d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4c

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 00:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe
Size 468KB
Sample241005-a34plazdnd
SHA256 d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4c
MD5 a320de90b3b8f3e682a53e313c7c48b0
SHA1 d9a5d7692bd7ab648a00e0db57a13071104bf63d
SHA512 f86aaceef168715d287becdf6f511da394d8e50bebd76832389286f5dd2d158c7a668648c3283a99ed3205cbc72c976fda72fbc5346f98cc3ad98405c421783a
SSDEEP 3072:1GeHo5IKq05UDbYpH5cOcf8/LC2WP0p1nLHewVPPXPH+tSgsvzlA:1Guoe8UDuHSOcfjYIsXPe0gsv
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2184	Unicorn-15834.exe
3044	Unicorn-53050.exe
2428	Unicorn-38297.exe
2888	Unicorn-8840.exe
3056	Unicorn-44345.exe
2880	Unicorn-31185.exe
2892	Unicorn-51051.exe
1176	Unicorn-10403.exe
1476	Unicorn-29764.exe
776	Unicorn-49630.exe
2948	Unicorn-15322.exe
2984	Unicorn-21351.exe
2924	Unicorn-15220.exe
2036	Unicorn-46218.exe
2460	Unicorn-39888.exe
2192	Unicorn-53489.exe
2528	Unicorn-21523.exe
2088	Unicorn-7682.exe
484	Unicorn-58008.exe
1224	Unicorn-62550.exe
2208	Unicorn-40760.exe
1628	Unicorn-20894.exe
268	Unicorn-27525.exe
2188	Unicorn-3614.exe
1992	Unicorn-3349.exe
1528	Unicorn-27190.exe
2468	Unicorn-36121.exe
2476	Unicorn-60002.exe
1680	Unicorn-61775.exe
1488	Unicorn-4271.exe
1064	Unicorn-3882.exe
1924	Unicorn-3882.exe
1688	Unicorn-26249.exe
2124	Unicorn-17483.exe
1460	Unicorn-14581.exe
2032	Unicorn-9803.exe
2712	Unicorn-29669.exe
2860	Unicorn-23538.exe
2748	Unicorn-44697.exe
2976	Unicorn-59191.exe
2636	Unicorn-43685.exe
1128	Unicorn-43950.exe
2344	Unicorn-58258.exe
2580	Unicorn-1651.exe
840	Unicorn-36270.exe
1204	Unicorn-36270.exe
1480	Unicorn-42309.exe
1088	Unicorn-64152.exe
2916	Unicorn-17940.exe
2784	Unicorn-17940.exe
2816	Unicorn-37806.exe
1988	Unicorn-23414.exe
1664	Unicorn-48880.exe
2904	Unicorn-13296.exe
3020	Unicorn-53841.exe
2140	Unicorn-33533.exe
2060	Unicorn-5847.exe
988	Unicorn-39754.exe
2592	Unicorn-57508.exe
2244	Unicorn-12322.exe
320	Unicorn-17493.exe
1812	Unicorn-17493.exe
892	Unicorn-16781.exe
560	Unicorn-18893.exe

