4f6437604e1573dc07ff1696e6efaf9acbe26ee5fbb6b4929a8b430f80685354

Analysis

max time kernel
148s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 21:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f6437604e1573dc07ff1696e6efaf9acbe26ee5fbb6b4929a8b430f80685354.exe
Size

468KB
MD5

25ef7830ee067f2cf7578f5f58177187
SHA1

c7beeeb849e91510a37f3d3e7defe4b82d046296
SHA256

4f6437604e1573dc07ff1696e6efaf9acbe26ee5fbb6b4929a8b430f80685354
SHA512

0527a1e89acc4853a8bcec3f25e6b9ada32794869ab68ce5cf7b3d729d9b09ba077c00914ef3808e93fa1ec18c01a6677aee02c20d2b1e4b36bed5874712ff9a
SSDEEP

3072:WeMFo7Lgjy8nNbYkPz5jtfLeYqjWRp9nmHeoVWOoGyFSGkNYKl6:WemooLnN3P1jtf7XLCoGuRkNY

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2648	Unicorn-11579.exe
2784	Unicorn-25861.exe
2888	Unicorn-14163.exe
2644	Unicorn-64537.exe
2612	Unicorn-43925.exe
2552	Unicorn-2984.exe
2120	Unicorn-54786.exe
1244	Unicorn-38362.exe
1504	Unicorn-6244.exe
2852	Unicorn-37905.exe
2944	Unicorn-38170.exe
2216	Unicorn-53115.exe
2104	Unicorn-15804.exe
2000	Unicorn-25817.exe
1796	Unicorn-20489.exe
2376	Unicorn-11574.exe
2012	Unicorn-63489.exe
1924	Unicorn-19748.exe
872	Unicorn-57359.exe
1476	Unicorn-24979.exe
2284	Unicorn-28962.exe
1332	Unicorn-35093.exe
1612	Unicorn-20703.exe
2204	Unicorn-837.exe
1716	Unicorn-23203.exe
2160	Unicorn-8258.exe
1784	Unicorn-56089.exe
1960	Unicorn-36223.exe
1576	Unicorn-55824.exe
2900	Unicorn-13795.exe
2816	Unicorn-42860.exe
2728	Unicorn-14755.exe
2628	Unicorn-46421.exe
2208	Unicorn-64724.exe
1428	Unicorn-58310.exe
2436	Unicorn-49380.exe
2200	Unicorn-54894.exe
2624	Unicorn-31367.exe
2616	Unicorn-17531.exe
2108	Unicorn-64039.exe
1756	Unicorn-33313.exe
1100	Unicorn-54718.exe
1544	Unicorn-2394.exe
3012	Unicorn-60074.exe
964	Unicorn-60339.exe
892	Unicorn-64786.exe
1812	Unicorn-49933.exe
1460	Unicorn-33505.exe
1952	Unicorn-14215.exe
1480	Unicorn-21637.exe
2364	Unicorn-11641.exe
2988	Unicorn-20075.exe
2952	Unicorn-6431.exe
2640	Unicorn-48663.exe
2764	Unicorn-8298.exe
2696	Unicorn-12290.exe
2564	Unicorn-43017.exe
2720	Unicorn-26681.exe
2632	Unicorn-1752.exe
2540	Unicorn-34910.exe
2980	Unicorn-54776.exe
2380	Unicorn-11697.exe
2308	Unicorn-58668.exe
944	Unicorn-3992.exe

