eddc46a662b51109ef2f83589bfe3c60d820b4c1f47b9e5e8e218d10f0485ba5

Analysis

max time kernel
150s
max time network
20s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 03:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eddc46a662b51109ef2f83589bfe3c60d820b4c1f47b9e5e8e218d10f0485ba5.exe
Size

468KB
MD5

b78db7fdb0a224afb61a5f786ee74934
SHA1

6be7547361d3422552ace91a676843a4ee8a6ed2
SHA256

eddc46a662b51109ef2f83589bfe3c60d820b4c1f47b9e5e8e218d10f0485ba5
SHA512

e867c1a47b1faedf84076bfc07f9896e0f87cd2d19ebff339a76af46f70f8ff324ab1759bf7c1092db43e262b06df999e8dcf3201ec8ad333cbb0919aed3354f
SSDEEP

3072:hDDKowLNjy8U6bYPfzsjff5/lhAoIpBnmH0AV8KljzXh2iNDZlT:hDmoILU6kfwjffx0lcljrkiND

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2720	Unicorn-8125.exe
2768	Unicorn-49724.exe
2788	Unicorn-62723.exe
2836	Unicorn-57259.exe
2652	Unicorn-29522.exe
2532	Unicorn-25992.exe
2596	Unicorn-56064.exe
2832	Unicorn-9885.exe
2052	Unicorn-21623.exe
1380	Unicorn-21728.exe
1120	Unicorn-18665.exe
108	Unicorn-38531.exe
572	Unicorn-49614.exe
2448	Unicorn-28666.exe
2152	Unicorn-55744.exe
2352	Unicorn-50223.exe
2244	Unicorn-5116.exe
1764	Unicorn-24022.exe
960	Unicorn-36444.exe
628	Unicorn-22569.exe
948	Unicorn-19126.exe
1984	Unicorn-34920.exe
2344	Unicorn-41051.exe
1448	Unicorn-40786.exe
1060	Unicorn-40283.exe
2068	Unicorn-36369.exe
1724	Unicorn-55503.exe
1572	Unicorn-9831.exe
2648	Unicorn-36069.exe
2656	Unicorn-30117.exe
2640	Unicorn-34392.exe
2580	Unicorn-53298.exe
2492	Unicorn-32970.exe
2612	Unicorn-46706.exe
2628	Unicorn-6759.exe
1624	Unicorn-44990.exe
2100	Unicorn-48384.exe
928	Unicorn-63952.exe
2852	Unicorn-44087.exe
1080	Unicorn-46116.exe
2036	Unicorn-53210.exe
2360	Unicorn-28165.exe
2216	Unicorn-38602.exe
2284	Unicorn-693.exe
872	Unicorn-4331.exe
2464	Unicorn-53376.exe
2440	Unicorn-38732.exe
1804	Unicorn-38732.exe
668	Unicorn-9084.exe
1124	Unicorn-58550.exe
1884	Unicorn-51725.exe
2196	Unicorn-38196.exe
1608	Unicorn-27798.exe
2632	Unicorn-23521.exe
2664	Unicorn-26475.exe
2744	Unicorn-6033.exe
2660	Unicorn-58571.exe
2876	Unicorn-14040.exe
2840	Unicorn-27775.exe
2260	Unicorn-33906.exe
2484	Unicorn-33906.exe
2388	Unicorn-33906.exe
1500	Unicorn-33065.exe
1812	Unicorn-23730.exe

Loads dropped DLL 64 IoCs

pid	Process
2256	eddc46a662b51109ef2f83589bfe3c60d820b4c1f47b9e5e8e218d10f0485ba5.exe
2256	eddc46a662b51109ef2f83589bfe3c60d820b4c1f47b9e5e8e218d10f0485ba5.exe
2720	Unicorn-8125.exe
2256	eddc46a662b51109ef2f83589bfe3c60d820b4c1f47b9e5e8e218d10f0485ba5.exe
2720	Unicorn-8125.exe
2256	eddc46a662b51109ef2f83589bfe3c60d820b4c1f47b9e5e8e218d10f0485ba5.exe
2768	Unicorn-49724.exe
2768	Unicorn-49724.exe
2788	Unicorn-62723.exe
2720	Unicorn-8125.exe
2788	Unicorn-62723.exe
2720	Unicorn-8125.exe
2256	eddc46a662b51109ef2f83589bfe3c60d820b4c1f47b9e5e8e218d10f0485ba5.exe
2256	eddc46a662b51109ef2f83589bfe3c60d820b4c1f47b9e5e8e218d10f0485ba5.exe
2836	Unicorn-57259.exe
2836	Unicorn-57259.exe
2768	Unicorn-49724.exe
2768	Unicorn-49724.exe
2652	Unicorn-29522.exe
2652	Unicorn-29522.exe
2532	Unicorn-25992.exe
2788	Unicorn-62723.exe
2788	Unicorn-62723.exe
2532	Unicorn-25992.exe
2596	Unicorn-56064.exe
2720	Unicorn-8125.exe
2720	Unicorn-8125.exe
2256	eddc46a662b51109ef2f83589bfe3c60d820b4c1f47b9e5e8e218d10f0485ba5.exe
2256	eddc46a662b51109ef2f83589bfe3c60d820b4c1f47b9e5e8e218d10f0485ba5.exe
2596	Unicorn-56064.exe
2832	Unicorn-9885.exe
2832	Unicorn-9885.exe
2836	Unicorn-57259.exe
2836	Unicorn-57259.exe
1380	Unicorn-21728.exe
1380	Unicorn-21728.exe
2052	Unicorn-21623.exe
2652	Unicorn-29522.exe
2652	Unicorn-29522.exe
2768	Unicorn-49724.exe
2052	Unicorn-21623.exe
2768	Unicorn-49724.exe
2788	Unicorn-62723.exe
2720	Unicorn-8125.exe
572	Unicorn-49614.exe
2788	Unicorn-62723.exe
2720	Unicorn-8125.exe
572	Unicorn-49614.exe
108	Unicorn-38531.exe
108	Unicorn-38531.exe
2532	Unicorn-25992.exe
2532	Unicorn-25992.exe
2596	Unicorn-56064.exe
2448	Unicorn-28666.exe
2596	Unicorn-56064.exe
2448	Unicorn-28666.exe
2256	eddc46a662b51109ef2f83589bfe3c60d820b4c1f47b9e5e8e218d10f0485ba5.exe
2256	eddc46a662b51109ef2f83589bfe3c60d820b4c1f47b9e5e8e218d10f0485ba5.exe
2352	Unicorn-50223.exe
2352	Unicorn-50223.exe
2832	Unicorn-9885.exe
2832	Unicorn-9885.exe
2244	Unicorn-5116.exe
2244	Unicorn-5116.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
1680	1380	WerFault.exe	38
2496	2652	WerFault.exe	33
2848	1764	WerFault.exe	46
2504	960	WerFault.exe	48
3064	1624	WerFault.exe	64
3288	2356	WerFault.exe	97