Loads dropped DLL 64 IoCs

pid	Process
3052	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe
3052	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe
2184	Unicorn-15834.exe
3052	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe
3052	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe
2184	Unicorn-15834.exe
3044	Unicorn-53050.exe
3044	Unicorn-53050.exe
3052	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe
3052	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe
2184	Unicorn-15834.exe
2184	Unicorn-15834.exe
2428	Unicorn-38297.exe
2428	Unicorn-38297.exe
2888	Unicorn-8840.exe
2888	Unicorn-8840.exe
3044	Unicorn-53050.exe
3056	Unicorn-44345.exe
3044	Unicorn-53050.exe
3056	Unicorn-44345.exe
3052	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe
3052	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe
2184	Unicorn-15834.exe
2880	Unicorn-31185.exe
2880	Unicorn-31185.exe
2184	Unicorn-15834.exe
2428	Unicorn-38297.exe
2428	Unicorn-38297.exe
1176	Unicorn-10403.exe
1176	Unicorn-10403.exe
2888	Unicorn-8840.exe
2888	Unicorn-8840.exe
1476	Unicorn-29764.exe
1476	Unicorn-29764.exe
2892	Unicorn-51051.exe
2892	Unicorn-51051.exe
3044	Unicorn-53050.exe
3044	Unicorn-53050.exe
2984	Unicorn-21351.exe
2984	Unicorn-21351.exe
2924	Unicorn-15220.exe
2924	Unicorn-15220.exe
2880	Unicorn-31185.exe
2880	Unicorn-31185.exe
2428	Unicorn-38297.exe
2428	Unicorn-38297.exe
2948	Unicorn-15322.exe
2184	Unicorn-15834.exe
2948	Unicorn-15322.exe
2184	Unicorn-15834.exe
3052	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe
3052	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe
776	Unicorn-49630.exe
776	Unicorn-49630.exe
3056	Unicorn-44345.exe
3056	Unicorn-44345.exe
2460	Unicorn-39888.exe
2460	Unicorn-39888.exe
1176	Unicorn-10403.exe
1176	Unicorn-10403.exe
2528	Unicorn-21523.exe
2192	Unicorn-53489.exe
2528	Unicorn-21523.exe
2088	Unicorn-7682.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40517.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35147.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61081.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41970.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2864.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56099.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43267.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33070.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26686.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50068.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16303.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14457.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32929.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37693.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2141.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43685.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42774.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7832.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51143.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39754.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3641.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39704.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21235.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21006.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27130.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10177.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51143.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29489.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8729.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40517.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40517.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56451.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52868.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12710.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6845.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55875.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14163.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30163.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53047.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41047.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48126.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34598.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8729.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3825.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31671.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57956.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7128.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7114.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43821.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63165.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33533.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36441.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8729.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18460.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3052	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe
2184	Unicorn-15834.exe
3044	Unicorn-53050.exe
2428	Unicorn-38297.exe
2888	Unicorn-8840.exe
3056	Unicorn-44345.exe
2880	Unicorn-31185.exe
2892	Unicorn-51051.exe
1176	Unicorn-10403.exe
1476	Unicorn-29764.exe
776	Unicorn-49630.exe
2984	Unicorn-21351.exe
2924	Unicorn-15220.exe
2036	Unicorn-46218.exe
2948	Unicorn-15322.exe
2460	Unicorn-39888.exe
2192	Unicorn-53489.exe
2528	Unicorn-21523.exe
2088	Unicorn-7682.exe
484	Unicorn-58008.exe
1224	Unicorn-62550.exe
2208	Unicorn-40760.exe
268	Unicorn-27525.exe
1628	Unicorn-20894.exe
2188	Unicorn-3614.exe
1528	Unicorn-27190.exe
1992	Unicorn-3349.exe
2468	Unicorn-36121.exe
2476	Unicorn-60002.exe
1680	Unicorn-61775.exe
1488	Unicorn-4271.exe
1924	Unicorn-3882.exe
1688	Unicorn-26249.exe
1064	Unicorn-3882.exe
2124	Unicorn-17483.exe
2860	Unicorn-23538.exe
1460	Unicorn-14581.exe
2712	Unicorn-29669.exe
2032	Unicorn-9803.exe
2748	Unicorn-44697.exe
2976	Unicorn-59191.exe
1128	Unicorn-43950.exe
2636	Unicorn-43685.exe
2344	Unicorn-58258.exe
2580	Unicorn-1651.exe
1204	Unicorn-36270.exe
840	Unicorn-36270.exe
1480	Unicorn-42309.exe
1088	Unicorn-64152.exe
2784	Unicorn-17940.exe
2816	Unicorn-37806.exe
2916	Unicorn-17940.exe
1664	Unicorn-48880.exe
1988	Unicorn-23414.exe
2904	Unicorn-13296.exe
3020	Unicorn-53841.exe
2140	Unicorn-33533.exe
2060	Unicorn-5847.exe
2592	Unicorn-57508.exe
988	Unicorn-39754.exe
2244	Unicorn-12322.exe
320	Unicorn-17493.exe
1812	Unicorn-17493.exe
892	Unicorn-16781.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2184	3052	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe	31
PID 3052 wrote to memory of 2184	3052	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe	31
PID 3052 wrote to memory of 2184	3052	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe	31
PID 3052 wrote to memory of 2184	3052	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe	31
PID 3052 wrote to memory of 3044	3052	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe	33
PID 3052 wrote to memory of 3044	3052	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe	33
PID 3052 wrote to memory of 3044	3052	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe	33
PID 3052 wrote to memory of 3044	3052	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe	33
PID 2184 wrote to memory of 2428	2184	Unicorn-15834.exe	32
PID 2184 wrote to memory of 2428	2184	Unicorn-15834.exe	32
PID 2184 wrote to memory of 2428	2184	Unicorn-15834.exe	32
PID 2184 wrote to memory of 2428	2184	Unicorn-15834.exe	32
PID 3044 wrote to memory of 2888	3044	Unicorn-53050.exe	34
PID 3044 wrote to memory of 2888	3044	Unicorn-53050.exe	34
PID 3044 wrote to memory of 2888	3044	Unicorn-53050.exe	34
PID 3044 wrote to memory of 2888	3044	Unicorn-53050.exe	34
PID 3052 wrote to memory of 3056	3052	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe	35
PID 3052 wrote to memory of 3056	3052	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe	35
PID 3052 wrote to memory of 3056	3052	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe	35
PID 3052 wrote to memory of 3056	3052	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe	35
PID 2184 wrote to memory of 2880	2184	Unicorn-15834.exe	36
PID 2184 wrote to memory of 2880	2184	Unicorn-15834.exe	36
PID 2184 wrote to memory of 2880	2184	Unicorn-15834.exe	36
PID 2184 wrote to memory of 2880	2184	Unicorn-15834.exe	36
PID 2428 wrote to memory of 2892	2428	Unicorn-38297.exe	37
PID 2428 wrote to memory of 2892	2428	Unicorn-38297.exe	37
PID 2428 wrote to memory of 2892	2428	Unicorn-38297.exe	37
PID 2428 wrote to memory of 2892	2428	Unicorn-38297.exe	37
PID 2888 wrote to memory of 1176	2888	Unicorn-8840.exe	38
PID 2888 wrote to memory of 1176	2888	Unicorn-8840.exe	38
PID 2888 wrote to memory of 1176	2888	Unicorn-8840.exe	38
PID 2888 wrote to memory of 1176	2888	Unicorn-8840.exe	38
PID 3044 wrote to memory of 1476	3044	Unicorn-53050.exe	39
PID 3044 wrote to memory of 1476	3044	Unicorn-53050.exe	39
PID 3044 wrote to memory of 1476	3044	Unicorn-53050.exe	39
PID 3044 wrote to memory of 1476	3044	Unicorn-53050.exe	39
PID 3056 wrote to memory of 776	3056	Unicorn-44345.exe	40
PID 3056 wrote to memory of 776	3056	Unicorn-44345.exe	40
PID 3056 wrote to memory of 776	3056	Unicorn-44345.exe	40
PID 3056 wrote to memory of 776	3056	Unicorn-44345.exe	40
PID 3052 wrote to memory of 2948	3052	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe	41
PID 3052 wrote to memory of 2948	3052	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe	41
PID 3052 wrote to memory of 2948	3052	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe	41
PID 3052 wrote to memory of 2948	3052	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe	41
PID 2880 wrote to memory of 2984	2880	Unicorn-31185.exe	43
PID 2880 wrote to memory of 2984	2880	Unicorn-31185.exe	43
PID 2880 wrote to memory of 2984	2880	Unicorn-31185.exe	43
PID 2880 wrote to memory of 2984	2880	Unicorn-31185.exe	43
PID 2184 wrote to memory of 2924	2184	Unicorn-15834.exe	42
PID 2184 wrote to memory of 2924	2184	Unicorn-15834.exe	42
PID 2184 wrote to memory of 2924	2184	Unicorn-15834.exe	42
PID 2184 wrote to memory of 2924	2184	Unicorn-15834.exe	42
PID 2428 wrote to memory of 2036	2428	Unicorn-38297.exe	44
PID 2428 wrote to memory of 2036	2428	Unicorn-38297.exe	44
PID 2428 wrote to memory of 2036	2428	Unicorn-38297.exe	44
PID 2428 wrote to memory of 2036	2428	Unicorn-38297.exe	44
PID 1176 wrote to memory of 2460	1176	Unicorn-10403.exe	45
PID 1176 wrote to memory of 2460	1176	Unicorn-10403.exe	45
PID 1176 wrote to memory of 2460	1176	Unicorn-10403.exe	45
PID 1176 wrote to memory of 2460	1176	Unicorn-10403.exe	45
PID 2888 wrote to memory of 2192	2888	Unicorn-8840.exe	46
PID 2888 wrote to memory of 2192	2888	Unicorn-8840.exe	46
PID 2888 wrote to memory of 2192	2888	Unicorn-8840.exe	46
PID 2888 wrote to memory of 2192	2888	Unicorn-8840.exe	46