Loads dropped DLL 64 IoCs

pid	Process
3020	4f6437604e1573dc07ff1696e6efaf9acbe26ee5fbb6b4929a8b430f80685354.exe
3020	4f6437604e1573dc07ff1696e6efaf9acbe26ee5fbb6b4929a8b430f80685354.exe
2648	Unicorn-11579.exe
2648	Unicorn-11579.exe
3020	4f6437604e1573dc07ff1696e6efaf9acbe26ee5fbb6b4929a8b430f80685354.exe
3020	4f6437604e1573dc07ff1696e6efaf9acbe26ee5fbb6b4929a8b430f80685354.exe
2784	Unicorn-25861.exe
2784	Unicorn-25861.exe
2888	Unicorn-14163.exe
3020	4f6437604e1573dc07ff1696e6efaf9acbe26ee5fbb6b4929a8b430f80685354.exe
2888	Unicorn-14163.exe
3020	4f6437604e1573dc07ff1696e6efaf9acbe26ee5fbb6b4929a8b430f80685354.exe
2648	Unicorn-11579.exe
2648	Unicorn-11579.exe
2612	Unicorn-43925.exe
2612	Unicorn-43925.exe
2888	Unicorn-14163.exe
2888	Unicorn-14163.exe
2120	Unicorn-54786.exe
2120	Unicorn-54786.exe
3020	4f6437604e1573dc07ff1696e6efaf9acbe26ee5fbb6b4929a8b430f80685354.exe
3020	4f6437604e1573dc07ff1696e6efaf9acbe26ee5fbb6b4929a8b430f80685354.exe
2552	Unicorn-2984.exe
2784	Unicorn-25861.exe
2784	Unicorn-25861.exe
2552	Unicorn-2984.exe
2648	Unicorn-11579.exe
2648	Unicorn-11579.exe
2644	Unicorn-64537.exe
2644	Unicorn-64537.exe
1504	Unicorn-6244.exe
1504	Unicorn-6244.exe
2852	Unicorn-37905.exe
2852	Unicorn-37905.exe
3020	4f6437604e1573dc07ff1696e6efaf9acbe26ee5fbb6b4929a8b430f80685354.exe
2888	Unicorn-14163.exe
3020	4f6437604e1573dc07ff1696e6efaf9acbe26ee5fbb6b4929a8b430f80685354.exe
2888	Unicorn-14163.exe
2216	Unicorn-53115.exe
2216	Unicorn-53115.exe
2944	Unicorn-38170.exe
2784	Unicorn-25861.exe
2944	Unicorn-38170.exe
2784	Unicorn-25861.exe
2120	Unicorn-54786.exe
1244	Unicorn-38362.exe
1244	Unicorn-38362.exe
2120	Unicorn-54786.exe
2612	Unicorn-43925.exe
2612	Unicorn-43925.exe
2000	Unicorn-25817.exe
2000	Unicorn-25817.exe
2104	Unicorn-15804.exe
2104	Unicorn-15804.exe
2552	Unicorn-2984.exe
2552	Unicorn-2984.exe
2648	Unicorn-11579.exe
2648	Unicorn-11579.exe
1796	Unicorn-20489.exe
1796	Unicorn-20489.exe
2644	Unicorn-64537.exe
2644	Unicorn-64537.exe
1476	Unicorn-24979.exe
1476	Unicorn-24979.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25449.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19387.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24516.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57315.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51919.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17313.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16027.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54011.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34244.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50360.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28869.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54490.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31505.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14248.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14257.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44342.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60074.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50604.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9773.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12290.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61408.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11574.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6150.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3992.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32130.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48491.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3565.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43925.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25091.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10899.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48106.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11697.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52663.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1404.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43566.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57156.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62038.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53826.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38387.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38190.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1431.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61408.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28510.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60115.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47087.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28979.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31505.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6244.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30738.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30738.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17955.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3020	4f6437604e1573dc07ff1696e6efaf9acbe26ee5fbb6b4929a8b430f80685354.exe
2648	Unicorn-11579.exe
2784	Unicorn-25861.exe
2888	Unicorn-14163.exe
2552	Unicorn-2984.exe
2612	Unicorn-43925.exe
2120	Unicorn-54786.exe
2644	Unicorn-64537.exe
1244	Unicorn-38362.exe
1504	Unicorn-6244.exe
2852	Unicorn-37905.exe
2216	Unicorn-53115.exe
2944	Unicorn-38170.exe
2104	Unicorn-15804.exe
2000	Unicorn-25817.exe
1796	Unicorn-20489.exe
2376	Unicorn-11574.exe
2012	Unicorn-63489.exe
872	Unicorn-57359.exe
1476	Unicorn-24979.exe
1924	Unicorn-19748.exe
2284	Unicorn-28962.exe
1612	Unicorn-20703.exe
1716	Unicorn-23203.exe
1784	Unicorn-56089.exe
1576	Unicorn-55824.exe
2160	Unicorn-8258.exe
1960	Unicorn-36223.exe
2900	Unicorn-13795.exe
2204	Unicorn-837.exe
1332	Unicorn-35093.exe
2816	Unicorn-42860.exe
2728	Unicorn-14755.exe
2628	Unicorn-46421.exe
2208	Unicorn-64724.exe
1428	Unicorn-58310.exe
2624	Unicorn-31367.exe
2200	Unicorn-54894.exe
2436	Unicorn-49380.exe
2108	Unicorn-64039.exe
1100	Unicorn-54718.exe
1756	Unicorn-33313.exe
2616	Unicorn-17531.exe
1544	Unicorn-2394.exe
964	Unicorn-60339.exe
3012	Unicorn-60074.exe
892	Unicorn-64786.exe
1812	Unicorn-49933.exe
1460	Unicorn-33505.exe
1480	Unicorn-21637.exe
1952	Unicorn-14215.exe
2952	Unicorn-6431.exe
2988	Unicorn-20075.exe
2640	Unicorn-48663.exe
2364	Unicorn-11641.exe
2764	Unicorn-8298.exe
2696	Unicorn-12290.exe
2540	Unicorn-34910.exe
2720	Unicorn-26681.exe
2564	Unicorn-43017.exe
2632	Unicorn-1752.exe
2980	Unicorn-54776.exe
2380	Unicorn-11697.exe
944	Unicorn-3992.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2648	3020	4f6437604e1573dc07ff1696e6efaf9acbe26ee5fbb6b4929a8b430f80685354.exe	30
PID 3020 wrote to memory of 2648	3020	4f6437604e1573dc07ff1696e6efaf9acbe26ee5fbb6b4929a8b430f80685354.exe	30
PID 3020 wrote to memory of 2648	3020	4f6437604e1573dc07ff1696e6efaf9acbe26ee5fbb6b4929a8b430f80685354.exe	30
PID 3020 wrote to memory of 2648	3020	4f6437604e1573dc07ff1696e6efaf9acbe26ee5fbb6b4929a8b430f80685354.exe	30
PID 2648 wrote to memory of 2784	2648	Unicorn-11579.exe	31
PID 2648 wrote to memory of 2784	2648	Unicorn-11579.exe	31
PID 2648 wrote to memory of 2784	2648	Unicorn-11579.exe	31
PID 2648 wrote to memory of 2784	2648	Unicorn-11579.exe	31
PID 3020 wrote to memory of 2888	3020	4f6437604e1573dc07ff1696e6efaf9acbe26ee5fbb6b4929a8b430f80685354.exe	32
PID 3020 wrote to memory of 2888	3020	4f6437604e1573dc07ff1696e6efaf9acbe26ee5fbb6b4929a8b430f80685354.exe	32
PID 3020 wrote to memory of 2888	3020	4f6437604e1573dc07ff1696e6efaf9acbe26ee5fbb6b4929a8b430f80685354.exe	32
PID 3020 wrote to memory of 2888	3020	4f6437604e1573dc07ff1696e6efaf9acbe26ee5fbb6b4929a8b430f80685354.exe	32
PID 2784 wrote to memory of 2644	2784	Unicorn-25861.exe	33
PID 2784 wrote to memory of 2644	2784	Unicorn-25861.exe	33
PID 2784 wrote to memory of 2644	2784	Unicorn-25861.exe	33
PID 2784 wrote to memory of 2644	2784	Unicorn-25861.exe	33
PID 2888 wrote to memory of 2612	2888	Unicorn-14163.exe	34
PID 2888 wrote to memory of 2612	2888	Unicorn-14163.exe	34
PID 2888 wrote to memory of 2612	2888	Unicorn-14163.exe	34
PID 2888 wrote to memory of 2612	2888	Unicorn-14163.exe	34
PID 3020 wrote to memory of 2552	3020	4f6437604e1573dc07ff1696e6efaf9acbe26ee5fbb6b4929a8b430f80685354.exe	35
PID 3020 wrote to memory of 2552	3020	4f6437604e1573dc07ff1696e6efaf9acbe26ee5fbb6b4929a8b430f80685354.exe	35
PID 3020 wrote to memory of 2552	3020	4f6437604e1573dc07ff1696e6efaf9acbe26ee5fbb6b4929a8b430f80685354.exe	35
PID 3020 wrote to memory of 2552	3020	4f6437604e1573dc07ff1696e6efaf9acbe26ee5fbb6b4929a8b430f80685354.exe	35
PID 2648 wrote to memory of 2120	2648	Unicorn-11579.exe	36
PID 2648 wrote to memory of 2120	2648	Unicorn-11579.exe	36
PID 2648 wrote to memory of 2120	2648	Unicorn-11579.exe	36
PID 2648 wrote to memory of 2120	2648	Unicorn-11579.exe	36
PID 2612 wrote to memory of 1244	2612	Unicorn-43925.exe	37
PID 2612 wrote to memory of 1244	2612	Unicorn-43925.exe	37
PID 2612 wrote to memory of 1244	2612	Unicorn-43925.exe	37
PID 2612 wrote to memory of 1244	2612	Unicorn-43925.exe	37
PID 2888 wrote to memory of 1504	2888	Unicorn-14163.exe	38
PID 2888 wrote to memory of 1504	2888	Unicorn-14163.exe	38
PID 2888 wrote to memory of 1504	2888	Unicorn-14163.exe	38
PID 2888 wrote to memory of 1504	2888	Unicorn-14163.exe	38
PID 2120 wrote to memory of 2944	2120	Unicorn-54786.exe	39
PID 2120 wrote to memory of 2944	2120	Unicorn-54786.exe	39
PID 2120 wrote to memory of 2944	2120	Unicorn-54786.exe	39
PID 2120 wrote to memory of 2944	2120	Unicorn-54786.exe	39
PID 3020 wrote to memory of 2852	3020	4f6437604e1573dc07ff1696e6efaf9acbe26ee5fbb6b4929a8b430f80685354.exe	40
PID 3020 wrote to memory of 2852	3020	4f6437604e1573dc07ff1696e6efaf9acbe26ee5fbb6b4929a8b430f80685354.exe	40
PID 3020 wrote to memory of 2852	3020	4f6437604e1573dc07ff1696e6efaf9acbe26ee5fbb6b4929a8b430f80685354.exe	40
PID 3020 wrote to memory of 2852	3020	4f6437604e1573dc07ff1696e6efaf9acbe26ee5fbb6b4929a8b430f80685354.exe	40
PID 2784 wrote to memory of 2216	2784	Unicorn-25861.exe	42
PID 2784 wrote to memory of 2216	2784	Unicorn-25861.exe	42
PID 2784 wrote to memory of 2216	2784	Unicorn-25861.exe	42
PID 2784 wrote to memory of 2216	2784	Unicorn-25861.exe	42
PID 2552 wrote to memory of 2104	2552	Unicorn-2984.exe	41
PID 2552 wrote to memory of 2104	2552	Unicorn-2984.exe	41
PID 2552 wrote to memory of 2104	2552	Unicorn-2984.exe	41
PID 2552 wrote to memory of 2104	2552	Unicorn-2984.exe	41
PID 2648 wrote to memory of 2000	2648	Unicorn-11579.exe	43
PID 2648 wrote to memory of 2000	2648	Unicorn-11579.exe	43
PID 2648 wrote to memory of 2000	2648	Unicorn-11579.exe	43
PID 2648 wrote to memory of 2000	2648	Unicorn-11579.exe	43
PID 2644 wrote to memory of 1796	2644	Unicorn-64537.exe	44
PID 2644 wrote to memory of 1796	2644	Unicorn-64537.exe	44
PID 2644 wrote to memory of 1796	2644	Unicorn-64537.exe	44
PID 2644 wrote to memory of 1796	2644	Unicorn-64537.exe	44
PID 1504 wrote to memory of 2376	1504	Unicorn-6244.exe	45
PID 1504 wrote to memory of 2376	1504	Unicorn-6244.exe	45
PID 1504 wrote to memory of 2376	1504	Unicorn-6244.exe	45
PID 1504 wrote to memory of 2376	1504	Unicorn-6244.exe	45