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50183.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37305.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39932.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36622.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51013.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11221.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48384.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8447.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8447.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48434.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40617.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18407.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36444.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38196.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60477.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16518.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7072.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14736.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32103.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38850.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38732.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46461.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39737.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7603.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38888.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37898.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14736.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32970.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46116.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60079.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11221.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38531.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45272.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24878.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1951.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51509.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35529.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1128.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9741.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9471.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24138.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18665.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63393.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51378.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38732.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4407.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59163.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17319.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58571.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46481.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7603.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39932.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9521.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8153.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18406.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6601.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2256	eddc46a662b51109ef2f83589bfe3c60d820b4c1f47b9e5e8e218d10f0485ba5.exe
2720	Unicorn-8125.exe
2768	Unicorn-49724.exe
2788	Unicorn-62723.exe
2836	Unicorn-57259.exe
2652	Unicorn-29522.exe
2532	Unicorn-25992.exe
2596	Unicorn-56064.exe
2832	Unicorn-9885.exe
2052	Unicorn-21623.exe
1380	Unicorn-21728.exe
1120	Unicorn-18665.exe
572	Unicorn-49614.exe
108	Unicorn-38531.exe
2448	Unicorn-28666.exe
2152	Unicorn-55744.exe
2352	Unicorn-50223.exe
2244	Unicorn-5116.exe
628	Unicorn-22569.exe
1764	Unicorn-24022.exe
2344	Unicorn-41051.exe
960	Unicorn-36444.exe
1984	Unicorn-34920.exe
2068	Unicorn-36369.exe
1448	Unicorn-40786.exe
948	Unicorn-19126.exe
1572	Unicorn-9831.exe
1060	Unicorn-40283.exe
2648	Unicorn-36069.exe
2656	Unicorn-30117.exe
2640	Unicorn-34392.exe
2612	Unicorn-46706.exe
2580	Unicorn-53298.exe
2492	Unicorn-32970.exe
2628	Unicorn-6759.exe
1624	Unicorn-44990.exe
2100	Unicorn-48384.exe
928	Unicorn-63952.exe
2852	Unicorn-44087.exe
1080	Unicorn-46116.exe
2036	Unicorn-53210.exe
2360	Unicorn-28165.exe
2216	Unicorn-38602.exe
2284	Unicorn-693.exe
872	Unicorn-4331.exe
1804	Unicorn-38732.exe
2440	Unicorn-38732.exe
2464	Unicorn-53376.exe
1884	Unicorn-51725.exe
2196	Unicorn-38196.exe
668	Unicorn-9084.exe
1608	Unicorn-27798.exe
2632	Unicorn-23521.exe
1124	Unicorn-58550.exe
2664	Unicorn-26475.exe
2744	Unicorn-6033.exe
2660	Unicorn-58571.exe
2484	Unicorn-33906.exe
2840	Unicorn-27775.exe
2260	Unicorn-33906.exe
1500	Unicorn-33065.exe
2876	Unicorn-14040.exe
2388	Unicorn-33906.exe
1812	Unicorn-23730.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2720	2256	eddc46a662b51109ef2f83589bfe3c60d820b4c1f47b9e5e8e218d10f0485ba5.exe	29
PID 2256 wrote to memory of 2720	2256	eddc46a662b51109ef2f83589bfe3c60d820b4c1f47b9e5e8e218d10f0485ba5.exe	29
PID 2256 wrote to memory of 2720	2256	eddc46a662b51109ef2f83589bfe3c60d820b4c1f47b9e5e8e218d10f0485ba5.exe	29
PID 2256 wrote to memory of 2720	2256	eddc46a662b51109ef2f83589bfe3c60d820b4c1f47b9e5e8e218d10f0485ba5.exe	29
PID 2720 wrote to memory of 2768	2720	Unicorn-8125.exe	30
PID 2720 wrote to memory of 2768	2720	Unicorn-8125.exe	30
PID 2720 wrote to memory of 2768	2720	Unicorn-8125.exe	30
PID 2720 wrote to memory of 2768	2720	Unicorn-8125.exe	30
PID 2256 wrote to memory of 2788	2256	eddc46a662b51109ef2f83589bfe3c60d820b4c1f47b9e5e8e218d10f0485ba5.exe	31
PID 2256 wrote to memory of 2788	2256	eddc46a662b51109ef2f83589bfe3c60d820b4c1f47b9e5e8e218d10f0485ba5.exe	31
PID 2256 wrote to memory of 2788	2256	eddc46a662b51109ef2f83589bfe3c60d820b4c1f47b9e5e8e218d10f0485ba5.exe	31
PID 2256 wrote to memory of 2788	2256	eddc46a662b51109ef2f83589bfe3c60d820b4c1f47b9e5e8e218d10f0485ba5.exe	31
PID 2768 wrote to memory of 2836	2768	Unicorn-49724.exe	32
PID 2768 wrote to memory of 2836	2768	Unicorn-49724.exe	32
PID 2768 wrote to memory of 2836	2768	Unicorn-49724.exe	32
PID 2768 wrote to memory of 2836	2768	Unicorn-49724.exe	32
PID 2788 wrote to memory of 2652	2788	Unicorn-62723.exe	33
PID 2788 wrote to memory of 2652	2788	Unicorn-62723.exe	33
PID 2788 wrote to memory of 2652	2788	Unicorn-62723.exe	33
PID 2788 wrote to memory of 2652	2788	Unicorn-62723.exe	33
PID 2720 wrote to memory of 2532	2720	Unicorn-8125.exe	34
PID 2720 wrote to memory of 2532	2720	Unicorn-8125.exe	34
PID 2720 wrote to memory of 2532	2720	Unicorn-8125.exe	34
PID 2720 wrote to memory of 2532	2720	Unicorn-8125.exe	34
PID 2256 wrote to memory of 2596	2256	eddc46a662b51109ef2f83589bfe3c60d820b4c1f47b9e5e8e218d10f0485ba5.exe	35
PID 2256 wrote to memory of 2596	2256	eddc46a662b51109ef2f83589bfe3c60d820b4c1f47b9e5e8e218d10f0485ba5.exe	35
PID 2256 wrote to memory of 2596	2256	eddc46a662b51109ef2f83589bfe3c60d820b4c1f47b9e5e8e218d10f0485ba5.exe	35
PID 2256 wrote to memory of 2596	2256	eddc46a662b51109ef2f83589bfe3c60d820b4c1f47b9e5e8e218d10f0485ba5.exe	35
PID 2836 wrote to memory of 2832	2836	Unicorn-57259.exe	36
PID 2836 wrote to memory of 2832	2836	Unicorn-57259.exe	36
PID 2836 wrote to memory of 2832	2836	Unicorn-57259.exe	36
PID 2836 wrote to memory of 2832	2836	Unicorn-57259.exe	36
PID 2768 wrote to memory of 2052	2768	Unicorn-49724.exe	37
PID 2768 wrote to memory of 2052	2768	Unicorn-49724.exe	37
PID 2768 wrote to memory of 2052	2768	Unicorn-49724.exe	37
PID 2768 wrote to memory of 2052	2768	Unicorn-49724.exe	37
PID 2652 wrote to memory of 1380	2652	Unicorn-29522.exe	38
PID 2652 wrote to memory of 1380	2652	Unicorn-29522.exe	38
PID 2652 wrote to memory of 1380	2652	Unicorn-29522.exe	38
PID 2652 wrote to memory of 1380	2652	Unicorn-29522.exe	38
PID 2788 wrote to memory of 1120	2788	Unicorn-62723.exe	40
PID 2788 wrote to memory of 1120	2788	Unicorn-62723.exe	40
PID 2788 wrote to memory of 1120	2788	Unicorn-62723.exe	40
PID 2788 wrote to memory of 1120	2788	Unicorn-62723.exe	40
PID 2532 wrote to memory of 108	2532	Unicorn-25992.exe	39
PID 2532 wrote to memory of 108	2532	Unicorn-25992.exe	39
PID 2532 wrote to memory of 108	2532	Unicorn-25992.exe	39
PID 2532 wrote to memory of 108	2532	Unicorn-25992.exe	39
PID 2720 wrote to memory of 572	2720	Unicorn-8125.exe	42
PID 2720 wrote to memory of 572	2720	Unicorn-8125.exe	42
PID 2720 wrote to memory of 572	2720	Unicorn-8125.exe	42
PID 2720 wrote to memory of 572	2720	Unicorn-8125.exe	42
PID 2256 wrote to memory of 2448	2256	eddc46a662b51109ef2f83589bfe3c60d820b4c1f47b9e5e8e218d10f0485ba5.exe	43
PID 2256 wrote to memory of 2448	2256	eddc46a662b51109ef2f83589bfe3c60d820b4c1f47b9e5e8e218d10f0485ba5.exe	43
PID 2256 wrote to memory of 2448	2256	eddc46a662b51109ef2f83589bfe3c60d820b4c1f47b9e5e8e218d10f0485ba5.exe	43
PID 2256 wrote to memory of 2448	2256	eddc46a662b51109ef2f83589bfe3c60d820b4c1f47b9e5e8e218d10f0485ba5.exe	43
PID 2596 wrote to memory of 2152	2596	Unicorn-56064.exe	41
PID 2596 wrote to memory of 2152	2596	Unicorn-56064.exe	41
PID 2596 wrote to memory of 2152	2596	Unicorn-56064.exe	41
PID 2596 wrote to memory of 2152	2596	Unicorn-56064.exe	41
PID 2832 wrote to memory of 2352	2832	Unicorn-9885.exe	44
PID 2832 wrote to memory of 2352	2832	Unicorn-9885.exe	44
PID 2832 wrote to memory of 2352	2832	Unicorn-9885.exe	44
PID 2832 wrote to memory of 2352	2832	Unicorn-9885.exe	44