C:\Users\Admin\AppData\Local\Temp\d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe
"C:\Users\Admin\AppData\Local\Temp\d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15834.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15834.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38297.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38297.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51051.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7682.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26249.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17493.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54292.exe
        8⤵
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45377.exe
        8⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7580.exe
        8⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53306.exe
        7⤵
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2864.exe
        7⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12710.exe
        7⤵
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
        7⤵
        
        PID:5700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18893.exe
        6⤵
        Executes dropped EXE
        
        PID:560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54292.exe
        7⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42261.exe
        7⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43245.exe
        7⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
        7⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19485.exe
        6⤵
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8729.exe
        6⤵
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4045.exe
        6⤵
        
        PID:4240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36539.exe
        6⤵
        
        PID:5856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23538.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23518.exe
        6⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23992.exe
        7⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        7⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27063.exe
        7⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10806.exe
        7⤵
        
        PID:6280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39704.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2864.exe
        6⤵
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49182.exe
        6⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29027.exe
        6⤵
        
        PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44052.exe
        5⤵
        
        PID:1836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2974.exe
        6⤵
        
        PID:2992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3825.exe
        6⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37693.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61081.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49065.exe
        5⤵
        
        PID:3688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59936.exe
        5⤵
        
        PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59090.exe
        5⤵
        
        PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46218.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9803.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25516.exe
        6⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3713.exe
        7⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42261.exe
        7⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32929.exe
        7⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2141.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43950.exe
        6⤵
        
        PID:2412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48126.exe
        6⤵
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49245.exe
        6⤵
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36539.exe
        6⤵
        
        PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39723.exe
        5⤵
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45378.exe
        6⤵
        
        PID:708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54053.exe
        7⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4433.exe
        7⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22829.exe
        7⤵
        
        PID:6712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34741.exe
        6⤵
        
        PID:3724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7832.exe
        6⤵
        
        PID:4980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63165.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46324.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14457.exe
        6⤵
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32929.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42485.exe
        6⤵
        
        PID:6580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16303.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42774.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41047.exe
        5⤵
        
        PID:5520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22290.exe
        5⤵
        
        PID:6404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27525.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59191.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3208.exe
        6⤵
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53594.exe
        7⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
        7⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23929.exe
        7⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14163.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34741.exe
        6⤵
        
        PID:3700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10162.exe
        6⤵
        
        PID:4800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
        6⤵
        
        PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43778.exe
        5⤵
        
        PID:2832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40872.exe
        6⤵
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56099.exe
        6⤵
        
        PID:4900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29512.exe
        6⤵
        
        PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40607.exe
        5⤵
        
        PID:3684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40838.exe
        5⤵
        
        PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37115.exe
        5⤵
        
        PID:6020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43685.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7114.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63944.exe
        6⤵
        
        PID:1864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38784.exe
        6⤵
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43245.exe
        6⤵
        
        PID:4700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
        6⤵
        
        PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40570.exe
        5⤵
        
        PID:2420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2864.exe
        5⤵
        
        PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12710.exe
        5⤵
        
        PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53651.exe
        5⤵
        
        PID:6080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
      4⤵
      PID:2936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-819.exe
        5⤵
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26620.exe
        5⤵
        
        PID:4576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43317.exe
        5⤵
        
        PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37693.exe
        5⤵
        
        PID:6156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5836.exe
      4⤵
      PID:1592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18460.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63465.exe
      4⤵
      PID:5600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45542.exe
      4⤵
      PID:6316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31185.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31185.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21351.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62550.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1651.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35310.exe
        7⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32390.exe
        8⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28386.exe
        7⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1497.exe
        7⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10177.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5275.exe
        6⤵
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14457.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32929.exe
        7⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2141.exe
        7⤵
        
        PID:6332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52868.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26372.exe
        6⤵
        
        PID:4660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40517.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57029.exe
        6⤵
        
        PID:6548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64152.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43269.exe
        6⤵
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14457.exe
        7⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49182.exe
        7⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42485.exe
        7⤵
        
        PID:6560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29557.exe
        6⤵
        
        PID:2660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2864.exe
        6⤵
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49182.exe
        6⤵
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42485.exe
        6⤵
        
        PID:6572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52261.exe
        5⤵
        
        PID:1108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58998.exe
        6⤵
        
        PID:3608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31140.exe
        6⤵
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3825.exe
        6⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37693.exe
        6⤵
        
        PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40253.exe
        5⤵
        
        PID:2576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64.exe
        5⤵
        
        PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42870.exe
        5⤵
        
        PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe
        5⤵
        
        PID:6140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20894.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13296.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56802.exe
        6⤵
        
        PID:2704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8729.exe
        6⤵
        
        PID:3156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24263.exe
        6⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57029.exe
        6⤵
        
        PID:6556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26723.exe
        5⤵
        
        PID:1188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58998.exe
        6⤵
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48391.exe
        7⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38309.exe
        7⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55875.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31140.exe
        6⤵
        
        PID:4864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62206.exe
        6⤵
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
        6⤵
        
        PID:1308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4910.exe
        5⤵
        
        PID:3744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50741.exe
        5⤵
        
        PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40517.exe
        5⤵
        
        PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57029.exe
        5⤵
        
        PID:6536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33533.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61463.exe
        5⤵
        
        PID:1516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14457.exe
        6⤵
        
        PID:3104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9690.exe
        6⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46625.exe
        6⤵
        
        PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41970.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2864.exe
        5⤵
        
        PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57910.exe
        5⤵
        
        PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
        5⤵
        
        PID:5900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59784.exe
      4⤵
      PID:872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50672.exe
        5⤵
        
        PID:3640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31140.exe
        5⤵
        
        PID:4848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43317.exe
        5⤵
        
        PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46385.exe
        5⤵
        
        PID:6352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50068.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1171.exe
      4⤵
      PID:4692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41047.exe
      4⤵
      PID:5528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30163.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15220.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15220.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40760.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48880.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3208.exe
        6⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30653.exe
        7⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        7⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62206.exe
        7⤵
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55290.exe
        7⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47325.exe
        6⤵
        
        PID:1868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8729.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59406.exe
        6⤵
        
        PID:4772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63556.exe
        6⤵
        
        PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59136.exe
        5⤵
        
        PID:1576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11040.exe
        6⤵
        
        PID:3800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31140.exe
        6⤵
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27063.exe
        6⤵
        
        PID:5276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51956.exe
        6⤵
        
        PID:6464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52868.exe
        5⤵
        
        PID:3500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26372.exe
        5⤵
        
        PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35147.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34263.exe
        5⤵
        
        PID:6224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53841.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3015.exe
        5⤵
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40872.exe
        6⤵
        
        PID:3840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56099.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29512.exe
        6⤵
        
        PID:6052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14457.exe
        5⤵
        
        PID:4080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38106.exe
        5⤵
        
        PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14163.exe
        5⤵
        
        PID:6744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48473.exe
      4⤵
      PID:1880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8729.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40517.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45619.exe
      4⤵
      PID:7024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3349.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3349.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43950.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43269.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45687.exe
        6⤵
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        6⤵
        
        PID:4112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45377.exe
        6⤵
        
        PID:1704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
        6⤵
        
        PID:5936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51698.exe
        5⤵
        
        PID:3712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50741.exe
        5⤵
        
        PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40517.exe
        5⤵
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51143.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60923.exe
      4⤵
      PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57828.exe
        5⤵
        
        PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48004.exe
        5⤵
        
        PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1486.exe
        5⤵
        
        PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59212.exe
        5⤵
        
        PID:6636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64922.exe
      4⤵
      PID:2612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8729.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4045.exe
      4⤵
      PID:4616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36539.exe
      4⤵
      PID:2260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58258.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58258.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56802.exe
      4⤵
      PID:768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8729.exe
      4⤵
      PID:3168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59406.exe
      4⤵
      PID:5012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63556.exe
      4⤵
      PID:6104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21123.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21123.exe
    3⤵
    PID:2008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34374.exe
      4⤵
      PID:3136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40872.exe
        5⤵
        
        PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29902.exe
        5⤵
        
        PID:4688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56451.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10554.exe
      4⤵
      PID:4952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42577.exe
      4⤵
      PID:4492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63556.exe
      4⤵
      PID:5144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe
    3⤵
    PID:3308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16555.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16555.exe
    3⤵
    PID:4556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33070.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33070.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57956.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57956.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5340
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53050.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53050.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8840.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8840.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10403.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39888.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61775.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5847.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41589.exe
        8⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        8⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45377.exe
        8⤵
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
        8⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35760.exe
        7⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2864.exe
        7⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59612.exe
        7⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
        7⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39754.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41924.exe
        7⤵
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        7⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52045.exe
        7⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
        7⤵
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47384.exe
        6⤵
        
        PID:2980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8729.exe
        6⤵
        
        PID:3120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4045.exe
        6⤵
        
        PID:4596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36539.exe
        6⤵
        
        PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4271.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57508.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43415.exe
        7⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        7⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6845.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7016.exe
        6⤵
        
        PID:1908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48126.exe
        6⤵
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43267.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36539.exe
        6⤵
        
        PID:5864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12322.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6397.exe
        6⤵
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43317.exe
        6⤵
        
        PID:5552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51956.exe
        6⤵
        
        PID:6472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36176.exe
        5⤵
        
        PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64.exe
        5⤵
        
        PID:3852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23981.exe
        5⤵
        
        PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29558.exe
        5⤵
        
        PID:6076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53489.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3882.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17493.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16888.exe
        7⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        7⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52045.exe
        7⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
        7⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7359.exe
        6⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52577.exe
        7⤵
        
        PID:6652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2864.exe
        6⤵
        
        PID:3836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49182.exe
        6⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43291.exe
        6⤵
        
        PID:6516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16781.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-253.exe
        6⤵
        
        PID:1944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62206.exe
        6⤵
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55290.exe
        6⤵
        
        PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37156.exe
        5⤵
        
        PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8729.exe
        5⤵
        
        PID:3124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38795.exe
        5⤵
        
        PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49748.exe
        5⤵
        
        PID:6796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14581.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13258.exe
        5⤵
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53462.exe
        6⤵
        
        PID:1804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        6⤵
        
        PID:4004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37380.exe
        6⤵
        
        PID:4796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
        6⤵
        
        PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54754.exe
        5⤵
        
        PID:1952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2864.exe
        5⤵
        
        PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51242.exe
        5⤵
        
        PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38244.exe
        5⤵
        
        PID:5804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21566.exe
      4⤵
      PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36441.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        5⤵
        
        PID:4224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43317.exe
        5⤵
        
        PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37693.exe
        5⤵
        
        PID:5964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34355.exe
      4⤵
      PID:1312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49065.exe
      4⤵
      PID:3816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41047.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22290.exe
      4⤵
      PID:6416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29764.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29764.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21523.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3882.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36704.exe
        6⤵
        
        PID:684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54998.exe
        7⤵
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        7⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45377.exe
        7⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19835.exe
        7⤵
        
        PID:6492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49570.exe
        6⤵
        
        PID:2288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2864.exe
        6⤵
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12710.exe
        6⤵
        
        PID:936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
        6⤵
        
        PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55370.exe
        5⤵
        
        PID:976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46589.exe
        6⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64820.exe
        7⤵
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26620.exe
        7⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3825.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
        7⤵
        
        PID:5300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39132.exe
        6⤵
        
        PID:3524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53869.exe
        6⤵
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58358.exe
        6⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56190.exe
        6⤵
        
        PID:6604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16943.exe
        5⤵
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40872.exe
        6⤵
        
        PID:3792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56099.exe
        6⤵
        