C:\Users\Admin\AppData\Local\Temp\4f6437604e1573dc07ff1696e6efaf9acbe26ee5fbb6b4929a8b430f80685354.exe
"C:\Users\Admin\AppData\Local\Temp\4f6437604e1573dc07ff1696e6efaf9acbe26ee5fbb6b4929a8b430f80685354.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11579.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11579.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25861.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25861.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64537.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20489.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13795.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33505.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4361.exe
        8⤵
        
        PID:968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41895.exe
        8⤵
        
        PID:280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4671.exe
        8⤵
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4856.exe
        8⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17313.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16027.exe
        8⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60162.exe
        8⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46141.exe
        7⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52663.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5658.exe
        7⤵
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19923.exe
        8⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17021.exe
        8⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64855.exe
        7⤵
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38680.exe
        7⤵
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38118.exe
        7⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41574.exe
        7⤵
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14215.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44474.exe
        6⤵
        
        PID:2352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46826.exe
        6⤵
        
        PID:1764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2551.exe
        6⤵
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43942.exe
        6⤵
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10899.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8134.exe
        6⤵
        
        PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42860.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4361.exe
        6⤵
        
        PID:2344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42087.exe
        6⤵
        
        PID:904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43566.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43972.exe
        6⤵
        
        PID:3372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58340.exe
        6⤵
        
        PID:3140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28644.exe
        6⤵
        
        PID:4328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39971.exe
        6⤵
        
        PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4096.exe
        5⤵
        
        PID:2248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1108.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12170.exe
        5⤵
        
        PID:2708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1026.exe
        5⤵
        
        PID:3396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32855.exe
        5⤵
        
        PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38742.exe
        5⤵
        
        PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24956.exe
        5⤵
        
        PID:4784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53115.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24979.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14755.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4361.exe
        7⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38387.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12036.exe
        7⤵
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6451.exe
        7⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51556.exe
        7⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61408.exe
        7⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53826.exe
        7⤵
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45757.exe
        6⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
        7⤵
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28869.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34244.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31934.exe
        8⤵
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10230.exe
        7⤵
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56249.exe
        7⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54011.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2554.exe
        7⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44342.exe
        7⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48715.exe
        7⤵
        
        PID:4736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17940.exe
        6⤵
        
        PID:1832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39753.exe
        6⤵
        
        PID:820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57315.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51919.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17313.exe
        6⤵
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16027.exe
        6⤵
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60162.exe
        6⤵
        
        PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46421.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39172.exe
        6⤵
        
        PID:2452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53510.exe
        6⤵
        
        PID:2744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7961.exe
        6⤵
        
        PID:3288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7983.exe
        6⤵
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20405.exe
        6⤵
        
        PID:3808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37388.exe
        6⤵
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48715.exe
        6⤵
        
        PID:580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23887.exe
        5⤵
        
        PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50360.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41918.exe
        5⤵
        
        PID:3388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48319.exe
        5⤵
        
        PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20935.exe
        5⤵
        
        PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32923.exe
        5⤵
        
        PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21849.exe
        5⤵
        
        PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28962.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21637.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30738.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6150.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17792.exe
        6⤵
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15025.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51986.exe
        6⤵
        
        PID:4088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25449.exe
        6⤵
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37027.exe
        6⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4426.exe
        6⤵
        
        PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10967.exe
        5⤵
        
        PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2917.exe
        5⤵
        
        PID:3700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8507.exe
        5⤵
        
        PID:4140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61803.exe
        5⤵
        
        PID:5244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11641.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58010.exe
      4⤵
      PID:900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55450.exe
      4⤵
      PID:1692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46252.exe
      4⤵
      PID:3088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27225.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17090.exe
      4⤵
      PID:4988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14892.exe
      4⤵
      PID:4816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36627.exe
      4⤵
      PID:6048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54786.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54786.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38170.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35093.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12290.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55710.exe
        6⤵
        
        PID:956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14977.exe
        6⤵
        
        PID:2668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43972.exe
        6⤵
        
        PID:3356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58340.exe
        6⤵
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17744.exe
        6⤵
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9094.exe
        6⤵
        
        PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33425.exe
        5⤵
        
        PID:2328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53126.exe
        6⤵
        
        PID:1980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45783.exe
        6⤵
        
        PID:1724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3296.exe
        6⤵
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56891.exe
        6⤵
        
        PID:1348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16783.exe
        6⤵
        
        PID:4948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20492.exe
        6⤵
        
        PID:4828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21491.exe
        6⤵
        
        PID:6092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9773.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28705.exe
        5⤵
        
        PID:2412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49497.exe
        5⤵
        
        PID:3484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38190.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34542.exe
        5⤵
        
        PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52691.exe
        5⤵
        
        PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-837.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60339.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50604.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28979.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60308.exe
        6⤵
        
        PID:3272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58340.exe
        6⤵
        
        PID:760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1431.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61408.exe
        6⤵
        
        PID:4864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27184.exe
        6⤵
        
        PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12.exe
        5⤵
        
        PID:1080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42715.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
        5⤵
        
        PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25667.exe
        5⤵
        
        PID:3816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28644.exe
        5⤵
        
        PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19166.exe
        5⤵
        
        PID:4528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49933.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55786.exe
        5⤵
        
        PID:3432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49403.exe
        5⤵
        
        PID:4776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14036.exe
        5⤵
        
        PID:5204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50339.exe
      4⤵
      PID:1684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1404.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51553.exe
      4⤵
      PID:3988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61008.exe
      4⤵
      PID:1704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24179.exe
      4⤵
      PID:4156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21273.exe
      4⤵
      PID:5012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25817.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25817.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8258.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31367.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58668.exe
        6⤵
        Executes dropped EXE
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55710.exe
        6⤵
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31505.exe
        6⤵
        
        PID:2304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9161.exe
        6⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48226.exe
        6⤵
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-248.exe
        6⤵
        
        PID:4980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37558.exe
        6⤵
        
        PID:4780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65498.exe
        6⤵
        
        PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3992.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3908.exe
        5⤵
        
        PID:916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37371.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
        5⤵
        
        PID:3520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31690.exe
        5⤵
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17313.exe
        5⤵
        
        PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16027.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60162.exe
        5⤵
        
        PID:5992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17531.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53370.exe
        5⤵
        
        PID:1776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37221.exe
        6⤵
        
        PID:3212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57156.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63678.exe
        6⤵
        
        PID:4852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3565.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55072.exe
        5⤵
        
        PID:1360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe
        5⤵
        
        PID:3040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15767.exe
        5⤵
        
        PID:3736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58340.exe
        5⤵
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28644.exe
        5⤵
        
        PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18180.exe
        5⤵
        
        PID:5412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16788.exe
      4⤵
      PID:2800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40874.exe
        5⤵
        
        PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17770.exe
        5⤵
        
        PID:664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38107.exe
        5⤵
        
        PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1468.exe
        5⤵
        
        PID:3792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10369.exe
        5⤵
        
        PID:4200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31073.exe
        5⤵
        
        PID:5104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9773.exe
      4⤵
      PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28705.exe
      4⤵
      PID:1548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18771.exe
      4⤵
      PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48756.exe
      4⤵
      PID:3280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14257.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43556.exe
      4⤵
      PID:4708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64363.exe
      4⤵
      PID:6000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55824.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55824.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64724.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20122.exe
        5⤵
        
        PID:3336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53920.exe
        5⤵
        
        PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58016.exe
        5⤵
        
        PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15526.exe
        5⤵
        
        PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9290.exe
        5⤵
        
        PID:4996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42907.exe
      4⤵
      PID:2424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46716.exe
      4⤵
      PID:1660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-443.exe
      4⤵
      PID:3740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44334.exe
      4⤵
      PID:3312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20476.exe
      4⤵
      PID:4228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9244.exe
      4⤵
      PID:4644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49380.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49380.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6063.exe
      4⤵
      PID:1620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17770.exe
      4⤵
      PID:1672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38107.exe
      4⤵
      PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1468.exe
      4⤵
      PID:3444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45180.exe
      4⤵
      PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26003.exe
      4⤵
      PID:5276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25138.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25138.exe
    3⤵
    PID:2416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30236.exe
      4⤵
      PID:3092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48146.exe
      4⤵
      PID:2388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19387.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60878.exe
      4⤵
      PID:4960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58292.exe
      4⤵
      PID:4740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40445.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40445.exe
    3⤵
    PID:548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47087.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47087.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64869.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64869.exe
    3⤵
    PID:3728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14876.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14876.exe
    3⤵
    PID:4132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63274.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63274.exe
    3⤵
    PID:3172
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14163.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14163.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43925.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43925.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38362.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20703.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4361.exe
        6⤵
        
        PID:2056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23997.exe
        6⤵
        
        PID:920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25091.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45346.exe
        6⤵
        
        PID:2172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16745.exe
        6⤵
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61408.exe
        6⤵
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53826.exe
        6⤵
        
        PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19306.exe
        5⤵
        
        PID:336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55823.exe
        5⤵
        
        PID:2840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14620.exe
        5⤵
        
        PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28810.exe
        5⤵
        
        PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11252.exe
        5⤵
        
        PID:4488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39877.exe
        5⤵
        
        PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48491.exe
        5⤵
        
        PID:4360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23203.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48663.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16924.exe
        5⤵
        
        PID:2932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31505.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43972.exe
        5⤵
        
        PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58340.exe
        5⤵
        
        PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28644.exe
        5⤵
        
        PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34641.exe
        5⤵
        
        PID:5700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8298.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9773.exe
      4⤵
      PID:2780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45994.exe
      4⤵
      PID:3320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65385.exe
      4⤵
      PID:3976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30131.exe
      4⤵
      PID:3876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
      4⤵
      PID:4640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
      4⤵
      PID:4524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6244.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6244.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11574.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20075.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24516.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17460.exe
        6⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51035.exe
        7⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30082.exe
        7⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47980.exe
        7⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48106.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46380.exe
        6⤵
        
        PID:3768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5717.exe
        6⤵
        
        PID:3108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25449.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37027.exe
        6⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4426.exe
        6⤵
        
        PID:6028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20348.exe
        5⤵
        
        PID:2132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
        5⤵
        
        PID:4048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50248.exe
        5⤵
        
        PID:4044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61408.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53826.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6431.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23822.exe
        5⤵
        
        PID:3160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15025.exe
        5⤵
        
        PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21259.exe
        5⤵
        
        PID:3880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53845.exe
        5⤵
        
        PID:4192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47142.exe
        5⤵
        
        PID:3120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16269.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31258.exe
      4⤵
      PID:2936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41822.exe
        5⤵
        
        PID:5912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51835.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41804.exe
      4⤵
      PID:1596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37542.exe
      4⤵
      PID:4124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63173.exe
      4⤵
      PID:4508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57359.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57359.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64039.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47338.exe
        5⤵
        
        PID:4768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28510.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39117.exe
        5⤵
        
        PID:5364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30738.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42715.exe
      4⤵
      PID:2732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52517.exe
        5⤵
        
        PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49943.exe
        5⤵
        
        PID:4848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50985.exe
        5⤵
        
        PID:4704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
      4⤵
      PID:3968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60478.exe
      4⤵
      PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17744.exe
      4⤵
      PID:4388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9094.exe
      4⤵
      PID:5332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60074.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60074.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25356.exe
      4⤵
      PID:4808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28510.exe
      4⤵
      PID:4440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39117.exe
      4⤵
      PID:5352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41674.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41674.exe
    3⤵
    PID:1668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54490.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54490.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
    3⤵
    PID:3996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39477.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39477.exe
    3⤵
    PID:3828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49570.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49570.exe
    3⤵
    PID:4232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62038.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62038.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4460
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2984.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2984.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15804.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15804.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56089.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28518.exe
        5⤵
        
        PID:884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55710.exe
        5⤵
        
        PID:2576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31505.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43972.exe
        5⤵
        
        PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58340.exe
        5⤵
        
        PID:3196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28644.exe
        5⤵
        
        PID:4164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48139.exe
        5⤵
        
        PID:1456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50033.exe
      4⤵
      PID:2176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3908.exe
      4⤵
      PID:2828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37371.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35306.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35306.exe
      4⤵
      PID:3464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59721.exe
      4⤵
      PID:3884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39877.exe
      4⤵
      PID:3868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48491.exe
      4⤵
      PID:4424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36223.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36223.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58310.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34185.exe
        5⤵
        
        PID:912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53593.exe
        5⤵
        
        PID:1316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60115.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11582.exe
        5⤵
        
        PID:3128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12699.exe
        5⤵
        
        PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32552.exe
        5⤵
        
        PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8097.exe
      4⤵
      PID:360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34463.exe
      4⤵
      PID:732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
      4⤵
      PID:4016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45871.exe
      4⤵
      PID:4624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39877.exe
      4⤵
      PID:5068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48491.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54894.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54894.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60007.exe
      4⤵
      PID:3004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1434.exe
      4⤵
      PID:1780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38107.exe
      4⤵
      PID:3448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1468.exe
      4⤵
      PID:3264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15268.exe
      4⤵
      PID:4292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64898.exe
      4⤵
      PID:5292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50339.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50339.exe
    3⤵
    PID:2296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35830.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35830.exe
    3⤵
    PID:1696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51553.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51553.exe
    3⤵
    PID:4056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45782.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45782.exe
    3⤵
    PID:3852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34542.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34542.exe
    3⤵
    PID:5044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5770.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5770.exe
    3⤵
    PID:5692
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37905.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37905.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63489.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63489.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2394.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26681.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32130.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28979.exe
        6⤵
        
        PID:1464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5351.exe
        6⤵
        
        PID:4036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1246.exe
        6⤵
        
        PID:3872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44342.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9820.exe
        6⤵
        
        PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47075.exe
        5⤵
        
        PID:1736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9248.exe
        5⤵
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24500.exe
        6⤵
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6331.exe
        6⤵
        
        PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33282.exe
        5⤵
        
        PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58340.exe
        5⤵
        
        PID:3168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59371.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9244.exe
        5⤵
        
        PID:4660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34910.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3908.exe
      4⤵
      PID:2592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20842.exe
      4⤵
      PID:1536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13753.exe
      4⤵
      PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16011.exe
      4⤵
      PID:4248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17189.exe
      4⤵
      PID:4692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64786.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64786.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54776.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26396.exe
        5⤵
        
        PID:1268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5351.exe
        5⤵
        
        PID:3932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3606.exe
        5⤵
        
        PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45180.exe
        5⤵
        
        PID:4320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22905.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55710.exe
      4⤵
      PID:1136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31505.exe
      4⤵
      PID:1852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43972.exe
      4⤵
      PID:3404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42655.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61408.exe
      4⤵
      PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53826.exe
      4⤵
      PID:4868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11697.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11697.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9773.exe
    3⤵
    PID:2760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15098.exe
      4⤵
      PID:3840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1110.exe
      4⤵
      PID:1284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32411.exe
      4⤵
      PID:4792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17955.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28705.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28705.exe
    3⤵
    PID:3052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18771.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18771.exe
    3⤵
    PID:3564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58870.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58870.exe
    3⤵
    PID:3908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54905.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54905.exe
    3⤵
    PID:4208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37609.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37609.exe
    3⤵
    PID:4544
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19748.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19748.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33313.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33313.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12423.exe
      4⤵
      PID:2872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18484.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40871.exe
      4⤵
      PID:1248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30738.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30738.exe
    3⤵
    PID:264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42715.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42715.exe
    3⤵
    PID:2336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
    3⤵
    PID:4004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50248.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50248.exe
    3⤵
    PID:3948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61408.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61408.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53826.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53826.exe
    3⤵
    PID:4100
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54718.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54718.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43017.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43017.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55710.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55710.exe
    3⤵
    PID:3056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8755.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8755.exe
    3⤵
    PID:2440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43972.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43972.exe
    3⤵
    PID:3328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48226.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48226.exe
    3⤵
    PID:2528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61701.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61701.exe
    3⤵
    PID:5036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49618.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49618.exe
    3⤵
    PID:4112
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1752.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1752.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2632
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45644.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45644.exe
  2⤵
  PID:816
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2370.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2370.exe
  2⤵
  PID:1584
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43897.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43897.exe
  2⤵
  PID:3512
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63891.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63891.exe
  2⤵
  PID:3176
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14248.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14248.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4900
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17220.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17220.exe
  2⤵
  PID:4724
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58762.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58762.exe
  2⤵
  PID:6084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-15804.exe

Filesize
468KB

MD5
fef8e51c75092d564c671913ab67fa97

SHA1
9bbbfcccc0ea632d91234de8716a024e23d8863a

SHA256
ba0dbce4d6e54f2fa5ed27438dbe8de1fc9f2f8d76e6dbdaaefb574794aa8163

SHA512
894e0a5aeec03cd4f541279d998772b37eafd3f85a1c27bb39b3fcb0927d89fe94f724263a647f5cd63345afd1470656905465bfb84cd4128bee64c230baa2f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25817.exe

Filesize
468KB

MD5
194bcbe52e0089f5a5e0cde17e485863

SHA1
c3e169898153dfb803d2f384934af555bd837fe3

SHA256
db6475fe2ff491b7c54943599fffebf650d61aa0c1e8005412f11bfeaad23fb3

SHA512
bc5a104470305e890e29dea32fbfe323495707b9b9cddb471f3b3210936cd91bdd3cbc6d61358e7be5c5bd80015a4124cdcf40d7bb6913294823cbf9cf237699

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26003.exe

Filesize
468KB

MD5
7757fc74f9548fd838c2c1ce872d9c71

SHA1
2fd0a6177369484f66c4bfeeed99349ffb84b86e

SHA256
1c71aae13bd05fec7e6c9cd2889e0eb169bc610f85941bf3ed9295cc7770562f

SHA512
000e48d67d024638af2508bbd08f35a6c799230f91d6bba071c969a97b3905984e087f9977f683031b2f46def71a1e778e39e536c4c5f7b956d54129913bbf94

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40871.exe

Filesize
468KB

MD5
c510af4d75b8839cd1477409013082cc

SHA1
2ecab7810882994e8fd68bd9abe92a1c3247ad9b

SHA256
ff2a14ae6acb52fa30162cd78f9dc5d101d3b2d90446aab7a5c973fc7bbac083

SHA512
aafc8b289203962a0de866b2b6a400f3a85019eac758ecff0f282a15c36aefd85d58fd2f7d42bb2e9753aeb3a7489a599dcbba0746872628e80260c58a66b402

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53115.exe

Filesize
468KB

MD5
5911308d12f5c8f6aca6b9f3e0e0e26f

SHA1
829a7274aa42d95d24144ed1589ba5f0ddd1c8d5

SHA256
3cba21b3c82377c097ddc07342800ada97ced76fbd6af5bafab420732f032312

SHA512
18643b651a5a82629451ffea3d4965305122ac85934d2f4cb9b6bec83fdea42e86860603e627471e6ad1d79ad61dfe91eb6bdafd18ef3511ce94b40c0e8abbc3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-11574.exe

Filesize
468KB

MD5
0bb04c4a8d41ad594f88f63e7987d529

SHA1
73621f3ca40dfabdcbb64f1cfce666c87ab9e6f5

SHA256
d9fa6efe4f17f8b6eaf7b897f5ffe23196a803559ace20eafea8d4c109f62c5e

SHA512
f96c2857e955fc3c970b1920ab62e4a4584ad18f8e8ec878faf3763061fff5dc832e1d006151cd67d22bdc364fc4006a1573a5ab728058b42156abb73e6ce505

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-11579.exe

Filesize
468KB

MD5
ba51f004d7d481119f6be2f6df6a8df5

SHA1
800001b9113ff548e633226fd7ce4326fbcf041e

SHA256
5d1d03483ae702f859567dbe51149466048c58e5d9a61b1699c3cf6775d4db6d

SHA512
3adcfb4869ee52f59fd1bb7ed86e6213537556bd59a3e97f84f6b6c26521ae2bbc7ad54d1e039e1ad55d4cfac3142ee1ad4394acb708a91085bf3d624222af8b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14163.exe

Filesize
468KB

MD5
1c135e80104c20789c3655e9731d2a99

SHA1
0525d8557f6702aeb146d0b8e4bd20acd008ea26

SHA256
4d07bc903a0ab5775262a5abcd94e2bc7d3ca35033e340e6700f9f8ca8a2aa22

SHA512
27b1d5e77d04958d1a49a8e758137d64c3221a7a7a26a60dc8602962a773aa43019de156374b84f3f13af0ca1d21728a03fa9ebca1803e131e7d42c287900585

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19748.exe

Filesize
468KB

MD5
30fc68f7947df4e65ddc4858c140ecfe

SHA1
68143712351cf051418414765933329e573fab3c

SHA256
5a628f89dee1352d1b7b7ef9db39d32f7544fa9bcfad394aabedcd63ccc3a00c

SHA512
30d06cf6103f07104f2dcd314ab2a620ab87ae6c94956f8b0eba7a96e40890405edcc1106bea84d742146da20791324f4d41129c2d8ae19518db93488ade785a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20489.exe

Filesize
468KB

MD5
97fd258ae025660813bf317afbf1dce1

SHA1
86188cbbc9c2b768795bf1b50ee7d135f31c9919

SHA256
47594b23dcd908bb5a8ee970d55e0300a7822b58e45c5a426d1ed810e6ebb635

SHA512
5ab12714ae8c29348a36e45cd59807e0c7e7f5f3d16dee33bc902c551f2e6b808a8835bf0f9f46f7110b98fd806213038ce65213f547c664e57eff917de52ef1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25861.exe

Filesize
468KB

MD5
80148aa4455a5baadf2ca2aaa3471a65

SHA1
c0fe37cdfabc2af930821c97d62cf6c28da4d0a6

SHA256
63aad6e42b303de10360d3a4805aee911b4db3c09548e1e1098f5a55abc54b8c

SHA512
edb3303ff488083e496d9d6841bf8fe283152ebbf48c9a6d065c9cb0b0e0335a95863b8738490da4bfd9641aae9191b1f14749e614465d5836d8e37c66281ee9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-2984.exe

Filesize
468KB

MD5
dc19a0bf6eee9bfef25c77a783d84cc6

SHA1
2553e4c3f4db0666d23f51a3007622924b2a2c56

SHA256
9bcba90e6bd965433a79d570b56f9d85e73acde64993acd9bb561bf3a831d146

SHA512
b9b1a01c819e0a463183b2c420203bbb19ae25e9a6f321661f6792cda2a13bab3db0b44528e37939b1717ccd110b17d5c6ce1f45f8b41e73151b190c7b6588ed

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37905.exe

Filesize
468KB

MD5
065ed94c8b61d516a8a9a567191d0661

SHA1
bd6eaa5ba7d9860820e669afe2bed6eaa0560647

SHA256
a9ab6d71b715532a3c5362b89c131512120f2b798bce76ec769b68f43b93690a

SHA512
68d818739586dc83ef70e5bd47793715170fa49c77cec33131a82266e1a2fa4feef769d5e949c10596c4a91e22ec993f5d996d2039f6cf9efe9ff5395a491e14

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38170.exe

Filesize
468KB

MD5
56e4eb3d8800569df37f1f2b36e2982b

SHA1
f5ac1faef7096f60e7b86c61f5cd52f79fbaabe9

SHA256
7c72a26573f29fb9f2a7e731deabaef3e9b9b210602f63d6e06597bad71ad202

SHA512
0da5cc4d9dcdf6c7b4aa16c877f7a7d7f3facf9f7bf5fce7d1a6914167d1c0dbb8ce45c6f6d281fc8899a4860bc3bc4fa57189ef12f9a766a8168defaadbaa24

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38362.exe

Filesize
468KB

MD5
0aa2c89dbca59751622fb6b3f4750ac5

SHA1
905b51d4b8b617e218ff789d4a5feefe620ca5d8

SHA256
01c1de64ee030e7afb2d358718986d54fe864a4b4b95a82c2cc93b009d33fdc0

SHA512
ec62b7afe56e4957beeeb065bc43a969f091374f5aca91e4972d4f8c57aeb1fe1dd2eadd1eed592e60769cadb1d43998a736e7a66509d57151abf065200de7e1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43925.exe

Filesize
468KB

MD5
6286d9ba717c98027113376721b316f1

SHA1
7f6e60c58b45a90a575f1641871da2986533cf52

SHA256
bb2888fad49425d7b0b734b4a027e67bd903bdcd2fd940bef369977f4e4552d8

SHA512
41e8e549904b2a7583abdc75a85ea60ef6ea9140d78f7df0147072d26a8fe5e27f8eaf3990e5c9a093ea92f287e35458bdb740ff83eddef986eaf202a78566e9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54786.exe

Filesize
468KB

MD5
e868e8bbebf4663902847730c5520595

SHA1
b9eacf4c96f820ad2ee1209652af307f2d86fc47

SHA256
021015fbafb3dd6648a72ace779a231048b714f3fb76e007432c00685ea70201

SHA512
63cc96545aae5af72220de53dd3e88acec085b439c26fba4ed7bb4e4279bf152d8372c96b29372d5dba342f845d33d4cd11bce7d4ee9938e0e61990e2a5fafc9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57359.exe

Filesize
468KB

MD5
d9a626aa6af52d566a3c7b093505d66e

SHA1
9fb8b3ea008f2a3723c78f5c7400e75f6cc1e0e9

SHA256
15cd316cc4d296e01296b820fbdd2d4509c542df9d48feee3068d87dbedc1319

SHA512
6d374955b343dc02e5d529f9229d69a5ff4aff283346d50fb424b5affd10a4b9c4d7d74ce328bcf5431eec97cf2251039e4b59e041d53567f89970ded523364f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-6244.exe

Filesize
468KB

MD5
7abe836f67695a997c186627ab5c17cd

SHA1
1ed66736ccd0fb5ca8e5585974b2f911442e7d0f

SHA256
f53c12d56db76d933c6af660b8d71c701162d9824eac4b13b1c3d1ba37375e40

SHA512
9e8b747614502b827a4745b3b02339248eabeb4b28919cbe55c0c2540c5ee7082175a7569243c5fad21009a3528fb0bff2fa23b604c4bf52054bc6d90440f3d8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63489.exe

Filesize
468KB

MD5
5464a98449db8feeeb45a89b6b1ea377

SHA1
e1b2ea25ecaed8290e1d4378bd545e2128cd5f2f

SHA256
3b2ee9a5a369cdccfc03f2e6cef39c6065519631e6d9f30d0ff8b855624799a8

SHA512
562dda8b94e2b7abeb256d4c4959003e74cfae7a314dadf428dfa77866253074682e3f30d8af650a414aa9a10b19fec967953b0eff576c0d223a7d24cbd44258

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64537.exe

Filesize
468KB

MD5
d8d81b4ab7c99bb136bd685d1366edda

SHA1
2a737adccd546ff60154475bbdc116df3f8fbe43

SHA256
933c862c9e5cb95158f667a90e07dfa1f293b7f8f945a025c968002b873fffa1

SHA512
6e18d552ff6774449e2c6cad6593f6a48ebbe7a5384d09ebaf824c2005034101dc1764e984f8669a58c5f3200341775304ce27aacb43f378e751b83c00be6c5b

Download Submit
memory/872-235-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1244-98-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1244-281-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1332-268-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1428-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1476-367-0x00000000028B0000-0x0000000002925000-memory.dmp

Filesize
468KB

Download
memory/1476-247-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1504-109-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1504-202-0x0000000001E80000-0x0000000001EF5000-memory.dmp

Filesize
468KB

Download
memory/1504-201-0x0000000001E80000-0x0000000001EF5000-memory.dmp

Filesize
468KB

Download
memory/1576-322-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1576-387-0x0000000002760000-0x00000000027D5000-memory.dmp

Filesize
468KB

Download
memory/1576-386-0x0000000002760000-0x00000000027D5000-memory.dmp

Filesize
468KB

Download
memory/1612-283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1716-291-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1784-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1796-190-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1796-344-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/1924-233-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1960-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1960-407-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2000-300-0x0000000000640000-0x00000000006B5000-memory.dmp

Filesize
468KB

Download
memory/2000-173-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2000-298-0x0000000000640000-0x00000000006B5000-memory.dmp

Filesize
468KB

Download
memory/2012-223-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2104-171-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2104-305-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2104-306-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2120-126-0x00000000024B0000-0x0000000002525000-memory.dmp

Filesize
468KB

Download
memory/2120-81-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2120-280-0x00000000024B0000-0x0000000002525000-memory.dmp

Filesize
468KB

Download
memory/2120-282-0x00000000024B0000-0x0000000002525000-memory.dmp

Filesize
468KB

Download
memory/2160-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2204-284-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2208-389-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2216-156-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2216-245-0x00000000033C0000-0x0000000003435000-memory.dmp

Filesize
468KB

Download
memory/2216-376-0x0000000002890000-0x0000000002905000-memory.dmp

Filesize
468KB

Download
memory/2216-377-0x0000000002890000-0x0000000002905000-memory.dmp

Filesize
468KB

Download
memory/2216-246-0x00000000033C0000-0x0000000003435000-memory.dmp

Filesize
468KB

Download
memory/2284-267-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2376-204-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2436-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2552-139-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/2552-313-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/2552-316-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/2552-153-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/2552-71-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2612-70-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2612-96-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2612-290-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2628-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2644-187-0x00000000024A0000-0x0000000002515000-memory.dmp

Filesize
468KB

Download
memory/2644-356-0x00000000024A0000-0x0000000002515000-memory.dmp

Filesize
468KB

Download
memory/2644-50-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2644-357-0x00000000024A0000-0x0000000002515000-memory.dmp

Filesize
468KB

Download
memory/2644-188-0x00000000024A0000-0x0000000002515000-memory.dmp

Filesize
468KB

Download
memory/2648-388-0x0000000003580000-0x00000000035F5000-memory.dmp

Filesize
468KB

Download
memory/2648-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2648-406-0x0000000003380000-0x00000000033F5000-memory.dmp

Filesize
468KB

Download
memory/2648-19-0x0000000003580000-0x00000000035F5000-memory.dmp

Filesize
468KB

Download
memory/2648-397-0x0000000003380000-0x00000000033F5000-memory.dmp

Filesize
468KB

Download
memory/2648-323-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/2648-396-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/2648-167-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/2648-324-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/2648-166-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/2728-368-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2784-152-0x0000000000370000-0x00000000003E5000-memory.dmp

Filesize
468KB

Download
memory/2784-142-0x0000000000370000-0x00000000003E5000-memory.dmp

Filesize
468KB

Download
memory/2784-25-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2784-48-0x0000000000370000-0x00000000003E5000-memory.dmp

Filesize
468KB

Download
memory/2784-398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2784-266-0x0000000000370000-0x00000000003E5000-memory.dmp

Filesize
468KB

Download
memory/2816-358-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2852-136-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2852-220-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2852-222-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2888-106-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/2888-221-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/2888-69-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/2888-234-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/2888-37-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2900-345-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2944-265-0x0000000002220000-0x0000000002295000-memory.dmp

Filesize
468KB

Download
memory/2944-154-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2944-264-0x0000000002D50000-0x0000000002DC5000-memory.dmp

Filesize
468KB

Download
memory/3020-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3020-232-0x0000000002660000-0x00000000026D5000-memory.dmp

Filesize
468KB

Download
memory/3020-405-0x0000000002660000-0x00000000026D5000-memory.dmp

Filesize
468KB

Download
memory/3020-35-0x0000000002660000-0x00000000026D5000-memory.dmp

Filesize
468KB

Download
memory/3020-224-0x0000000002660000-0x00000000026D5000-memory.dmp

Filesize
468KB

Download
memory/3020-341-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3020-134-0x0000000002660000-0x00000000026D5000-memory.dmp

Filesize
468KB

Download
memory/3020-8-0x0000000002660000-0x00000000026D5000-memory.dmp

Filesize
468KB

Download
memory/3020-11-0x0000000002660000-0x00000000026D5000-memory.dmp

Filesize
468KB

Download