C:\Users\Admin\AppData\Local\Temp\eddc46a662b51109ef2f83589bfe3c60d820b4c1f47b9e5e8e218d10f0485ba5.exe
"C:\Users\Admin\AppData\Local\Temp\eddc46a662b51109ef2f83589bfe3c60d820b4c1f47b9e5e8e218d10f0485ba5.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8125.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8125.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49724.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49724.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57259.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9885.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50223.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30117.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4331.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11603.exe
        9⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15102.exe
        9⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51509.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14736.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47822.exe
        8⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59163.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57243.exe
        8⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57845.exe
        8⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7603.exe
        8⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38850.exe
        8⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33555.exe
        8⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53376.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1702.exe
        8⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60673.exe
        8⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2766.exe
        7⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46461.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4587.exe
        7⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1128.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
        7⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17319.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37755.exe
        7⤵
        
        PID:6032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34392.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58550.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37088.exe
        8⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4407.exe
        7⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22352.exe
        7⤵
        
        PID:1008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26537.exe
        7⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50183.exe
        7⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60841.exe
        7⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38196.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3899.exe
        7⤵
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37898.exe
        7⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39932.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36091.exe
        7⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43449.exe
        7⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6601.exe
        7⤵
        
        PID:4996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24008.exe
        6⤵
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-520.exe
        6⤵
        
        PID:1668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7076.exe
        6⤵
        
        PID:3556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18193.exe
        6⤵
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3138.exe
        6⤵
        
        PID:4864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11984.exe
        6⤵
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65041.exe
        6⤵
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5116.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53298.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27798.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62509.exe
        8⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8335.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13968.exe
        8⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59891.exe
        8⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4407.exe
        7⤵
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7731.exe
        7⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63434.exe
        7⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17663.exe
        7⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7603.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38850.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33555.exe
        7⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23521.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7339.exe
        7⤵
        
        PID:608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62148.exe
        7⤵
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51378.exe
        7⤵
        
        PID:3120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51243.exe
        7⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24138.exe
        7⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38120.exe
        7⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55610.exe
        7⤵
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17161.exe
        6⤵
        
        PID:1916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16211.exe
        6⤵
        
        PID:1096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48578.exe
        6⤵
        
        PID:3216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26042.exe
        6⤵
        
        PID:3404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
        6⤵
        
        PID:4808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50183.exe
        6⤵
        
        PID:4100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37755.exe
        6⤵
        
        PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46706.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33906.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50541.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15928.exe
        7⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30492.exe
        7⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39932.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36091.exe
        7⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25738.exe
        7⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6601.exe
        7⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30291.exe
        6⤵
        
        PID:2740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        6⤵
        
        PID:804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35398.exe
        6⤵
        
        PID:3712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15231.exe
        6⤵
        
        PID:4076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41266.exe
        6⤵
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38850.exe
        6⤵
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33555.exe
        6⤵
        
        PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33065.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3899.exe
        6⤵
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37898.exe
        6⤵
        
        PID:3452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34761.exe
        6⤵
        
        PID:3952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64938.exe
        6⤵
        
        PID:3792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9741.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
        6⤵
        
        PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60506.exe
        5⤵
        
        PID:2172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32298.exe
        5⤵
        
        PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16155.exe
        5⤵
        
        PID:4032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35272.exe
        5⤵
        
        PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48942.exe
        5⤵
        
        PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49472.exe
        5⤵
        
        PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21623.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22569.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48384.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33906.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3899.exe
        8⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37898.exe
        8⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39932.exe
        8⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19947.exe
        8⤵
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24233.exe
        8⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6601.exe
        8⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49571.exe
        7⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51634.exe
        7⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40627.exe
        7⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7072.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58743.exe
        7⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6601.exe
        7⤵
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14040.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63306.exe
        6⤵
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57499.exe
        6⤵
        
        PID:3380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15625.exe
        6⤵
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39737.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        6⤵
        
        PID:4688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50607.exe
        6⤵
        
        PID:5128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44087.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48440.exe
        6⤵
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45361.exe
        6⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62691.exe
        6⤵
        
        PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55942.exe
        5⤵
        
        PID:700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16211.exe
        5⤵
        
        PID:1816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48578.exe
        5⤵
        
        PID:3164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56803.exe
        5⤵
        
        PID:2512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54277.exe
        5⤵
        
        PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
        5⤵
        
        PID:5244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19126.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23730.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49571.exe
        5⤵
        
        PID:2760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51634.exe
        5⤵
        
        PID:3460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24291.exe
        5⤵
        
        PID:2996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56273.exe
        5⤵
        
        PID:3312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58743.exe
        5⤵
        
        PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6601.exe
        5⤵
        
        PID:4684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49998.exe
      4⤵
      PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57993.exe
        5⤵
        
        PID:1460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62148.exe
        5⤵
        
        PID:2696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51378.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18186.exe
        5⤵
        
        PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24138.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21784.exe
        5⤵
        
        PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22169.exe
        5⤵
        
        PID:5344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53142.exe
      4⤵
      PID:1800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60104.exe
        5⤵
        
        PID:3232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4690.exe
        5⤵
        
        PID:4044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59073.exe
        5⤵
        
        PID:3772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18406.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6071.exe
        5⤵
        
        PID:5148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56548.exe
      4⤵
      PID:2948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49108.exe
      4⤵
      PID:3148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21577.exe
      4⤵
      PID:1948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63340.exe
      4⤵
      PID:4768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32520.exe
      4⤵
      PID:4488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57356.exe
      4⤵
      PID:5896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25992.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25992.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38531.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40283.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53210.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11887.exe
        7⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15928.exe
        7⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60477.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41193.exe
        7⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46481.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58743.exe
        7⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6601.exe
        7⤵
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47204.exe
        6⤵
        
        PID:1412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29663.exe
        6⤵
        
        PID:1904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51542.exe
        6⤵
        
        PID:3836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38888.exe
        6⤵
        
        PID:3884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9471.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6177.exe
        6⤵
        
        PID:5084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33555.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28165.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63072.exe
        5⤵
        
        PID:2896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16211.exe
        5⤵
        
        PID:2688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48578.exe
        5⤵
        
        PID:3172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8253.exe
        5⤵
        
        PID:1672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
        5⤵
        
        PID:4856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50183.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3441.exe
        5⤵
        
        PID:5660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36369.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58571.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3644.exe
        6⤵
        
        PID:2704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15928.exe
        6⤵
        
        PID:2924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13070.exe
        6⤵
        
        PID:4008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3247.exe
        6⤵
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7603.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6177.exe
        6⤵
        
        PID:4120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-639.exe
        6⤵
        
        PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16451.exe
        5⤵
        
        PID:2712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16211.exe
        5⤵
        
        PID:552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48578.exe
        5⤵
        
        PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7602.exe
        5⤵
        
        PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54277.exe
        5⤵
        
        PID:4656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
        5⤵
        
        PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27775.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18407.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48434.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41120.exe
        5⤵
        
        PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59891.exe
        5⤵
        
        PID:6008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3634.exe
      4⤵
      PID:1552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48834.exe
      4⤵
      PID:3388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15426.exe
      4⤵
      PID:3956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5037.exe
      4⤵
      PID:4128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22373.exe
      4⤵
      PID:4400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49472.exe
      4⤵
      PID:4532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49614.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49614.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41051.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38602.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62072.exe
        6⤵
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62148.exe
        6⤵
        
        PID:2572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51378.exe
        6⤵
        
        PID:3128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33454.exe
        6⤵
        
        PID:3676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24138.exe
        6⤵
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21784.exe
        6⤵
        
        PID:4724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38890.exe
        6⤵
        
        PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60079.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10346.exe
        5⤵
        
        PID:1708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57243.exe
        5⤵
        
        PID:3132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9521.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7603.exe
        5⤵
        
        PID:4872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38850.exe
        5⤵
        
        PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33555.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-693.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1951.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60673.exe
        5⤵
        
        PID:4284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30015.exe
      4⤵
      PID:3008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16211.exe
      4⤵
      PID:1728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48578.exe
      4⤵
      PID:3176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8253.exe
      4⤵
      PID:3968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
      4⤵
      PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17319.exe
      4⤵
      PID:4748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14236.exe
      4⤵
      PID:6116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40786.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40786.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36426.exe
      4⤵
      PID:2536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22215.exe
      4⤵
      PID:1076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40454.exe
      4⤵
      PID:3972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47553.exe
      4⤵
      PID:3584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26006.exe
      4⤵
      PID:4384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54649.exe
      4⤵
      PID:5068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38890.exe
      4⤵
      PID:6000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63393.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63393.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26281.exe
      4⤵
      PID:2024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62148.exe
      4⤵
      PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51378.exe
      4⤵
      PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51243.exe
      4⤵
      PID:3484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24138.exe
      4⤵
      PID:4776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22700.exe
      4⤵
      PID:4468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38890.exe
      4⤵
      PID:5976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32911.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32911.exe
    3⤵
    PID:300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8076.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8076.exe
    3⤵
    PID:2164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27577.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27577.exe
    3⤵
    PID:3272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16242.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16242.exe
    3⤵
    PID:1416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2003.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2003.exe
    3⤵
    PID:4880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4784.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4784.exe
    3⤵
    PID:4512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2768.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2768.exe
    3⤵
    PID:5360
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62723.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62723.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29522.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29522.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21728.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24022.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44990.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53636.exe
        7⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3899.exe
        8⤵
        
        PID:2808
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 216
        8⤵
        Program crash
        
        PID:3288
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 236
        7⤵
        Program crash
        
        PID:3064
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 236
        6⤵
        Program crash
        
        PID:2848
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 236
        5⤵
        Program crash
        
        PID:1680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36444.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33906.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2388
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 216
        5⤵
        Program crash
        
        PID:2504
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 240
      4⤵
      Program crash
      PID:2496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18665.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18665.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32970.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64687.exe
        5⤵
        
        PID:2636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60526.exe
        5⤵
        
        PID:1176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45677.exe
        5⤵
        
        PID:3812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47553.exe
        5⤵
        
        PID:3800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59997.exe
        5⤵
        
        PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54649.exe
        5⤵
        
        PID:5060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5833.exe
        5⤵
        
        PID:5480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65272.exe
      4⤵
      PID:644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35529.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32103.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15992.exe
      4⤵
      PID:3832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47011.exe
      4⤵
      PID:3504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54277.exe
      4⤵
      PID:4544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34920.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34920.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38732.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50079.exe
        5⤵
        
        PID:2220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17197.exe
        5⤵
        
        PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1985.exe
        5⤵
        
        PID:1312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42833.exe
        5⤵
        
        PID:4220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38850.exe
        5⤵
        
        PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33555.exe
        5⤵
        
        PID:6044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3426.exe
      4⤵
      PID:2124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10346.exe
      4⤵
      PID:2668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57243.exe
      4⤵
      PID:3088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39737.exe
      4⤵
      PID:3284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
      4⤵
      PID:4664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50607.exe
      4⤵
      PID:5036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9084.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9084.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64687.exe
      4⤵
      PID:2236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2280.exe
      4⤵
      PID:1020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29532.exe
      4⤵
      PID:3704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40617.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24968.exe
      4⤵
      PID:4108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38888.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6601.exe
      4⤵
      PID:5012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38269.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38269.exe
    3⤵
    PID:1576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28125.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28125.exe
    3⤵
    PID:2488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43407.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43407.exe
    3⤵
    PID:3824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17887.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17887.exe
    3⤵
    PID:3796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48295.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48295.exe
    3⤵
    PID:4408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49048.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49048.exe
    3⤵
    PID:4528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37305.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37305.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5388
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56064.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56064.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55744.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55744.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6759.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2830.exe
        5⤵
        
        PID:2624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37898.exe
        5⤵
        
        PID:3420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39932.exe
        5⤵
        
        PID:2884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62625.exe
        5⤵
        
        PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58743.exe
        5⤵
        
        PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6601.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1209.exe
      4⤵
      PID:1040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16211.exe
      4⤵
      PID:2340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48578.exe
      4⤵
      PID:3248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57838.exe
      4⤵
      PID:3652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
      4⤵
      PID:4816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50183.exe
      4⤵
      PID:1364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11221.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55503.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55503.exe
    3⤵
    - Executes dropped EXE
    PID:1724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53146.exe
      4⤵
      PID:1744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18616.exe
      4⤵
      PID:1084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30492.exe
      4⤵
      PID:3612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39932.exe
      4⤵
      PID:3856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62625.exe
      4⤵
      PID:3696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58743.exe
      4⤵
      PID:4640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6601.exe
      4⤵
      PID:5220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19597.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19597.exe
    3⤵
    PID:2960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35529.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35529.exe
    3⤵
    PID:1248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32103.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32103.exe
    3⤵
    PID:3588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14731.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14731.exe
    3⤵
    PID:3924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36622.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36622.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20147.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20147.exe
    3⤵
    PID:5052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
    3⤵
    PID:5168
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28666.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28666.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9831.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9831.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63952.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4407.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10611.exe
        5⤵
        
        PID:2560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62453.exe
        5⤵
        
        PID:3524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59957.exe
        5⤵
        
        PID:3076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7603.exe
        5⤵
        
        PID:4948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38850.exe
        5⤵
        
        PID:4764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33555.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6033.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16518.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45338.exe
        5⤵
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12541.exe
        5⤵
        
        PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14736.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24878.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41666.exe
      4⤵
      PID:3112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32345.exe
      4⤵
      PID:3896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1128.exe
      4⤵
      PID:3244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
      4⤵
      PID:4756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17319.exe
      4⤵
      PID:4624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11221.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46116.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46116.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53684.exe
      4⤵
      PID:3516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9212.exe
      4⤵
      PID:4260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13968.exe
      4⤵
      PID:5488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27026.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27026.exe
    3⤵
    PID:2888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16211.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16211.exe
    3⤵
    PID:1488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48578.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48578.exe
    3⤵
    PID:3188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8253.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8253.exe
    3⤵
    PID:3912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
    3⤵
    PID:4848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50183.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50183.exe
    3⤵
    PID:5096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44504.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44504.exe
    3⤵
    PID:5428
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36069.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36069.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38732.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38732.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21511.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21511.exe
    3⤵
    PID:2400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51013.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40596.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40596.exe
    3⤵
    PID:1968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62536.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62536.exe
    3⤵
    PID:3368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59957.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59957.exe
    3⤵
    PID:3784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7603.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7603.exe
    3⤵
    PID:4924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6177.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6177.exe
    3⤵
    PID:5116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49839.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49839.exe
    3⤵
    PID:5452
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51725.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51725.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9474.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9474.exe
    3⤵
    PID:2184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62072.exe
      4⤵
      PID:752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3899.exe
        5⤵
        
        PID:776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37898.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18425.exe
        5⤵
        
        PID:4040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64938.exe
        5⤵
        
        PID:3892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9741.exe
        5⤵
        
        PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
        5⤵
        
        PID:5188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49571.exe
      4⤵
      PID:2132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51634.exe
      4⤵
      PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31266.exe
      4⤵
      PID:3980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26414.exe
      4⤵
      PID:3268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49239.exe
      4⤵
      PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50607.exe
      4⤵
      PID:4180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61148.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61148.exe
    3⤵
    PID:944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10346.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10346.exe
    3⤵
    PID:1656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57243.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57243.exe
    3⤵
    PID:3220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27668.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27668.exe
    3⤵
    PID:3936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7603.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7603.exe
    3⤵
    PID:4956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6177.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6177.exe
    3⤵
    PID:4104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33555.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33555.exe
    3⤵
    PID:5984
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42525.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42525.exe
  2⤵
  PID:1604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34624.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34624.exe
    3⤵
    PID:4728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60673.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60673.exe
    3⤵
    PID:5032
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57751.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57751.exe
  2⤵
  PID:560
- C:\Users\Admin\AppData\Local\Temp\Unicorn-397.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-397.exe
  2⤵
  PID:3720
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9816.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9816.exe
  2⤵
  PID:4056
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8153.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8153.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1168
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46174.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46174.exe
  2⤵
  PID:4336
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18937.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18937.exe
  2⤵
  PID:4480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1128.exe

Filesize
468KB

MD5
ecedddf267c480ecd81f83cfed18df0a

SHA1
78ed70a98e47dad1d53f38012948f786714ec46d

SHA256
5e4e37bc5817f615645cd2df2eaddd82e686bceb5261b0fc74dce56ba5257a84

SHA512
a0869ddddee0dae9272621af895aef0e5d14823e97a9d4772cdb039cb7fd9c60ac7793bd119eb25e06544630715784f6edfa2e211792f7f740bd63c2e3fab569

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18186.exe

Filesize
468KB

MD5
f68b412e1b8cc13fe68396f0a3592689

SHA1
7f9f96724a5b018d38830e9ff2052adefdd0db71

SHA256
08fabcf72e8cb4b4d33488fabd9e629c430b64debbbb5bc548574a2f51840e4f

SHA512
bed95db9a04a26b38aee5e1b299d42b802cc59ec25be360efbcbde424a91d63356e5d438e09aa6ac3c3935adad2b245218fdc701a86e5906ad5f21b47632b5ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18665.exe

Filesize
468KB

MD5
f42298b994d7627e63e17080a3b3b6a7

SHA1
939927fe3c05c62e488d6c75dce7c4df40430618

SHA256
eb4014164dfb67fa2b06a58d66592293cfeb898e4b9be75954de390382e56443

SHA512
799dc7094f5ab17e543b8882ed28bf629389f3452eb5173721fda9395664fdb906742cc5b145eb508944808058192fbad30439cf4d10e8184911bcce67fd7864

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21623.exe

Filesize
468KB

MD5
e268a2d82023f9c9cab85cab620cffac

SHA1
d636333b269757585a1fc2a2a4ef72786370b994

SHA256
15b227a079ae4aa9341c6c45916a7cbb71f81452ea87b065bdd74e9249ebc31b

SHA512
38f43db51344e9941739348e04a7ad3d9296bd6d931ad1047b46d80e2c64dc95c57a65cdda4152746b3be961e74f32589c6c902ff2fb2290f358b1b4f802576f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21728.exe

Filesize
468KB

MD5
6c23e117db42d126e150d73288faba13

SHA1
eaa457586fd5dc9836606d9cfc3c508bd06e8e7f

SHA256
0c533f8a4c57c2edb9277ee940dca1ddbe94c159cefa497dfd22d7b6f6236e5d

SHA512
3095117839b6a89fda76579be01212f7c977e7a0146629b4c529167ec64a5f77b9cfc6c5a4fc4a54c875b4b38d0cb923ff59dd61e90f7b5f80cb33c6a6e98768

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24022.exe

Filesize
468KB

MD5
b3ef98282d0909a617643a728776c8fd

SHA1
22431abfc4ab14811aff53f4f8b5c1658923186e

SHA256
18e551efd1c1f6d70d26762ef7876b3bad8073432cb13fba6c34b2f3732ea241

SHA512
55fe1ecdb538a8873eedc24ac0af97cd38c62c5f96944cb781e4b9a6f65d9226d343c47b5fba1a087872a9f9521efc442e7ac389579c23085581626f379a7b8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25992.exe

Filesize
468KB

MD5
15856434c7fa115dc1b11d38bb72bfdf

SHA1
f202741acf0c687b47a5b5367b1cb17fd0531b0b

SHA256
6fa442da969fb0edf4f6188e912bc2ad843ac477b333c6ae908cfa825d7cd404

SHA512
8e3414b2bb8d2397010b0912c4e354da7a538699c77e660c47aa70ac08f98a96ec73ee33f106b38d94c5d8fe2146fac3131ddac131274677e8ee68812afb8963

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28666.exe

Filesize
468KB

MD5
95fe3643d8e8aa9fc21e66e381c6f777

SHA1
a409553671393433dbb7235b24f1fca006b68fcb

SHA256
2cd6b7ba7f9e643ae784d31f743f57bba19a4f1565d548c9b83d004635e66b92

SHA512
bc9d1a16c1ca2e0fa794e52add3f0fb4134bb9284a4b32a76e81f0114247aeb3f7fda331e13fbdfcee8e3462605e16c186d469dcfaec209e706273531ddebe30

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29522.exe

Filesize
468KB

MD5
f24ca00acee4565d08bfb69a837aed86

SHA1
b3255eff8d5c4c68ca91946ad4e9a2ad2e229eec

SHA256
d37ade0d67e20f074dec5586afd0b159d412fe006e0488ee84abcba3a1f028ad

SHA512
893d127c7ec64bbf8c68eb5a8373c8bf88dfd1c330d637566c61a0044582bc2a5f1a0c04d02d9eb3f994eb294fd2f51ff7de505e1a7f411b50e9cfafef68b0f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49614.exe

Filesize
468KB

MD5
8b18ee3c6051720698908b2cc6fbc7e2

SHA1
07008efa45f2232c24b8d62381a09ce20041daa3

SHA256
7fd20714c1391818eae48d47bff829908e0cf3dd50dadd9af8a4e604c2a9ca30

SHA512
d18bd66825e356ae5b0972a3288d9e5c658d6ec64f487dd1324f33b567602ae222c882abf281fc3c19eb38841ce97f2842a67e344d38c64f8bf4327ac054a2d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50223.exe

Filesize
468KB

MD5
6880e9154888c808885615f99aa6c254

SHA1
b5d111abf880e456cbb075f15ff969bddb00093f

SHA256
682fc7b3d56159d5e1c1df1f81ebdfb7304d4872a0aa3302659ee90414efd8ab

SHA512
0c242d346d4f37a9483ca55f6534326a673a2ddd8dc7b73aba28afa112b1819741d09f821c801d1646a672a90cd51ee2d3daf7e5f2d026ab22c0b9d9a601fde0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56064.exe

Filesize
468KB

MD5
8e3928d0215df4369c4721fc3e7ec4cc

SHA1
0eb158b7da562958e557a48f264db3c5a46d95de

SHA256
8552bbb04f25b5d0569c76ee3cde46c22d95d73459d05a7566ff8fefe98559b5

SHA512
55dcb97cca2db2c21d8318f0f867bfe67ec034b0a2721f251689f0e939fac2bd82ac3dd057571746c8f1b18efd18d6bc64896605846a532289441c6d18ec75ef

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38531.exe

Filesize
468KB

MD5
6ad5f649d4b945685a7aed771e9c0d21

SHA1
19a88324c7378ee008834d91ba07cb03754e602e

SHA256
4b4648285dbf4aa5a8b3fbf2bc9ad304adbd2ab01bc567ac4da7a7736b07b12b

SHA512
b7b3f6c92dfe49133cec9eb0a85a283081413abe62c86a626ee357e75837d1aa2902c9aaaadcbdf0c3e95e66e1172160b47eb91b6fc3636198600e2c4a792e4b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49724.exe

Filesize
468KB

MD5
0834dc174cbdeab3e10c584ccb6645de

SHA1
b0bdb3141264ca790c5be9692bd93dd6d1da1248

SHA256
e3c49ea692a880c5759e96119beca2f130dd05f2a0e01e0dc1c856d4a62beb3c

SHA512
2e0da11196d5c2ab21e545c06fb7cd3bba0b9fdac116bbc5cfe8154cb94d5ffbd7401f13f556af221b8511d33b0bcd41985489ec5d1ee24ff68d28b71ddca42a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-5116.exe

Filesize
468KB

MD5
e98f0ca4305033082d8e3272138b05ce

SHA1
2dd554dce9a193bf8a781099929f4e2c2c0308ed

SHA256
aa792d59285920b7f1dc31a8d47c7182fe508f92f1e534201890e02c529c773f

SHA512
56606f51a2309a1ba3d0cd76adcc25b4372a655c634b3f9be9e9151801bebcee0f8c301086fe6f588d50d4f56cdebdb7a99e04dbaafd0632173c63ba941137c8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55744.exe

Filesize
468KB

MD5
2e95ed390fc73aa1f99216f48aa06d66

SHA1
014645691e22bcd811381a7d69ea15c55445170b

SHA256
d3c8b8da23dd60d91f893304d87bcaa3e4a6d3d6a400c634a554ee3b2ea7e6f0

SHA512
156ba5050b73742712fc698780d60b95236a79b7355773045d9b8673ea71ef07e1035b15481a4c0956c590959fd11a000b4b64875499d7e6a6a46652ab478971

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57259.exe

Filesize
468KB

MD5
25c9985bb25b6bccf8555bbae9dc0f88

SHA1
13c8c98f56fc35312898cc966af987f47ab85e2e

SHA256
f30601a02f7316c9639242f15e1368f7aaed3ae44487b52a3927ea789f436e11

SHA512
576eababae9ec2f0cbc58dcabf6ea066eccbdd9b40511420b3e479e1b5b1e1a745808c18e563b644dadf49b386d655a9f308fd2378fe1954af9086d680d6a54c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62723.exe

Filesize
468KB

MD5
b37db1f7a86977735bbeeaf0d2917e23

SHA1
d0dd53f9a4db4f6a7ee325503739ade2609bbdda

SHA256
f29d3319f4ae2b17dc99afd9645b084f15d937f5b5404eac8473ac3084c349ad

SHA512
4a9d594bb613f524698c73f05081e01e6895dc88eca69f01a1795b812dd2088792d1515c623239eacc48ccaaf92363b5de08943e95d712eca39b6654b426fb45

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8125.exe

Filesize
468KB

MD5
bb98d1d01eaccc193bb63820906cda99

SHA1
7d0ce573bf9ceb846257825bb1e4f9ee94da53c0

SHA256
3c06f3605f0de8651760ccc4b6a1f281a5003dbc45d3ba1a3c599397438d2f1e

SHA512
3cf25ba9709bc03adfc7c0f59bebfdcae1fcaa87506932ca9767c7b5d3fcf37b14a98721789e92d2f6ee8a908615cacaab6c1ef846a42f25f135bed7ee6897ff

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9885.exe

Filesize
468KB

MD5
8901732ce0b7850e83275e1fbad83e0e

SHA1
16710747892f3be5d793465b91d06fcbc8ad6f01

SHA256
1925f3dc699e3e6db2562b863fef83a660670176c0ddee74134f1c6d81c232d2

SHA512
d9e98d86683b3c534becb47732cb1c85fe254db31a9ec5c611f43b213ffd66264b181ea798734689527cfb73778b1f16caef8dc724dda3147875d08e273e21ae

Download Submit
memory/108-293-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/108-148-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/108-292-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/572-266-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/572-163-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/572-278-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/628-417-0x00000000023E0000-0x0000000002455000-memory.dmp

Filesize
468KB

Download
memory/628-256-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/628-418-0x00000000023E0000-0x0000000002455000-memory.dmp

Filesize
468KB

Download
memory/948-260-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/960-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1060-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1120-376-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/1120-146-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1120-377-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/1380-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1380-229-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1448-282-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1572-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1624-410-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1724-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1764-230-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1764-409-0x0000000001FD0000-0x0000000002045000-memory.dmp

Filesize
468KB

Download
memory/1764-407-0x0000000001FD0000-0x0000000002045000-memory.dmp

Filesize
468KB

Download
memory/1984-275-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2052-246-0x0000000002520000-0x0000000002595000-memory.dmp

Filesize
468KB

Download
memory/2052-233-0x0000000002520000-0x0000000002595000-memory.dmp

Filesize
468KB

Download
memory/2052-113-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2068-297-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2100-419-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2152-393-0x0000000002970000-0x00000000029E5000-memory.dmp

Filesize
468KB

Download
memory/2152-397-0x0000000002970000-0x00000000029E5000-memory.dmp

Filesize
468KB

Download
memory/2152-184-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2244-366-0x0000000002100000-0x0000000002175000-memory.dmp

Filesize
468KB

Download
memory/2244-367-0x0000000002100000-0x0000000002175000-memory.dmp

Filesize
468KB

Download
memory/2256-325-0x0000000002840000-0x00000000028B5000-memory.dmp

Filesize
468KB

Download
memory/2256-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2256-6-0x0000000003370000-0x00000000033E5000-memory.dmp

Filesize
468KB

Download
memory/2256-170-0x0000000002840000-0x00000000028B5000-memory.dmp

Filesize
468KB

Download
memory/2256-164-0x0000000002840000-0x00000000028B5000-memory.dmp

Filesize
468KB

Download
memory/2256-321-0x0000000002840000-0x00000000028B5000-memory.dmp

Filesize
468KB

Download
memory/2344-279-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2352-342-0x00000000033B0000-0x0000000003425000-memory.dmp

Filesize
468KB

Download
memory/2352-201-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2352-343-0x00000000033B0000-0x0000000003425000-memory.dmp

Filesize
468KB

Download
memory/2448-171-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2448-318-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2448-315-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2492-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2532-296-0x0000000000360000-0x00000000003D5000-memory.dmp

Filesize
468KB

Download
memory/2532-147-0x0000000000360000-0x00000000003D5000-memory.dmp

Filesize
468KB

Download
memory/2532-295-0x0000000000360000-0x00000000003D5000-memory.dmp

Filesize
468KB

Download
memory/2532-142-0x0000000000360000-0x00000000003D5000-memory.dmp

Filesize
468KB

Download
memory/2532-82-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2580-368-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2596-316-0x00000000028E0000-0x0000000002955000-memory.dmp

Filesize
468KB

Download
memory/2596-306-0x0000000003410000-0x0000000003485000-memory.dmp

Filesize
468KB

Download
memory/2596-182-0x00000000028E0000-0x0000000002955000-memory.dmp

Filesize
468KB

Download
memory/2596-160-0x00000000028E0000-0x0000000002955000-memory.dmp

Filesize
468KB

Download
memory/2596-81-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2612-384-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2628-398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2640-355-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2648-326-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2652-238-0x00000000029A0000-0x0000000002A15000-memory.dmp

Filesize
468KB

Download
memory/2652-239-0x00000000029A0000-0x0000000002A15000-memory.dmp

Filesize
468KB

Download
memory/2652-71-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2656-344-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2720-162-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2720-31-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2720-12-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2720-161-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2720-261-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2720-276-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2768-242-0x0000000002580000-0x00000000025F5000-memory.dmp

Filesize
468KB

Download
memory/2768-32-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2768-48-0x0000000002580000-0x00000000025F5000-memory.dmp

Filesize
468KB

Download
memory/2768-49-0x0000000002580000-0x00000000025F5000-memory.dmp

Filesize
468KB

Download
memory/2768-258-0x0000000002580000-0x00000000025F5000-memory.dmp

Filesize
468KB

Download
memory/2788-267-0x00000000024B0000-0x0000000002525000-memory.dmp

Filesize
468KB

Download
memory/2788-144-0x00000000024B0000-0x0000000002525000-memory.dmp

Filesize
468KB

Download
memory/2788-143-0x00000000024B0000-0x0000000002525000-memory.dmp

Filesize
468KB

Download
memory/2788-36-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2788-259-0x00000000024B0000-0x0000000002525000-memory.dmp

Filesize
468KB

Download
memory/2832-101-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2832-354-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2832-200-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2832-202-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2832-352-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2836-208-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2836-50-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2836-214-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2836-387-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2836-382-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2836-96-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2836-95-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download