        PID:4736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29512.exe
        6⤵
        
        PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40607.exe
        5⤵
        
        PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64704.exe
        5⤵
        
        PID:5000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37115.exe
        5⤵
        
        PID:6040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17483.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37161.exe
        5⤵
        
        PID:2464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6397.exe
        6⤵
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        6⤵
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43317.exe
        6⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51956.exe
        6⤵
        
        PID:6480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50538.exe
        5⤵
        
        PID:1888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48126.exe
        5⤵
        
        PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24263.exe
        5⤵
        
        PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57029.exe
        5⤵
        
        PID:6500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7128.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41013.exe
        5⤵
        
        PID:2328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        5⤵
        
        PID:4168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31671.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
        5⤵
        
        PID:5956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35180.exe
      4⤵
      PID:2084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64.exe
      4⤵
      PID:3844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53047.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53605.exe
      4⤵
      PID:5180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58008.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58008.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29669.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13258.exe
        5⤵
        
        PID:1568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54955.exe
        6⤵
        
        PID:3088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        6⤵
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45377.exe
        6⤵
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56499.exe
        6⤵
        
        PID:6616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48421.exe
        5⤵
        
        PID:1772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2864.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12710.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
        5⤵
        
        PID:5388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40616.exe
      4⤵
      PID:2720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61836.exe
        5⤵
        
        PID:2652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        5⤵
        
        PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31671.exe
        5⤵
        
        PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
        5⤵
        
        PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42120.exe
      4⤵
      PID:2820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8729.exe
      4⤵
      PID:4040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48285.exe
      4⤵
      PID:788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36539.exe
      4⤵
      PID:5648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44697.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44697.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15251.exe
      4⤵
      PID:2812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49423.exe
        5⤵
        
        PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        5⤵
        
        PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6845.exe
        5⤵
        
        PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
        5⤵
        
        PID:5372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33589.exe
      4⤵
      PID:1052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2864.exe
      4⤵
      PID:3964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12710.exe
      4⤵
      PID:4504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
      4⤵
      PID:5452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29489.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29489.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56230.exe
      4⤵
      PID:2408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65064.exe
      4⤵
      PID:4304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43317.exe
      4⤵
      PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37693.exe
      4⤵
      PID:6164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4300.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4300.exe
    3⤵
    PID:2668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-594.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-594.exe
    3⤵
    PID:3212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45561.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45561.exe
    3⤵
    PID:5200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53755.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53755.exe
    3⤵
    PID:6000
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44345.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44345.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49630.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49630.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36121.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36270.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51302.exe
        6⤵
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41440.exe
        7⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5241.exe
        8⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50125.exe
        7⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27063.exe
        7⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37693.exe
        7⤵
        
        PID:6148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30705.exe
        6⤵
        
        PID:2692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2864.exe
        6⤵
        
        PID:3812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12710.exe
        6⤵
        
        PID:1048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
        6⤵
        
        PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17295.exe
        5⤵
        
        PID:536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61836.exe
        6⤵
        
        PID:1728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        6⤵
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6087.exe
        6⤵
        
        PID:5988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14163.exe
        6⤵
        
        PID:6760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62161.exe
        5⤵
        
        PID:1740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8729.exe
        5⤵
        
        PID:4048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48285.exe
        5⤵
        
        PID:316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36539.exe
        5⤵
        
        PID:5676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17940.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8695.exe
        5⤵
        
        PID:1552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29678.exe
        6⤵
        
        PID:3380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26620.exe
        6⤵
        
        PID:4568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31671.exe
        6⤵
        
        PID:4728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10806.exe
        6⤵
        
        PID:6264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39132.exe
        5⤵
        
        PID:3484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20506.exe
        5⤵
        
        PID:4680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2534.exe
        5⤵
        
        PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14554.exe
        5⤵
        
        PID:5252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40459.exe
      4⤵
      PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38773.exe
        5⤵
        
        PID:1140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2864.exe
        5⤵
        
        PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49182.exe
        5⤵
        
        PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29027.exe
        5⤵
        
        PID:6024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9865.exe
      4⤵
      PID:1968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64.exe
      4⤵
      PID:3184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7728.exe
      4⤵
      PID:5568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43821.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60002.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60002.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55370.exe
      4⤵
      PID:2004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8434.exe
        5⤵
        
        PID:2728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21202.exe
        6⤵
        
        PID:3952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48375.exe
        6⤵
        
        PID:4916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23929.exe
        6⤵
        
        PID:4336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14163.exe
        6⤵
        
        PID:6728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41813.exe
        5⤵
        
        PID:3188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62022.exe
        5⤵
        
        PID:4776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12710.exe
        5⤵
        
        PID:1676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
        5⤵
        
        PID:5380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9061.exe
      4⤵
      PID:604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18556.exe
        5⤵
        
        PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49040.exe
        5⤵
        
        PID:5868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17015.exe
        5⤵
        
        PID:6908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40607.exe
      4⤵
      PID:3672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64704.exe
      4⤵
      PID:4964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10177.exe
      4⤵
      PID:6096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42309.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42309.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6583.exe
      4⤵
      PID:2416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53594.exe
        5⤵
        
        PID:3232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
        5⤵
        
        PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43317.exe
        5⤵
        
        PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51956.exe
        5⤵
        
        PID:6456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34741.exe
      4⤵
      PID:3736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7832.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53651.exe
      4⤵
      PID:6092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56313.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56313.exe
    3⤵
    PID:2588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56230.exe
      4⤵
      PID:4088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56179.exe
      4⤵
      PID:4564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10489.exe
      4⤵
      PID:5888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17197.exe
      4⤵
      PID:6232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
    3⤵
    PID:3752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65234.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65234.exe
    3⤵
    PID:4932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32650.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32650.exe
    3⤵
    PID:6068
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15322.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15322.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3614.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3614.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36270.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3641.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9504.exe
        6⤵
        
        PID:3860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31140.exe
        6⤵
        
        PID:4856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43317.exe
        6⤵
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51956.exe
        6⤵
        
        PID:6448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26686.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13262.exe
        5⤵
        
        PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57910.exe
        5⤵
        
        PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
        5⤵
        
        PID:5744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54106.exe
      4⤵
      PID:884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32307.exe
        5⤵
        
        PID:3676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48004.exe
        5⤵
        
        PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1486.exe
        5⤵
        
        PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59212.exe
        5⤵
        
        PID:6644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32310.exe
      4⤵
      PID:2884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19127.exe
      4⤵
      PID:4308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40517.exe
      4⤵
      PID:5464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51143.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17940.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17940.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17424.exe
      4⤵
      PID:1712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25382.exe
        5⤵
        
        PID:2628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50030.exe
        5⤵
        
        PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22829.exe
        5⤵
        
        PID:6736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44079.exe
      4⤵
      PID:1336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48126.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40517.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26755.exe
      4⤵
      PID:6504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7334.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7334.exe
    3⤵
    PID:1292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21006.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1967.exe
      4⤵
      PID:4948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62316.exe
      4⤵
      PID:6116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58733.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58733.exe
    3⤵
    PID:3476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17706.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17706.exe
    3⤵
    PID:4668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26041.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26041.exe
    3⤵
    PID:4400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38774.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38774.exe
    3⤵
    PID:5952
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27190.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27190.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37806.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37806.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13464.exe
      4⤵
      PID:948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21235.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26096.exe
        5⤵
        
        PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31671.exe
        5⤵
        
        PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
        5⤵
        
        PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39132.exe
      4⤵
      PID:3516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53537.exe
      4⤵
      PID:4744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15263.exe
      4⤵
      PID:5684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63165.exe
      4⤵
      PID:6768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43778.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43778.exe
    3⤵
    PID:1444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28688.exe
      4⤵
      PID:2040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
      4⤵
      PID:4032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6087.exe
      4⤵
      PID:5980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14163.exe
      4⤵
      PID:6752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57857.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57857.exe
    3⤵
    PID:2796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64.exe
    3⤵
    PID:3868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23981.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23981.exe
    3⤵
    PID:5488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2671.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2671.exe
    3⤵
    PID:6324
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23414.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23414.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34598.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34598.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
    3⤵
    PID:3992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37380.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37380.exe
    3⤵
    PID:4792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5168
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60152.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60152.exe
  2⤵
  PID:2724
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44600.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44600.exe
  2⤵
  PID:3220
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33558.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33558.exe
  2⤵
  PID:5664
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37076.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37076.exe
  2⤵
  PID:6624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-21006.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-21006.exe
Size 468KB
SHA256 7180692970917baebfdd5e9d3a9a1ade72790d5933a47806a61d4a993db1b056
MD5 8dbb941c9db4bc936925def9d6039016
SHA1 18747213234d2fb0c05de57c8d9fe6f8ae670856
SHA512 e6182a41a3a049b85a755f070ba61020e90e913e597db635a60c12d41e2d518eff1481dccd40f481d14abf5f15f2ff3199c9acb993a801e6913723ea28436838
SSDEEP 3072:EGeHo5IKq05UYbYpH5cOcf8/LC2WP0p1nLHewVPPaPH+tSgsvzlA:EGuoe8UYuHSOcfjYIsaPe0gsv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-39754.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-39754.exe
Size 468KB
SHA256 9891b2b410c3b4ad9cfbdb9efdb5c070c83bf5e9da673bd71ed759e2c0eb7528
MD5 f6cefd8ab3c4b55a7b126521837907c3
SHA1 0851243a3e1c493de4ea9822be69a3132263db22
SHA512 e8e61b18a361ed445987c2364edfb2d72997ed1300d81793ce41712f004865b81323ca8356c32a942095b173f608c36d1c3e6125fce9d7182ce882bd7e9d1708
SSDEEP 3072:NGevo5QKq05UDbYpH5cOcf8/sC2WP0p1nLHewVPPXPG+tSgsvzlA:NGmom8UDuHSOcfuYIsXPN0gsv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-5847.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-5847.exe
Size 468KB
SHA256 9771bd43ea4dadf855809c6f5a1e928cb79402cc8ee0bc855a6c9c8b24fef4de
MD5 92de163fbccab16d9a918b06be82c552
SHA1 1eea0a05b88174bd9c975931bedb9ff19f025da2
SHA512 f410153c94a60a17bd7fea3992f5177aa6b0144a3ecaa7be81dcc0286314cc42952cb1258a15b5cdae42247b98d11d5eb36ef7b631464d1253fb728a58637cbf
SSDEEP 3072:iGevo5QKq05UDbYpH5cOcf8/sC2WP0p1nLHewVPPXPG+tSgsvPlA:iGmom8UDuHSOcfuYIsXPN0gsv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-9690.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-9690.exe
Size 468KB
SHA256 bcb84e8e458c8bb5c1ca4db33787b39f27a02260c1f8c5eee81cfca6870ebc84
MD5 56c0f0b45f604b99fccad8c4d6d12f19
SHA1 a3e5d7af0cc9c0f69670953e1b1d39e3f8bedf05
SHA512 fb33a77f25d8712a1b10547e8fd7188f79093182d3f4e77259bec82e58edb8f7eddfc251f4557ba1e815e212e57aa7c3ce5d141fe4bb1869145006b45b9757c3
SSDEEP 3072:PGeHo5IKq05UDbYpHUcOcf8/LC2WP0p1nLHewV7PXPH+tSgsvYlA:PGuoe8UDuHROcfjYIYXPe0gsv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-10403.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-10403.exe
Size 468KB
SHA256 dcf22396614c703269f9653780d80837db7dd2bc65a2d2719390f369a9799e86
MD5 a58fc8164eeec9befb16c7ff41131795
SHA1 60b774f2adc70988dc0c460c50fba3c2aa3b9e67
SHA512 269003f4d2bd9f46499b01000c6176723024003a04e1dae1f53782d44fc47908ca8572ebebebaa43993800aeaa0d44d05f2193577b2f3516c98e0fba421f8037
SSDEEP 3072:1Gevo5QKq05UDbYpH5cOcf8/sC2WP0p1nLHewVPPXPH+tSgsvzlA:1Gmom8UDuHSOcfuYIsXPe0gsv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-15220.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-15220.exe
Size 468KB
SHA256 1ed56ecb3c9d82ea487705e4d2fc66d9f2d43ab23b959adf2d32febc8ad7120a
MD5 e2931fd680c6a48284307b363d8049dc
SHA1 762c519b820a47da152f729692c25ec69a7f1e21
SHA512 aeb57b965d23520bac715228cfd088c48ca4144ab4aa5e83e53d815a4edbe7baeffc5185c93c34dc10ee2051212849191125d0830fa2ccff52081b2d01908e74
SSDEEP 3072:1Gepo5IKq05UDbYpHUcOcf8/LC2WP0p1nLHewVPPXPH+tSgsvzlA:1G4oe8UDuHROcfjYIsXPe0gsv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-15322.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-15322.exe
Size 468KB
SHA256 9d68e5cd8cd45688d04e2bfc24bfb39c1b3485e1576773484650584907273646
MD5 8a227bbdb4ea1172d5c818e967fb5065
SHA1 288f526b5eb15c1fdf3897ebb87969ad20966e14
SHA512 b2f70e4463bc85e129d214a95a925f1a31e2b2f29f39404515595efaa2d87bb6b59834e61adff7cc4ddae086f616b5f066cfa52eabef80e76537114881d0ec2e
SSDEEP 3072:1GeHo5IKq05UDbYpH5cOcf8/LC2WP0p1nLHewVPPaPH+tSgsvzlA:1Guoe8UDuHSOcfjYIsaPe0gsv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-15834.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-15834.exe
Size 468KB
SHA256 04bc5caeba8b493b54735916a0c4bb223208557ad52cffcc38855381fea7c1a0
MD5 19d8b8251a53659030c73403095f9f34
SHA1 65529316943f64583fd7d163830280f12e58ac25
SHA512 4e57da27afa941c0f7690bebf0f2f6fbd29a3c669f8b68638915cb69fd32281a4abfc694a1c90085447cc4257b6582eef87bb75b44013456fe76fc98fcb35708
SSDEEP 3072:1GeHo5IKq05UDbYpHUcOcf8/LC2WP0p1nLHewVPPXPH+tSgsvzlA:1Guoe8UDuHROcfjYIsXPe0gsv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-21351.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-21351.exe
Size 468KB
SHA256 b3f805432cbef06e78050f86339d5fcaf9019ee2931c9bf2a3bec4e992d9a066
MD5 4311bfa34d5058df5e896f33ad5a0546
SHA1 e4534004358a7671baae6a3187799ece4b462f07
SHA512 f0a0b89f3047d99dd23c3b1b546c02248eca48d0fe71f04b80e7784a547c1481ad36a2b3bac8eb576cd3022ddb822c756d3b0dd74540d2fc9ea46960e27dec6e
SSDEEP 3072:1GeHo5IKq05UDbYpHUcOcf8/LC2W/0p1nLHewVPPXPH+tSgsvXlA:1Guoe8UDuHROcfTYIsXPe0gsv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-21523.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-21523.exe
Size 468KB
SHA256 0873781abf3db9e6b7ee0dfefef1eb411ce28616d63c1a804a427637b1c1f32a
MD5 8387b00ff1ee5f5a67724f5c720ff18c
SHA1 bfb62b37bbdc0d18d911f00231ad379c0b993d99
SHA512 c3bffd6c2c16dc0e194391ace8708abc4c01e6583d1c90f920f6b2c82a90ce63f86838fe2a29d5151dc3554fe7c22db0e303a687ba097dca8ef4c3a8569a1639
SSDEEP 3072:1GeHo5IKq05UDbYpH5cOcf8/sC2WT0p1nLHewVPPXPH+tSgsvulA:1Guoe8UDuHSOcfKYIsXPe0gsv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-29764.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-29764.exe
Size 468KB
SHA256 a7638ab836e378dcf85937e9de0d924d2beb9d1003b45a0ea746e179948264c3
MD5 d6b28d151a1597fbab575e08f8777fae
SHA1 d7b43c9fe99230adaca34807d258ab55cf0c3b3c
SHA512 c0f81ff43f695b5645ca6342cdec687bbe98a90af21c5dd6bb5a0811e4bf08ec8a550e35947e11e022ac88cbd1fc1e54695b8225e41831849e1a8f81bd004102
SSDEEP 3072:1GeHo5IKq05UDbYpH5cOcf8/sC2WP0p1nLHewVPPXPH+tSgsvulA:1Guoe8UDuHSOcfuYIsXPe0gsv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-31185.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-31185.exe
Size 468KB
SHA256 dde62a63bf921afd203a2ee2e0355d6dbbde31a0282ce0d25dfe9e56b771f7bb
MD5 1d490043c7a3367a3a7338746756a2f0
SHA1 a06146967f98272a9aad62b59d3b6ab3f9c6016f
SHA512 6d37fc5a7afd79476e25213c80721c97b3b5b692ce7ee3225cbe6967700b86d081126dae414a92f49d73c38221ba1f3632267a55e973e4c8fc1809470811aace
SSDEEP 3072:1GeHo5IKq05UDbYpHUcOcf8/LC2WP0p1nLHewVPPXPH+tSgsvXlA:1Guoe8UDuHROcfjYIsXPe0gsv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-38297.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-38297.exe
Size 468KB
SHA256 f9bd1a9ab007c0c6e0ea10e89f8fd46575a6ac3aaae8649a47920c99f37a2cf4
MD5 b628caf8a8805cb69cff2899c6c69d3d
SHA1 4b5cec9743747635f913d3a15e7a6ffa3d20f370
SHA512 0abb1e0dd5a72febe87c0852da86b7efcf35071cd0a94b0d23b1d46385225778c4df06450262695dface0290250c9591cd7a5d1f2bf7bb8e075a02db96eafe56
SSDEEP 3072:1GeHo5IKq05UDbYpHUcOcf8/LC2WP0p1nLHewVPPXXH+tSgsvzlA:1Guoe8UDuHROcfjYIsXXe0gsv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-39888.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-39888.exe
Size 468KB
SHA256 f3ea1b38c58f1110e7eb51172391f5ac7d9773c8c009426890cf966a63f08aa0
MD5 c552a1f3f5183a136da0001e218aa7db
SHA1 da4f4f3fe05f45b609a53e93bd6e02b2afa43da2
SHA512 9ec2a7c3710c6935d53e176fd08fb65309c4247266f10ba0246bcf1954f6a53fe466168e4c6cec39a1560bf36e14b5b78f5ba3d2c3d35462a738ed9cb0a9ba76
SSDEEP 3072:1Gevo5QKq05UDbYpH5cOcf8/sC2WP0p1nLHewVPPXPG+tSgsvzlA:1Gmom8UDuHSOcfuYIsXPN0gsv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-44345.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-44345.exe
Size 468KB
SHA256 7124d09c2e2c9d18b0e3722f977e49338bb9195da7003a977c194709f3e42c7b
MD5 2892f5fdd74a01e63217483c7e195a56
SHA1 42629f687cb853fa549b5bcf9177f676ea5ba28f
SHA512 edd75341adb2a0c2de005b822468761011f4dd8801aa3cb1ccd22a3c55f857d49638980c60b1dd364da82fa8c6d91e67b3ac2e29b80245f14e034207f903e9fd
SSDEEP 3072:1GeHo5IKq05UDbYpH5cOcf8/LC2WP0p1nLHewVPPXqH+tSgsvzlA:1Guoe8UDuHSOcfjYIsXqe0gsv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-46218.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-46218.exe
Size 468KB
SHA256 1b99682414d9227ce4577842ac3fab923e5efbfea362fb5b7452876ea86d5b48
MD5 8cb04fdac4c144f68ac9c8e9c06c0550
SHA1 45dc81b8274bccb2a6c58bac416ebb249f1ff7a3
SHA512 6430f132bfa8361ec1326fcffa96e6b98b8c5aca4baebab40ec9f194a48eef6b5c7dbf7d90060dfa4f85fe8ab285a493ecc1c335184a7b5c9d51f2bcd715c844
SSDEEP 3072:1GeHo5IKq45UDbYpHUcOcf8/LC2WP0p1nLHewVPPXXH+tSgsvzlA:1Guoe4UDuHROcfjYIsXXe0gsv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-49630.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-49630.exe
Size 468KB
SHA256 5035834c1f275542182b8a1781a409010207df21165c89d071463fd5ab07870e
MD5 71049c86a503d6c447d6263f6c41036d
SHA1 94eccd6cea7de51527e6e81b4c36a8aa7b83f153
SHA512 1c0d7bb2edafc4049c4d719679e3d048e54c711082d978651a618b7499c49c55a114648a0b3fc784f6aa3564e31592bed7172f91db143c4c6fc1d705f51dcddf
SSDEEP 3072:1GeHo5IKq05UDbYpH5cOcf8/LC2WP0p1nLHewVPPXqH+tqgsvzlA:1Guoe8UDuHSOcfjYIsXqesgsv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-51051.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-51051.exe
Size 468KB
SHA256 68583749160236019403e9474becc1b7b7cdb8cb38bcf17ca57ca2076a2d7d2c
MD5 174f24d18b908d69443028ca0a71a4a0
SHA1 12029de2547678cf6656066d0efbd147984e8ba5
SHA512 34eed18c25fbc0cf52ecbeac5f45287bd4d3c149540cd6d58760f535f256056b486bde2b7617b55d6ffb9cfc142631892712adc6109aaeba04e3ce54219b092c
SSDEEP 3072:1GeHo5IKq05UDbYpHUcOcf8/LC2WP0p1nLHewVPPXXH+tSIsvzlA:1Guoe8UDuHROcfjYIsXXe0Isv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-53050.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-53050.exe
Size 468KB
SHA256 94464e84cefa56d03a645b897f948dd060546f01e36c434b4af88b32e16fe088
MD5 cedb82581dde298063985e863d259177
SHA1 5253463587e364214032155bc111a7b9ca394a56
SHA512 aaa4f43f8459b8af96743d8ee4ff8b21228740e681d99e9dbe491b3b5183ce86713fd850a04d33f3b1cc43878ba77c9d702ee2e57d234d6d6688aa06b77439c9
SSDEEP 3072:1GeHo5IKq05UDbYpH5cOcf8/sC2WP0p1nLHewVPPXPH+tSgsvzlA:1Guoe8UDuHSOcfuYIsXPe0gsv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-53489.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-53489.exe
Size 468KB
SHA256 5f1fc0b358b585c0a2538498bba6e04d6b96b3b7e1151b204892ec77feb4d48c
MD5 18261eaa8a40597553bb60301c869b6e
SHA1 a13193a08e8577cef70c6615f04659130b46a04e
SHA512 222b3fd409004814f3bb8bd13b9a5d6faf0c6658f97f08a1f11353475d28374f4d196085329bb426e5bdd15618b5d65e7bc70a01611ba9937679d594faa8d229
SSDEEP 3072:1Gevo5IKq05UDbYpH5cOcf8/s72WP0p1nLHewVPPXPH+tSgsvzlA:1Gmoe8UDuHSOcfVYIsXPe0gsv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-7682.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-7682.exe
Size 468KB
SHA256 f77a9c02a33df006717bb27c8c7d2efcded47ecd3b731317c28d3f78f1bfdea8
MD5 d33e1e1b5bea9ba6bbf2b90324e97972
SHA1 161fc4d5d85730370472442bde64f6c66411f436
SHA512 26c6744115ab3b23e31611496da5e5558f7dff6d3ed2d1dc3234b10428c251e5955a5401e9f17b956f02da9c3bb405d7f84099cb37c07b3a29a6734854508b63
SSDEEP 3072:1GeHo5IKq05UDbYpHUcOcf8/LC2WP0p1nLHewVPPXXE+tSIsvzlA:1Guoe8UDuHROcfjYIsXXL0Isv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-8840.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-8840.exe
Size 468KB
SHA256 1c14efb47891de68c2c3716f297ab03f658a1b683dfd6234426112aa231b1bf3
MD5 1d435d82e9dd447f63f6e71a255e8cae
SHA1 ed2d168d9b2f0e91062a56b0410cf50ab3e6baf0
SHA512 7fd4dd84f21095f684057409ec318fce51c0c529b9e5e9883172f7abd1ea5bdf44d65189fab645dcf8f659a759520a9a033e0d6f38697bf16f377a1a1041187d
SSDEEP 3072:1Gevo5IKq05UDbYpH5cOcf8/sC2WP0p1nLHewVPPXPH+tSgsvzlA:1Gmoe8UDuHSOcfuYIsXPe0gsv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads