exe
    3⤵
    PID:2280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14026.exe
      4⤵
      PID:6980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34451.exe
        5⤵
        
        PID:6252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53530.exe
      4⤵
      PID:9608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23361.exe
      4⤵
      PID:11496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15094.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15094.exe
    3⤵
    PID:7004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58415.exe
      4⤵
      PID:10580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33853.exe
      4⤵
      PID:6520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44410.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44410.exe
    3⤵
    PID:9020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40959.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40959.exe
    3⤵
    PID:4240
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21866.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21866.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50113.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50113.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37472.exe
      4⤵
      PID:2388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29604.exe
        5⤵
        
        PID:2956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43352.exe
        6⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1691.exe
        7⤵
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-892.exe
        8⤵
        
        PID:8008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57221.exe
        8⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15536.exe
        7⤵
        
        PID:7636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3142.exe
        7⤵
        
        PID:11456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5754.exe
        6⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28879.exe
        7⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10459.exe
        7⤵
        
        PID:9232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61461.exe
        7⤵
        
        PID:11840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7481.exe
        6⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25852.exe
        7⤵
        
        PID:6816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24606.exe
        6⤵
        
        PID:10356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4549.exe
        5⤵
        
        PID:3212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38469.exe
        6⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23657.exe
        7⤵
        
        PID:12396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59556.exe
        6⤵
        
        PID:9040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12291.exe
        6⤵
        
        PID:4400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35490.exe
        5⤵
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14196.exe
        6⤵
        
        PID:2008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20823.exe
        5⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29578.exe
        6⤵
        
        PID:11436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10647.exe
      4⤵
      PID:2900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2464.exe
        5⤵
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17810.exe
        6⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24015.exe
        7⤵
        
        PID:12148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53852.exe
        6⤵
        
        PID:2824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33678.exe
        5⤵
        
        PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57920.exe
        5⤵
        
        PID:9072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64201.exe
      4⤵
      PID:1132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18054.exe
        5⤵
        
        PID:2508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20052.exe
        6⤵
        
        PID:7624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25897.exe
        6⤵
        
        PID:10012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44164.exe
        6⤵
        
        PID:11540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48785.exe
        5⤵
        
        PID:6404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55556.exe
        6⤵
        
        PID:11852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23618.exe
        5⤵
        
        PID:1036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49475.exe
      4⤵
      PID:3768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7799.exe
        5⤵
        
        PID:7956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52861.exe
        5⤵
        
        PID:10472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43148.exe
        5⤵
        
        PID:4808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59938.exe
      4⤵
      PID:8004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24288.exe
      4⤵
      PID:10544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34688.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34688.exe
    3⤵
    PID:5684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59148.exe
      4⤵
      PID:6024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55962.exe
        5⤵
        
        PID:1968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58754.exe
        6⤵
        
        PID:7612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33017.exe
        6⤵
        
        PID:4292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13136.exe
        6⤵
        
        PID:6204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13289.exe
        5⤵
        
        PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65284.exe
        5⤵
        
        PID:10336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56133.exe
      4⤵
      PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24520.exe
        5⤵
        
        PID:7456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40775.exe
        5⤵
        
        PID:9872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-128.exe
      4⤵
      PID:7188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50558.exe
      4⤵
      PID:11100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49262.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49262.exe
    3⤵
    PID:1720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15781.exe
      4⤵
      PID:6636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9925.exe
        5⤵
        
        PID:10388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15342.exe
      4⤵
      PID:3444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27737.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27737.exe
    3⤵
    PID:2324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7135.exe
      4⤵
      PID:7336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45462.exe
      4⤵
      PID:9784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59395.exe
      4⤵
      PID:6496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52835.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52835.exe
    3⤵
    PID:8976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13454.exe
      4⤵
      PID:11564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1172.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1172.exe
    3⤵
    PID:11184
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10241.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10241.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37472.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37472.exe
    3⤵
    PID:3792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47918.exe
      4⤵
      PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22008.exe
        5⤵
        
        PID:1332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61089.exe
        6⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29168.exe
        7⤵
        
        PID:11636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43224.exe
        6⤵
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51273.exe
        6⤵
        
        PID:11132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51421.exe
        5⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46158.exe
        6⤵
        
        PID:10752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33690.exe
        5⤵
        
        PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52343.exe
        5⤵
        
        PID:12264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29661.exe
      4⤵
      PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45054.exe
        5⤵
        
        PID:6596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13983.exe
        6⤵
        
        PID:11724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23209.exe
        5⤵
        
        PID:5028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59799.exe
        5⤵
        
        PID:7128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2935.exe
      4⤵
      PID:7020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22979.exe
        5⤵
        
        PID:7284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52861.exe
        5⤵
        
        PID:10776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46341.exe
      4⤵
      PID:8280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47341.exe
        5⤵
        
        PID:3888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53837.exe
      4⤵
      PID:11076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58779.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58779.exe
    3⤵
    PID:1676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37659.exe
      4⤵
      PID:3324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24359.exe
        5⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49517.exe
        6⤵
        
        PID:8288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21720.exe
        6⤵
        
        PID:10948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61447.exe
        5⤵
        
        PID:7824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19241.exe
        6⤵
        
        PID:11980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26887.exe
        5⤵
        
        PID:9640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19001.exe
        5⤵
        
        PID:11732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60793.exe
      4⤵
      PID:2720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15391.exe
        5⤵
        
        PID:7644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37336.exe
        6⤵
        
        PID:7152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45052.exe
        5⤵
        
        PID:10052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27381.exe
        5⤵
        
        PID:6620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58654.exe
      4⤵
      PID:7888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27538.exe
      4⤵
      PID:9236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10336.exe
      4⤵
      PID:11776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43397.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43397.exe
    3⤵
    PID:3604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26772.exe
      4⤵
      PID:2616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24821.exe
        5⤵
        
        PID:7988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48841.exe
        6⤵
        
        PID:7548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43302.exe
        5⤵
        
        PID:8224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44164.exe
        5⤵
        
        PID:12196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60591.exe
      4⤵
      PID:6336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26311.exe
      4⤵
      PID:5660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14254.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14254.exe
    3⤵
    PID:6208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22979.exe
      4⤵
      PID:6576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26008.exe
        5⤵
        
        PID:6380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52861.exe
      4⤵
      PID:10552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51272.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51272.exe
    3⤵
    PID:8296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20894.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20894.exe
    3⤵
    PID:10396
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2012.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2012.exe
  2⤵
  PID:5380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7186.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7186.exe
    3⤵
    PID:3788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42371.exe
      4⤵
      PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52973.exe
        5⤵
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60643.exe
        6⤵
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60797.exe
        7⤵
        
        PID:11856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39078.exe
        6⤵
        
        PID:9252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3734.exe
        6⤵
        
        PID:6472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63912.exe
        5⤵
        
        PID:6644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26311.exe
        5⤵
        
        PID:8456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36874.exe
        5⤵
        
        PID:10528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29215.exe
      4⤵
      PID:1860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58422.exe
        5⤵
        
        PID:8820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3246.exe
        5⤵
        
        PID:10924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11669.exe
      4⤵
      PID:8324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1285.exe
        5⤵
        
        PID:11488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11663.exe
      4⤵
      PID:10844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18124.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18124.exe
    3⤵
    PID:4928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16409.exe
      4⤵
      PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65495.exe
        5⤵
        
        PID:7288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23375.exe
        5⤵
        
        PID:9584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24705.exe
        5⤵
        
        PID:11888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9641.exe
      4⤵
      PID:6748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26311.exe
      4⤵
      PID:1892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-575.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-575.exe
    3⤵
    PID:3908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4125.exe
      4⤵
      PID:7600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29557.exe
        5⤵
        
        PID:12432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5005.exe
      4⤵
      PID:10640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13669.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13669.exe
    3⤵
    PID:7964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31994.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31994.exe
    3⤵
    PID:10020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10866.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10866.exe
    3⤵
    PID:8608
- C:\Users\Admin\AppData\Local\Temp\Unicorn-93.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-93.exe
  2⤵
  PID:6132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43352.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43352.exe
    3⤵
    PID:1260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16959.exe
      4⤵
      PID:4348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48640.exe
        5⤵
        
        PID:7616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2291.exe
        5⤵
        
        PID:2408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8450.exe
        5⤵
        
        PID:2816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53087.exe
      4⤵
      PID:7460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57936.exe
      4⤵
      PID:4732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3900.exe
      4⤵
      PID:11284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59039.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59039.exe
    3⤵
    PID:1380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45011.exe
      4⤵
      PID:10716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14801.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14801.exe
    3⤵
    PID:8652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15010.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15010.exe
    3⤵
    PID:11208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14801.exe
      4⤵
      PID:12380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51888.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51888.exe
    3⤵
    PID:11904
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
  2⤵
  PID:1728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64514.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64514.exe
    3⤵
    PID:6152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28592.exe
      4⤵
      PID:10796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25051.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25051.exe
    3⤵
    PID:6036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50697.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50697.exe
    3⤵
    PID:11192
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51366.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51366.exe
  2⤵
  PID:6392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25925.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25925.exe
    3⤵
    PID:3772
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46646.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46646.exe
  2⤵
  PID:4180
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57305.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57305.exe
  2⤵
  PID:12164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1420 -ip 1420
1⤵
PID:6488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-10241.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-10241.exe
Size 5.1MB
SHA256 c692e7028e3035dae10e76097bb52b663d55372f62f0ddc30a64599293863ec4
MD5 da6e1a566250a3087e8840112a468664
SHA1 529bb54aaaa8a709613f3c9ae3be60125e2da9da
SHA512 8b1b7815371abfe8ee4ee1351c95a32dfb0ca4c01385a413bd32a8a48f7c0eaa88a3fc1ec8f6274a1a33cd901669c8b04155f0c61fa03808d1c113f6b07596da
SSDEEP 98304:iPgisOcCFzQtDWq/xW6pLfhDKyMi0LbqHgWKu2/nim7q2S9:iPgvZWqn/x55fhmrLGHgWKTDq2y
TLSH
T1A236E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9B60A2B337F1657EA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-10647.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-10647.exe
Size 5.1MB
SHA256 877ee5ad4962506b54eede3a408c387fde342f75bb44d13e6e16e843c9c13e6a
MD5 0d415ebee2ad3e306c168950b7d8c2ef
SHA1 6782aef134f1b8d2b96e9ec91a48570e075b056a
SHA512 c9271a01de783d39ff5cb55d4040ed6e71dbb1f6e5dbd63a73e1da1212ba0e96c679065dcf642f7b494d43efad8ddee099ccabe6d0b1fe0a1a491a124428a701
SSDEEP 98304:iPgisOcCFzQtDWq/xW6pLfhDKyMi0LMIHgiKu2/nim7q2HF:iPgvZWqn/x55fhmrLLHgiKTDq2l
TLSH
T1CD36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9B60A2B337F1657EA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-1285.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-1285.exe
Size 5.1MB
SHA256 1724406abc5481e692669f80a0b560ceef5406554077a2b5c9587e0a75d14671
MD5 29a1b504f66ad84598daa4169ae9c297
SHA1 09e663689ab1a25c9f8e59bebbebb33b619b020a
SHA512 767a0212b83991e68fd7ee59d750427c2c7b0aee3b6b24ace91d1f992c63dbbb7b1ef5d70433045248ca37354142f6322c9c62b44f80cfc5f88671fdd527ceb8
SSDEEP 98304:tTgisOcCFzQtDWq/xf6pLfhDKyMi0LbqHgWKu2/nim7q2Hf:tTgvZWqn/xS5fhmrLGHgWKTDq2/
TLSH
T16536E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9B60A2B337F1657EA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-2012.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-2012.exe
Size 5.1MB
SHA256 201efc6c2ccd62485a7d5f8dab149cb3405f89b680f8e38541037a14756c8c0a
MD5 917272e5e8a678300fce998ec5e8a6bc
SHA1 2e7f0dab1bd976a55a2f35f55b600d9af0712dc5
SHA512 391c2e3518c36abc92b21c516632b55d7630eec5c6bf479e8b5b6b48c6976e50afaa13fcaecfa7c255f364102c9b5872e4dc84745f883c96194c7837aef58f55
SSDEEP 98304:iTgisOcCFzQtDWq/xW6pLfhDKyMi0LbqHgWKu2/nim7q2H9:iTgvZWqn/x55fhmrLGHgWKTDq2d
TLSH
T14936E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9B60A2B337F1657EA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-21866.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-21866.exe
Size 5.1MB
SHA256 296b26edaad72b3d04ac1f1fa58fa9cebd6f979376ddad5ed5e5731318962b59
MD5 3c4ad14a88e208add7ad517382abe8a8
SHA1 ca507a735593b995024c71e6622ca8585d9b99b4
SHA512 8ca38c0b0be01ea01bc166df1e3498e1aacba341e06cc7362aeb6e2d661c174c8e0185f555567c72931beb2f999531236ec47dac5ab739cc0d5218fd74958885
SSDEEP 98304:iPgisOcCFzQtDWq/xW6pLfhDKyMi0LbqHgiKu2/nim7q2H9:iPgvZWqn/x55fhmrLGHgiKTDq2d
TLSH
T14D36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9B60A2B337F1657EA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-2277.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-2277.exe
Size 5.1MB
SHA256 bb784673eac7eaa9c530c3dd85f9c5b5e114fc869cddd31635ae81bc709a8d02
MD5 8a65fca4e08c5624b90cf13cad7bb3d5
SHA1 8e701e54ec6b9056d7e46039c020e0764be8779e
SHA512 7862eb26417823e92ec057d6ba97b2f3595f2e593cffc58f0b1f5f4a7038db8128d5dd26ed88bdfcc69d185b3ffd7f43eb25d98948bd587fb1dbf60d44095267
SSDEEP 98304:iPgisOcCFzQtDWq/RW6pLfhDKyMi0LaqHgWKu2/nom7q2HN:iPgvZWqn/R55fhmrLvHgWKTtq2t
TLSH
T1DB36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9B60A2B337F1657EA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-23149.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-23149.exe
Size 5.1MB
SHA256 a98f5e09c3ecdf0421089b417ded449370b51cc8d58a20136948097114e012a9
MD5 44ce10033744b57d269eb3ef8cc466f5
SHA1 dc18fef3a8a5ec23ec1146e15677c6083870acf2
SHA512 b8a6972c2e7d95d380328c0e573b3a6a61802694460d635ead3b0add890958284cdf793e2d4140dfe6298b14ded3a635ef28a031c7d3cea528582b1c1e586312
SSDEEP 98304:iPgisOcCFzQtDWq/xW6pLfhDKyMi0LHqHgWKu2/nom7q2HH:iPgvZWqn/x55fhmrLKHgWKTtq2n
TLSH
T10A36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9B60A2B337F1657EA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-24592.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-24592.exe
Size 5.1MB
SHA256 bef23beed7107e9acf840b5e535ad1141d3c6a36aefc3f416cad2757ca90dbef
MD5 9a7315a01299afc944106cd56f54b146
SHA1 2488df4b7a95ff0247c28fa639c6ba3fa5eeeba0
SHA512 4fa3ccd75520cbb60c0142919f0763f48dc85f82063a751def13c2c67777660fad57f7e16d0bb2e294e19341ec67d802abeb6b5d478849a07d3b8c9b3bc81e92
SSDEEP 98304:iPgisOcCFzQtDWq/8W6pLfhDKyM60LaqHgWKu2/nom7q2MN:iPgvZWqn/855fhmjLvHgWKTtq2M
TLSH
T13D36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9B60A2B337F1657EA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-25094.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-25094.exe
Size 5.1MB
SHA256 c81bc6cba86970e78b0bda5f02f282b329514d2ba4c9898287b05c76c233b034
MD5 3ae0578f590601f8e7d6ddf0a4a27364
SHA1 1e544fcdc9dd4916630d5cc578697d6ee9d6a554
SHA512 0e003127c80a9508490d2487db644e9b85c96f7a7a778373a7501d39dab6e10dbbf5f9e92c650c7735fc181ca9c41d35a83662d41d56e55b5f7dd222105411fb
SSDEEP 98304:iPgisOcCFzQtDWq/xW6pLfhDKyMi0LbqHgWKur/nom7q2HH:iPgvZWqn/x55fhmrLGHgWKOtq2n
TLSH
T1DE36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9B60A2B337F1657EA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-30513.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-30513.exe
Size 5.1MB
SHA256 ff706e8501bd8d4ecefa4925659838daa743d4827f7c1aeedcdfd79334967813
MD5 49159e1ac03cd02c1c6820a4dc4320f4
SHA1 f918537a928505a8c9ab0ff1be6723f236105428
SHA512 61dc63077954032907cbd6a857dcbe14a0b0e133b445e0600dc2d72d9e02dce9f2a0c462ef034a6491e0605d263549b1c82dd756da26c1de2730a2de587afa3f
SSDEEP 98304:iPgisOcCFzQtDWq/RW6pHfhDKyMi0LaqHgWKu2/nom7q2H3:iPgvZWqn/R59fhmrLvHgWKTtq2X
TLSH
T1F036E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9B60A2B337F1657EA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-33205.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-33205.exe
Size 5.1MB
SHA256 3bdf913051cdff68ae8ea2f8a21167e98773929d6c9f50fa932f3486205950fc
MD5 0f66927adf27e2cb35f823914c6ff53f
SHA1 3ab58bf548aa0f64bd2193d6583cec3288888c85
SHA512 bd2d2cccfff237a4f04fa6a348b9ac8300521d2200c3ed930207f0614c4d558907de714f7f04bff76779b93d359bad1dec253e66d2c57e704b8a20f0b16693d6
SSDEEP 98304:iPgisOcCFzQtDWq/FW6pLfhDKyMi0LaqHgWKu2/nom782Hf:iPgvZWqn/F55fhmrLvHgWKTt82/
TLSH
T1BA36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9B60A2B337F1657EA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-3408.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-3408.exe
Size 5.1MB
SHA256 aa59e60d9b72939e5bc394805f53e0a89cbc53c3f2f986348f38a15deba6d649
MD5 df5abb0a5c3fe2a15968945206935b3d
SHA1 a9c18f923c41aa037a7f4edd512c33fa57205c91
SHA512 bcf9b1e68da9e864fe3a59dce8df83a0d6509a9f85c52f6f75b41350b97387f22c7a09314ad38ed3563ee47c9f72214edd2cf7ef4cfde90721448ce94734a90e
SSDEEP 98304:iPgisOcCFzQtDWq/xW6pLfhDKyMi0LbqHgWKur/nom7q2dF:iPgvZWqn/x55fhmrLGHgWKOtq2r
TLSH
T1EC36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9B60A2B337F1657EA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-34688.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-34688.exe
Size 5.1MB
SHA256 1833bace196f4a64e04a56cbca485b33a3b5f8da76e8ad64e066e8ec32e768e7
MD5 8bd84d10ba9e8070a9c99442084548a2
SHA1 ef88319a3fa47e7376b3049e7b241520b00fa7cc
SHA512 dcd5d3220f5e6864f1f33ad85b1d58fcad24165263955469820ed83d9a6b89401cf62bca6c031d76bc72399dddc497267e526686e473930b25e21066163daf4c
SSDEEP 98304:iPgisOcCFzQtDWq/xW6MLfhDKyMi0LbqHgiKu2/nim7q2HH:iPgvZWqn/x5WfhmrLGHgiKTDq2n
TLSH
T1E636E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9B60A2B337F1657EA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-37472.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-37472.exe
Size 5.1MB
SHA256 42277d584807c68e998275c94fe68c9ba3493b4b5b66848913337767983736ff
MD5 18c13839a95492582a2b3639656b6e62
SHA1 8056ec25bb1be1cdf46d3e3dac8f5b4a116c34e2
SHA512 1c390d93060f416647c619fe32af20d68d9caec7b6eead0ceec1085d886079f80d7b9c1d17aa991cfd95615442e1855109efdb1a336fd884cb1e98c0b44fffd8
SSDEEP 98304:iPgisOcCFzQtDWq/xW6pLfhDKyMi0LbIHgilu2/nim7q2HF:iPgvZWqn/x55fhmrLUHgilTDq2l
TLSH
T17F36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9B60A2B337F1657EA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-37704.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-37704.exe
Size 5.1MB
SHA256 e5fa6ae0c249f4973e8b73c0f28a81c6bd57c56bb36d13629314a0526cd6f1a3
MD5 04d25861d74f3645b4697181619938f5
SHA1 ba4d81ffca4105b4e84bd0bd5a453aa7631efa86
SHA512 9cf728a6fe8fae0c30a88d2f4654b3b5e17efbb751f1204c3f77dc591b188b565a01b2aaffde87973afb2ac06a0ba3ec25c4cd18553057778edbba5d4f1f4339
SSDEEP 98304:iPgisOcCFzQtDWq/xW6pLf0DKyMi0LaqHgWKu2/nom7q2Mf:iPgvZWqn/x55f0mrLvHgWKTtq2E
TLSH
T1B336E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9B60A2B337F1657EA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-3927.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-3927.exe
Size 5.1MB
SHA256 130e204bf391c9b679c80152e5ac9012de81012dda40191483b279d02f44d19e
MD5 a2100a61259cdd84531ed95db6efe106
SHA1 62a9c2de24345d31a7a3f9498e0df0fb872d7d97
SHA512 8da3a622dfc415c72d490e610ab352f93c310ce8e0e0000e27dbaa07a7b1ca50952d7c3086cc90a451978de9d91cd9261fd1a3ef4b979db8f18d6b7c6f8d5a1a
SSDEEP 98304:iPgisOcCFzQtDWq/xW6pLfhDKyMi0LaqHgWKu2/nom7q2MF:iPgvZWqn/x55fhmrLvHgWKTtq2s
TLSH
T1A636E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9B60A2B337F1657EA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-40663.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-40663.exe
Size 5.1MB
SHA256 527e50084af5b96b92e6d5496daa1aeda5af8cefcf38e3ebc9804c73c32a71d0
MD5 4a0a9655aec43659ebdeba265729ca3d
SHA1 3ec9ea126da85c0094b0229f1130d892a5111bfb
SHA512 bba9ab228156e751a9209ae5b7bfd3a7f479d534e61ac49f8a1f841462c6b4023433a7179606854b37b837a8053b828fc74befb013be734a0222b6ef03ae98da
SSDEEP 98304:iPgisOcCFzQtDWq/xW6pLfhDKyMi0LaqHgWKu2/nom7q2HH:iPgvZWqn/x55fhmrLvHgWKTtq2n
TLSH
T14736E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9B60A2B337F1657EA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-41373.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-41373.exe
Size 5.1MB
SHA256 e13397f583893927e0eadd0b6787b7d549d99828d7e46caa3260c4144d5423be
MD5 599496a350f7c266489883dd31c55efa
SHA1 9cf93f67f1b5a495acd0cb21ab7950a27231a79e
SHA512 002e94502db411651cb6c4a57ad5c4e3496405071fb29f03e0786626fe192a9640cb6dc1884e9fca2bc9865f4fb455a0dac13d6fed37697ec41ea4cd4d655ed1
SSDEEP 98304:i/gisOcCFzQtDWq/xW6pLfhDKyMi0LbqHgWKur/nom7q2df:i/gvZWqn/x55fhmrLGHgWKOtq2x
TLSH
T1F436E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9B60A2B337F1657EA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-41997.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-41997.exe
Size 5.1MB
SHA256 3d0c9455eb59971c30ced2f2c2319b13dfae708007c3cc427e371839db2840cf
MD5 1d77922749a8835633494a6e566f4200
SHA1 5186c44980fca1b63e16f5c70387ae6f537d6aa0
SHA512 0c7a280d69824fd83b574088c7f98bcd06a9fa18c4aa5401699ef350839969ea5468b19c3029a1f0ddc2582e21d8dd51b9db386173f9e1aab2bbbc87a2647ae3
SSDEEP 98304:iPgisOcCFzQtDWq/xW6pLfhDKyMi0LyIHgilu2/nim7q2HN:iPgvZWqn/x55fhmrL5HgilTDq2t
TLSH
T1C836E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9B60A2B337F1657EA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-43834.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-43834.exe
Size 5.1MB
SHA256 e91bb0109479918d0db27303313627672840b2145df73c430b9ded88a3efb629
MD5 6e95fbd27c582f5fab8424e5ce6cb187
SHA1 045b2e243f118c823eeaabe54985f1b7777daa58
SHA512 1d5b4cfc551b35f65dfcf0744366301d9263de337a0359dde51d7a6d1d73b74dd0df8ab54801965f6e0072dc89a1f3e0b358bd2a4b898236dafbf86179767ddf
SSDEEP 98304:iPgisOcCFzQtDWq/RW6pLfhDKyMi0LbqHgWKu2/nom7q2H3:iPgvZWqn/R55fhmrLGHgWKTtq2X
TLSH
T12736E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9B60A2B337F1657EA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-46387.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-46387.exe
Size 5.1MB
SHA256 89d86cc530d9e1e10943bb407575309a4751c56743c5e7c31082da49fd55c492
MD5 cdd70b11496d49842ffb9d1b404ee190
SHA1 5aa6cfa2d3454c9ae905107c5a392e9d69f96320
SHA512 0e517348a82e509035981e2c52ccef42073701145f93012af232396581fc8b5fb0d85791ab272917fbc792b8edd0d9c9233ad9e5df7ddc5d7ca77bcceb80e59e
SSDEEP 98304:iPgisOcCFzQtDWq/xW6pLfhDKyMi0LmqHgWKu2/nom7q2Mf:iPgvZWqn/x55fhmrLzHgWKTtq2E
TLSH
T1DE36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9B60A2B337F1657EA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-47918.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-47918.exe
Size 5.1MB
SHA256 8e973a4c0df0d495e52375540a7f786757d148a12b2b2881d166848d4ba85fd5
MD5 ebd244fa5cfbd77828564894997afdcf
SHA1 5d344a79fb09bd03d2c2803832ea2e90217b883b
SHA512 3280be11baad5ab48d9896acf35515350d29d251f31d3910d7ff466dc78ff4a3b2998a289b75d373e6e20885e7cb9be83b8a5a322379f8a470490cf06a61a966
SSDEEP 98304:iPgisOcCFzQtDWq/OW6pLfhDKyMi0LbIHgilu2/nim7q2Hf:iPgvZWqn/O55fhmrLUHgilTDq2/
TLSH
T10836E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9B60A2B337F1657EA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-47949.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-47949.exe
Size 5.1MB
SHA256 d2898bfbbbbc0101835609907b80cc928eae5ac76ae7d3c4bf5fab2687dfbcf3
MD5 e6f4c2e9fd887dc7d3a78ea0699cf148
SHA1 d034e996bcd0769b515429ecfd52f5286412d47e
SHA512 8c3ebfbbafbee87f62bb3fb9bd1cd35645479e2b0732204440a9db439e823e0754ba3d3c1573d8b23a7426cdee9ab0cebf626bcf6e1191c949ebc848f208965b
SSDEEP 98304:iPgisOcCFzQtDWq/xW6pLfhDKyM60LaqHgWKu2/nom7q2Mf:iPgvZWqn/x55fhmjLvHgWKTtq2E
TLSH
T11C36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9B60A2B337F1657EA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-50113.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-50113.exe
Size 5.1MB
SHA256 31eeff279e9514f65133044da46bb940ba5b8b6d768faae91295b6862f199209
MD5 ad20cbb868aeb24e5858be81b6bc13b2
SHA1 ec102f5a954ce18cb23ea6808e7ac2e241070021
SHA512 ea34c790c607e4086f5f2c13a192b88d7f96fcdd78ef481e9992de5abe879d93eddfc9578fb6484a84ea8e05f2965a620afd2c266a7e1cfdc00ae0ff9f5f7213
SSDEEP 98304:iPgisOcCFzQtDWq/xW6pLfhDKyMi0LbIHgiKu2/nim7q2HH:iPgvZWqn/x55fhmrLUHgiKTDq2n
TLSH
T1A136E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9B60A2B337F1657EA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-58317.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-58317.exe
Size 5.1MB
SHA256 71e43cd00c2987cff69dafff3759c73eb9195c0e0be0e4efeec2b67209bef67f
MD5 f06574eefe6637c248326a3628112ad7
SHA1 aab273683c4c507a3a3cfbddfcf0a5fe35766067
SHA512 297e462601bda366e5c46e20833ded10fb7220f4151dc771273afbaa094d4c8b49f8e180d84c451ee47c60843f2b1fb29baa2bbeaa33da861edf95c52e9b235e
SSDEEP 98304:iPgisOcCFzQtDWq/FW6pLfhDKyMi0LaqHgWKu2/nom7q2HF:iPgvZWqn/F55fhmrLvHgWKTtq2l
TLSH
T18E36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9B60A2B337F1657EA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-58779.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-58779.exe
Size 5.1MB
SHA256 325967220ba46c05945746e352c74ce7c1e8a21eb89b50464dd0c1c7e180489d
MD5 3f229a33673820fb5dbdf6b1337cb301
SHA1 9ba30f065e9444cd405c5d8aaf29713bb07f579b
SHA512 59b69597a85471f1004fd0faf156161791ecc13258ad0da52d234880fcb16307163bca566ac8f1f29662cffc975b5368f155a705cbe910b9b0de45933bb73a0a
SSDEEP 98304:iPgisOcCFzQtDWq/iW6pLfhDKyMi0LbqHgWKu2/nim7q2SH:iPgvZWqn/i55fhmrLGHgWKTDq22
TLSH
T1CF36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9B60A2B337F1657EA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-59402.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-59402.exe
Size 5.1MB
SHA256 9b529ff1a8f323144b9e40f1b24bad9d9cf74d147bc4406d1eceb81f4f4e8812
MD5 67cdb7712bd295b537dae3a141f03dd0
SHA1 54c2f5bb67cea672da28b0e2cbae0b7a3894c82c
SHA512 c5a3a7d8c35ca68d35a72d7ac01789a61c0c7c28bedfc302d194b203c9f1bfc55af79daf9420b4504d6d1adc43e9244f9e7ac02fedaddd446fa1fdf9b6350fe5
SSDEEP 98304:iPnisOcCFzQtDWq/xW6pLfhDKyMi0LbqHgWKu2/nRm7q2HF:iPnvZWqn/x55fhmrLGHgWKTSq2l
TLSH
T1DB36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9B60A2B337F1657EA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-59656.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-59656.exe
Size 5.1MB
SHA256 ba1d6050629e71b37c84b0dce7e9c73116f28e391c7d9f3d59aacaa6e39f9070
MD5 01bb68a83cc3c504909e30665062d264
SHA1 4561c37dec8bc737b01e14524b4aa8b14c98ede0
SHA512 84844d01b830912e17628a8d9f29d180488c207518b267b2b93b3e98b75c551934983332b3429ecd187083f89786a87ba1e7cda31fcf209f674d62c90cf1f38d
SSDEEP 98304:iPgisOcCFzQtDWq/xW6pLfhDKyMi0LbqHgWKu2/nom7q2H9:iPgvZWqn/x55fhmrLGHgWKTtq2d
TLSH
T14D36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9B60A2B337F1657EA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-65083.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-65083.exe
Size 5.1MB
SHA256 a11d68d5ec7773fc95717c5d1e9d2896d0c9eb5d5a38cfc4e7f8b51e0dbd16c0
MD5 966db7051a471cfd7b1ce28b6fe15142
SHA1 b8bc6e3aaf9681e99467a72d70fc7f4c024a19c9
SHA512 564acde7be1178f054bdf7e41fdbe01d16b80bcbcca429f045c2b5904f1d3669f158425a2affd02f1c36c954ebb4d98f09a2a31165e78baa8858d039cc080559
SSDEEP 98304:iPnisOcCFzQtDWq/xW6pLfhDKyMi0LbqHgWKu2/nom7q2HH:iPnvZWqn/x55fhmrLGHgWKTtq2n
TLSH
T1D636E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9B60A2B337F1657EA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-7186.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-7186.exe
Size 5.1MB
SHA256 19bb2e2483dcb320695c5075dd647b6a3b23866c5682edb664cc5159ce78d41e
MD5 de1d38bdc6f12aec5a61780a3b7f26ec
SHA1 a7fa3f820d70e12b2bbb8b58cc444cdc3cf11cb5
SHA512 f204366c023b9391f23058bb00d44ccd1ed6a57ea32aa57a13ab8d613d80dc52333160154edc021891fe3091d7ed35b773af3a5258d00c3f599b198c0d733eb1
SSDEEP 98304:iTgisOcCFzQtDWq/xW6pLfhDKyMi0LbqHgWKu2/nim7q2HH:iTgvZWqn/x55fhmrLGHgWKTDq2n
TLSH
T13C36E038E9A41ED4F033F2344A51D511E2A57C7A63108BCF27D9B60A2B337F1657EA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1016-545-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1040-1113-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1188-1130-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1368-81-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1380-822-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1420-279-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1624-540-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1676-216-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1720-537-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1816-1153-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1876-1699-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1876-0-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1968-675-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1976-559-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2104-557-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2136-1136-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2192-650-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2508-728-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2652-2580-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2720-725-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2776-729-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2956-266-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3132-544-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3152-532-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3264-378-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3280-451-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3456-1092-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3528-613-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3752-265-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3848-558-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3908-676-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4092-234-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4340-730-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4348-731-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4364-49-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4396-1119-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4560-612-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4712-539-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4824-541-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4840-1158-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4956-609-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5012-767-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5068-218-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5364-603-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5380-118-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5388-1063-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5460-403-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5612-235-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5736-1118-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5824-280-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5836-543-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5932-217-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5956-727-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6044-1065-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6064-677-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6208-938-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6232-939-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6316-1097-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6344-1135-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6392-1098-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6412-1132-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6456-941-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6464-940-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6532-1062-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6552-1111-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6588-1154-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6596-1059-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6644-1131-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6648-1314-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6728-965-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6744-1100-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6748-1134-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6780-1105-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6924-934-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6944-964-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6960-1001-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6972-966-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7016-1112-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7044-1117-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7056-1114-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7068-1061-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7100-1133-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7116-1250-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7164-1096-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7272-1155-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7284-1249-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7384-1284-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7508-1303-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7592-1156-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7600-1157-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7612-1285-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7660-1179-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7956-1161-0x0000000000400000-0x0000000000475000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads