54b207637e04f35a45bc93691850b9d68904ca0e99e590a0d56b8b3e90039d23

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 01:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
54b207637e04f35a45bc93691850b9d68904ca0e99e590a0d56b8b3e90039d23N.exe
Size 468KB
Sample241005-ccjylsyerr
SHA256 54b207637e04f35a45bc93691850b9d68904ca0e99e590a0d56b8b3e90039d23
MD5 9b14779392e15ba7140517625d90ae90
SHA1 03d4afed471f40b57ce4c7f1ca1f00b513736dfc
SHA512 6dd3e3503c41ab77f64c738dd14a7a8da2a1f4e2be7ab0ee06063774999f769d29c42cc40ee565c637949237e77a8d4a87ff601f231191aa54ecdd481aa8b20d
SSDEEP 3072:B1sfogCday8Unb/EPz5Fff1/fhW4I8YzmHe7VpmnG8ea3xVLhlVl7:B1wosLUnoP1Fff1xGKG8e43Lhl
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2704	Unicorn-58180.exe
2668	Unicorn-13608.exe
2724	Unicorn-13738.exe
2680	Unicorn-52854.exe
2684	Unicorn-22320.exe
2592	Unicorn-12895.exe
2560	Unicorn-16189.exe
1960	Unicorn-20935.exe
340	Unicorn-25869.exe
2860	Unicorn-63332.exe
552	Unicorn-11178.exe
3036	Unicorn-31044.exe
1800	Unicorn-61085.exe
676	Unicorn-54955.exe
1672	Unicorn-63835.exe
2784	Unicorn-42850.exe
1072	Unicorn-47209.exe
1552	Unicorn-17573.exe
1996	Unicorn-8536.exe
2920	Unicorn-1319.exe
1740	Unicorn-34760.exe
336	Unicorn-28629.exe
2492	Unicorn-34760.exe
1584	Unicorn-39535.exe
1260	Unicorn-39022.exe
3032	Unicorn-57637.exe
1236	Unicorn-57902.exe
1324	Unicorn-57902.exe
2448	Unicorn-38036.exe
752	Unicorn-38036.exe
1640	Unicorn-22288.exe
2624	Unicorn-1078.exe
2700	Unicorn-34457.exe
2544	Unicorn-1976.exe
2632	Unicorn-61383.exe
2540	Unicorn-36220.exe
2640	Unicorn-39257.exe
264	Unicorn-6127.exe
1472	Unicorn-22070.exe
2588	Unicorn-27004.exe
1992	Unicorn-46870.exe
2500	Unicorn-38597.exe
1756	Unicorn-5733.exe
2384	Unicorn-57596.exe
2976	Unicorn-12500.exe
2248	Unicorn-9961.exe
2912	Unicorn-10196.exe
1128	Unicorn-60658.exe
596	Unicorn-51728.exe
916	Unicorn-28178.exe
2180	Unicorn-28178.exe
2128	Unicorn-61353.exe
1088	Unicorn-15515.exe
3020	Unicorn-440.exe
2084	Unicorn-20306.exe
3004	Unicorn-36149.exe
748	Unicorn-61321.exe
1504	Unicorn-31707.exe
2968	Unicorn-12831.exe
2844	Unicorn-57471.exe
1676	Unicorn-58785.exe
2212	Unicorn-21348.exe
2580	Unicorn-55687.exe
2388	Unicorn-38514.exe

Loads dropped DLL 64 IoCs

pid	Process
2036	54b207637e04f35a45bc93691850b9d68904ca0e99e590a0d56b8b3e90039d23N.exe
2036	54b207637e04f35a45bc93691850b9d68904ca0e99e590a0d56b8b3e90039d23N.exe
2036	54b207637e04f35a45bc93691850b9d68904ca0e99e590a0d56b8b3e90039d23N.exe
2704	Unicorn-58180.exe
2036	54b207637e04f35a45bc93691850b9d68904ca0e99e590a0d56b8b3e90039d23N.exe
2704	Unicorn-58180.exe
2668	Unicorn-13608.exe
2668	Unicorn-13608.exe
2724	Unicorn-13738.exe
2724	Unicorn-13738.exe
2036	54b207637e04f35a45bc93691850b9d68904ca0e99e590a0d56b8b3e90039d23N.exe
2036	54b207637e04f35a45bc93691850b9d68904ca0e99e590a0d56b8b3e90039d23N.exe
2704	Unicorn-58180.exe
2704	Unicorn-58180.exe
2684	Unicorn-22320.exe
2684	Unicorn-22320.exe
2724	Unicorn-13738.exe
2724	Unicorn-13738.exe
2680	Unicorn-52854.exe
2680	Unicorn-52854.exe
2668	Unicorn-13608.exe
2668	Unicorn-13608.exe
2592	Unicorn-12895.exe
2704	Unicorn-58180.exe
2560	Unicorn-16189.exe
2036	54b207637e04f35a45bc93691850b9d68904ca0e99e590a0d56b8b3e90039d23N.exe
2592	Unicorn-12895.exe
2704	Unicorn-58180.exe
2560	Unicorn-16189.exe
2036	54b207637e04f35a45bc93691850b9d68904ca0e99e590a0d56b8b3e90039d23N.exe
1960	Unicorn-20935.exe
1960	Unicorn-20935.exe
2684	Unicorn-22320.exe
2684	Unicorn-22320.exe
340	Unicorn-25869.exe
340	Unicorn-25869.exe
2724	Unicorn-13738.exe
2724	Unicorn-13738.exe
552	Unicorn-11178.exe
552	Unicorn-11178.exe
2668	Unicorn-13608.exe
2860	Unicorn-63332.exe
1672	Unicorn-63835.exe
2668	Unicorn-13608.exe
2860	Unicorn-63332.exe
1672	Unicorn-63835.exe
2036	54b207637e04f35a45bc93691850b9d68904ca0e99e590a0d56b8b3e90039d23N.exe
2680	Unicorn-52854.exe
2680	Unicorn-52854.exe
2036	54b207637e04f35a45bc93691850b9d68904ca0e99e590a0d56b8b3e90039d23N.exe
2704	Unicorn-58180.exe
2704	Unicorn-58180.exe
676	Unicorn-54955.exe
1800	Unicorn-61085.exe
676	Unicorn-54955.exe
2560	Unicorn-16189.exe
2592	Unicorn-12895.exe
2592	Unicorn-12895.exe
2560	Unicorn-16189.exe
2784	Unicorn-42850.exe
2784	Unicorn-42850.exe
1960	Unicorn-20935.exe
1960	Unicorn-20935.exe
1072	Unicorn-47209.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2756	2608	WerFault.exe	116

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57596.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64701.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45815.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13295.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55476.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28027.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38345.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34457.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51953.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22947.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17379.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61660.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24075.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37513.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45878.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62162.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21323.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7849.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61383.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57637.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14215.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-309.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7849.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63576.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20306.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31726.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54381.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47208.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40662.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22160.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25028.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38345.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32479.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-117.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2993.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31726.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6281.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10630.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58986.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37161.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32479.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33050.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5861.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3674.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51357.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21323.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62854.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47130.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5189.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31726.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60311.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2036	54b207637e04f35a45bc93691850b9d68904ca0e99e590a0d56b8b3e90039d23N.exe
2704	Unicorn-58180.exe
2668	Unicorn-13608.exe
2724	Unicorn-13738.exe
2680	Unicorn-52854.exe
2684	Unicorn-22320.exe
2592	Unicorn-12895.exe
2560	Unicorn-16189.exe
1960	Unicorn-20935.exe
340	Unicorn-25869.exe
2860	Unicorn-63332.exe
3036	Unicorn-31044.exe
552	Unicorn-11178.exe
1672	Unicorn-63835.exe
1800	Unicorn-61085.exe
676	Unicorn-54955.exe
2784	Unicorn-42850.exe
1072	Unicorn-47209.exe
1552	Unicorn-17573.exe
1996	Unicorn-8536.exe
2920	Unicorn-1319.exe
1740	Unicorn-34760.exe
1260	Unicorn-39022.exe
2492	Unicorn-34760.exe
336	Unicorn-28629.exe
3032	Unicorn-57637.exe
752	Unicorn-38036.exe
1584	Unicorn-39535.exe
1324	Unicorn-57902.exe
2448	Unicorn-38036.exe
1640	Unicorn-22288.exe
2624	Unicorn-1078.exe
2700	Unicorn-34457.exe
2632	Unicorn-61383.exe
2544	Unicorn-1976.exe
2640	Unicorn-39257.exe
264	Unicorn-6127.exe
2540	Unicorn-36220.exe
1472	Unicorn-22070.exe
1992	Unicorn-46870.exe
2588	Unicorn-27004.exe
2500	Unicorn-38597.exe
1756	Unicorn-5733.exe
2384	Unicorn-57596.exe
2976	Unicorn-12500.exe
2912	Unicorn-10196.exe
2248	Unicorn-9961.exe
2180	Unicorn-28178.exe
1128	Unicorn-60658.exe
916	Unicorn-28178.exe
596	Unicorn-51728.exe
2128	Unicorn-61353.exe
1088	Unicorn-15515.exe
3020	Unicorn-440.exe
2084	Unicorn-20306.exe
748	Unicorn-61321.exe
3004	Unicorn-36149.exe
1504	Unicorn-31707.exe
2968	Unicorn-12831.exe
2844	Unicorn-57471.exe
1676	Unicorn-58785.exe
2212	Unicorn-21348.exe
2580	Unicorn-55687.exe
2312	Unicorn-44644.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2704	2036	54b207637e04f35a45bc93691850b9d68904ca0e99e590a0d56b8b3e90039d23N.exe	30
PID 2036 wrote to memory of 2704	2036	54b207637e04f35a45bc93691850b9d68904ca0e99e590a0d56b8b3e90039d23N.exe	30
PID 2036 wrote to memory of 2704	2036	54b207637e04f35a45bc93691850b9d68904ca0e99e590a0d56b8b3e90039d23N.exe	30
PID 2036 wrote to memory of 2704	2036	54b207637e04f35a45bc93691850b9d68904ca0e99e590a0d56b8b3e90039d23N.exe	30
PID 2704 wrote to memory of 2724	2704	Unicorn-58180.exe	32
PID 2704 wrote to memory of 2724	2704	Unicorn-58180.exe	32
PID 2704 wrote to memory of 2724	2704	Unicorn-58180.exe	32
PID 2704 wrote to memory of 2724	2704	Unicorn-58180.exe	32
PID 2036 wrote to memory of 2668	2036	54b207637e04f35a45bc93691850b9d68904ca0e99e590a0d56b8b3e90039d23N.exe	31
PID 2036 wrote to memory of 2668	2036	54b207637e04f35a45bc93691850b9d68904ca0e99e590a0d56b8b3e90039d23N.exe	31
PID 2036 wrote to memory of 2668	2036	54b207637e04f35a45bc93691850b9d68904ca0e99e590a0d56b8b3e90039d23N.exe	31
PID 2036 wrote to memory of 2668	2036	54b207637e04f35a45bc93691850b9d68904ca0e99e590a0d56b8b3e90039d23N.exe	31
PID 2668 wrote to memory of 2680	2668	Unicorn-13608.exe	33
PID 2668 wrote to memory of 2680	2668	Unicorn-13608.exe	33
PID 2668 wrote to memory of 2680	2668	Unicorn-13608.exe	33
PID 2668 wrote to memory of 2680	2668	Unicorn-13608.exe	33
PID 2724 wrote to memory of 2684	2724	Unicorn-13738.exe	34
PID 2724 wrote to memory of 2684	2724	Unicorn-13738.exe	34
PID 2724 wrote to memory of 2684	2724	Unicorn-13738.exe	34
PID 2724 wrote to memory of 2684	2724	Unicorn-13738.exe	34
PID 2036 wrote to memory of 2560	2036	54b207637e04f35a45bc93691850b9d68904ca0e99e590a0d56b8b3e90039d23N.exe	35
PID 2036 wrote to memory of 2560	2036	54b207637e04f35a45bc93691850b9d68904ca0e99e590a0d56b8b3e90039d23N.exe	35
PID 2036 wrote to memory of 2560	2036	54b207637e04f35a45bc93691850b9d68904ca0e99e590a0d56b8b3e90039d23N.exe	35
PID 2036 wrote to memory of 2560	2036	54b207637e04f35a45bc93691850b9d68904ca0e99e590a0d56b8b3e90039d23N.exe	35
PID 2704 wrote to memory of 2592	2704	Unicorn-58180.exe	36
PID 2704 wrote to memory of 2592	2704	Unicorn-58180.exe	36
PID 2704 wrote to memory of 2592	2704	Unicorn-58180.exe	36
PID 2704 wrote to memory of 2592	2704	Unicorn-58180.exe	36
PID 2684 wrote to memory of 1960	2684	Unicorn-22320.exe	37
PID 2684 wrote to memory of 1960	2684	Unicorn-22320.exe	37
PID 2684 wrote to memory of 1960	2684	Unicorn-22320.exe	37
PID 2684 wrote to memory of 1960	2684	Unicorn-22320.exe	37
PID 2724 wrote to memory of 340	2724	Unicorn-13738.exe	38
PID 2724 wrote to memory of 340	2724	Unicorn-13738.exe	38
PID 2724 wrote to memory of 340	2724	Unicorn-13738.exe	38
PID 2724 wrote to memory of 340	2724	Unicorn-13738.exe	38
PID 2680 wrote to memory of 2860	2680	Unicorn-52854.exe	39
PID 2680 wrote to memory of 2860	2680	Unicorn-52854.exe	39
PID 2680 wrote to memory of 2860	2680	Unicorn-52854.exe	39
PID 2680 wrote to memory of 2860	2680	Unicorn-52854.exe	39
PID 2668 wrote to memory of 552	2668	Unicorn-13608.exe	40
PID 2668 wrote to memory of 552	2668	Unicorn-13608.exe	40
PID 2668 wrote to memory of 552	2668	Unicorn-13608.exe	40
PID 2668 wrote to memory of 552	2668	Unicorn-13608.exe	40
PID 2592 wrote to memory of 3036	2592	Unicorn-12895.exe	41
PID 2592 wrote to memory of 3036	2592	Unicorn-12895.exe	41
PID 2592 wrote to memory of 3036	2592	Unicorn-12895.exe	41
PID 2592 wrote to memory of 3036	2592	Unicorn-12895.exe	41
PID 2704 wrote to memory of 676	2704	Unicorn-58180.exe	42
PID 2704 wrote to memory of 676	2704	Unicorn-58180.exe	42
PID 2704 wrote to memory of 676	2704	Unicorn-58180.exe	42
PID 2704 wrote to memory of 676	2704	Unicorn-58180.exe	42
PID 2560 wrote to memory of 1800	2560	Unicorn-16189.exe	43
PID 2560 wrote to memory of 1800	2560	Unicorn-16189.exe	43
PID 2560 wrote to memory of 1800	2560	Unicorn-16189.exe	43
PID 2560 wrote to memory of 1800	2560	Unicorn-16189.exe	43
PID 2036 wrote to memory of 1672	2036	54b207637e04f35a45bc93691850b9d68904ca0e99e590a0d56b8b3e90039d23N.exe	44
PID 2036 wrote to memory of 1672	2036	54b207637e04f35a45bc93691850b9d68904ca0e99e590a0d56b8b3e90039d23N.exe	44
PID 2036 wrote to memory of 1672	2036	54b207637e04f35a45bc93691850b9d68904ca0e99e590a0d56b8b3e90039d23N.exe	44
PID 2036 wrote to memory of 1672	2036	54b207637e04f35a45bc93691850b9d68904ca0e99e590a0d56b8b3e90039d23N.exe	44
PID 1960 wrote to memory of 2784	1960	Unicorn-20935.exe	45
PID 1960 wrote to memory of 2784	1960	Unicorn-20935.exe	45
PID 1960 wrote to memory of 2784	1960	Unicorn-20935.exe	45
PID 1960 wrote to memory of 2784	1960	Unicorn-20935.exe	45

C:\Users\Admin\AppData\Local\Temp\54b207637e04f35a45bc93691850b9d68904ca0e99e590a0d56b8b3e90039d23N.exe
"C:\Users\Admin\AppData\Local\Temp\54b207637e04f35a45bc93691850b9d68904ca0e99e590a0d56b8b3e90039d23N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58180.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58180.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13738.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13738.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22320.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20935.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42850.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22288.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58785.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31726.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32672.exe
        10⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56527.exe
        10⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15458.exe
        10⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47208.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
        9⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51357.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24384.exe
        9⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11860.exe
        8⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe
        9⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50824.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18674.exe
        9⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38345.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-151.exe
        8⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4887.exe
        8⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15874.exe
        8⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13144.exe
        8⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21348.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29614.exe
        8⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe
        9⤵
        
        PID:736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50824.exe
        9⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15960.exe
        9⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38345.exe
        9⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51953.exe
        8⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64559.exe
        8⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21825.exe
        8⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12658.exe
        8⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31262.exe
        7⤵
        
        PID:392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11629.exe
        8⤵
        
        PID:3740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
        8⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51357.exe
        8⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24384.exe
        8⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41185.exe
        7⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9984.exe
        7⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46318.exe
        7⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28648.exe
        7⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1078.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55687.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31726.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16761.exe
        9⤵
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45492.exe
        9⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33050.exe
        9⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49584.exe
        8⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5982.exe
        8⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1510.exe
        8⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11860.exe
        7⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50969.exe
        8⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4171.exe
        8⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32479.exe
        8⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59215.exe
        7⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9539.exe
        7⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42692.exe
        7⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7849.exe
        7⤵
        
        PID:6776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38514.exe
        6⤵
        Executes dropped EXE
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31019.exe
        7⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24990.exe
        7⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-117.exe
        7⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36783.exe
        7⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6016.exe
        6⤵
        
        PID:872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61759.exe
        6⤵
        
        PID:3776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46318.exe
        6⤵
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45093.exe
        6⤵
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47209.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34457.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44644.exe
        7⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14215.exe
        8⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18210.exe
        8⤵
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15960.exe
        8⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38345.exe
        8⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29710.exe
        7⤵
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44839.exe
        7⤵
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5982.exe
        7⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7540.exe
        7⤵
        
        PID:6572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23434.exe
        6⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14215.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16811.exe
        7⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21825.exe
        7⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29679.exe
        7⤵
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12278.exe
        6⤵
        
        PID:3028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45878.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62854.exe
        6⤵
        
        PID:4516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24605.exe
        6⤵
        
        PID:6676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61383.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5189.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe
        7⤵
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50824.exe
        7⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-117.exe
        7⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36863.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25364.exe
        6⤵
        
        PID:3712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9539.exe
        6⤵
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42692.exe
        6⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7849.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20165.exe
        5⤵
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36984.exe
        6⤵
        
        PID:3304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2225.exe
        6⤵
        
        PID:4368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1354.exe
        6⤵
        
        PID:6204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44331.exe
        5⤵
        
        PID:3184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58986.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63576.exe
        5⤵
        
        PID:4904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8679.exe
        5⤵
        
        PID:5292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25869.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17573.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1976.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43300.exe
        7⤵
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11205.exe
        8⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36819.exe
        8⤵
        
        PID:3876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-117.exe
        8⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53228.exe
        8⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59887.exe
        7⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31945.exe
        7⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5982.exe
        7⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7540.exe
        7⤵
        
        PID:6648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14986.exe
        6⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15175.exe
        7⤵
        
        PID:992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26277.exe
        7⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-117.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24075.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13295.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50704.exe
        6⤵
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62854.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28027.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36220.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exe
        6⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46182.exe
        7⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36819.exe
        7⤵
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-117.exe
        7⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24075.exe
        7⤵
        
        PID:6616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35662.exe
        6⤵
        
        PID:2788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47405.exe
        6⤵
        
        PID:3592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5982.exe
        6⤵
        
        PID:2424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7540.exe
        6⤵
        
        PID:6640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59313.exe
        5⤵
        
        PID:1176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21626.exe
        6⤵
        
        PID:2412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64152.exe
        6⤵
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-309.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43026.exe
        6⤵
        
        PID:5684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8610.exe
        5⤵
        
        PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22160.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14222.exe
        5⤵
        
        PID:4080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30210.exe
        5⤵
        
        PID:5868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8536.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39257.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47130.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25441.exe
        7⤵
        
        PID:428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17487.exe
        7⤵
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6174.exe
        7⤵
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12658.exe
        7⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17527.exe
        6⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19987.exe
        7⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50824.exe
        7⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-309.exe
        7⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21323.exe
        7⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59983.exe
        6⤵
        
        PID:3692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9539.exe
        6⤵
        
        PID:5072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42692.exe
        6⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7849.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47332.exe
        5⤵
        
        PID:1388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe
        6⤵
        
        PID:2268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50824.exe
        6⤵
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-117.exe
        6⤵
        
        PID:4484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24075.exe
        6⤵
        
        PID:6604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-151.exe
        5⤵
        
        PID:308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12685.exe
        5⤵
        
        PID:4856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27834.exe
        5⤵
        
        PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3384.exe
        5⤵
        
        PID:6820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6127.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-98.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-98.exe
        5⤵
        
        PID:1496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe
        6⤵
        
        PID:1888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50824.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18674.exe
        6⤵
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38345.exe
        6⤵
        
        PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51953.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64559.exe
        5⤵
        
        PID:3748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6174.exe
        5⤵
        
        PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12658.exe
        5⤵
        
        PID:5300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11718.exe
      4⤵
      PID:2360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59528.exe
        5⤵
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8203.exe
        5⤵
        
        PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15458.exe
        5⤵
        
        PID:5516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46352.exe
      4⤵
      PID:1484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62289.exe
      4⤵
      PID:3500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41853.exe
      4⤵
      PID:4500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18227.exe
      4⤵
      PID:5636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12895.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12895.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31044.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38597.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33008.exe
        6⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe
        7⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50824.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-309.exe
        7⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21323.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51953.exe
        6⤵
        
        PID:2168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64559.exe
        6⤵
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6174.exe
        6⤵
        
        PID:5040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12658.exe
        6⤵
        
        PID:2400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54724.exe
        5⤵
        
        PID:2556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25588.exe
        6⤵
        
        PID:6996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23353.exe
        5⤵
        
        PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13160.exe
        5⤵
        
        PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61660.exe
        5⤵
        
        PID:5600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38036.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20306.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        6⤵
        
        PID:2188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30742.exe
        6⤵
        
        PID:3520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18674.exe
        6⤵
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20747.exe
        6⤵
        
        PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54381.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57819.exe
        5⤵
        
        PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62854.exe
        5⤵
        
        PID:4576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11582.exe
        5⤵
        
        PID:5568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61321.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33008.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe
        6⤵
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50824.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51357.exe
        6⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24384.exe
        6⤵
        
        PID:6920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33395.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12784.exe
        5⤵
        
        PID:4224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24540.exe
        5⤵
        
        PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29679.exe
        5⤵
        
        PID:6000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40662.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3690.exe
        5⤵
        
        PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23854.exe
        5⤵
        
        PID:4164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32479.exe
        5⤵
        
        PID:5252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14687.exe
      4⤵
      PID:3900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62162.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30210.exe
      4⤵
      PID:5880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54955.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54955.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57902.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28178.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9029.exe
        6⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50824.exe
        7⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18674.exe
        7⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38345.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-121.exe
        6⤵
        
        PID:3084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64559.exe
        6⤵
        
        PID:4128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5982.exe
        6⤵
        
        PID:2280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7540.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34581.exe
        5⤵
        
        PID:2924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38076.exe
        6⤵
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2225.exe
        6⤵
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15458.exe
        6⤵
        
        PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35512.exe
        5⤵
        
        PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18649.exe
        5⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63046.exe
        5⤵
        
        PID:2052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61660.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15515.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8254.exe
        5⤵
        
        PID:2712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11629.exe
        6⤵
        
        PID:3728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
        6⤵
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51357.exe
        6⤵
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24384.exe
        6⤵
        
        PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38195.exe
        5⤵
        
        PID:3472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51357.exe
        5⤵
        
        PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24384.exe
        5⤵
        
        PID:6868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31496.exe
      4⤵
      PID:1608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45031.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63576.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8679.exe
      4⤵
      PID:6004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57637.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57637.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10196.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54447.exe
        5⤵
        
        PID:2572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3323.exe
        6⤵
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55476.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45492.exe
        6⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33050.exe
        6⤵
        
        PID:6804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21776.exe
        5⤵
        
        PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12784.exe
        5⤵
        
        PID:4208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5982.exe
        5⤵
        
        PID:1272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1510.exe
        5⤵
        
        PID:6564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60848.exe
      4⤵
      PID:1096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20179.exe
        5⤵
        
        PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50824.exe
        5⤵
        
        PID:1596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17906.exe
        5⤵
        
        PID:4168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38345.exe
        5⤵
        
        PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60311.exe
      4⤵
      PID:3932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-874.exe
      4⤵
      PID:4940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46318.exe
      4⤵
      PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13188.exe
      4⤵
      PID:5796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51728.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51728.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64756.exe
      4⤵
      PID:444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11550.exe
        5⤵
        
        PID:3372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52111.exe
        5⤵
        
        PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32479.exe
        5⤵
        
        PID:5244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40181.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40181.exe
      4⤵
      PID:3216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18072.exe
      4⤵
      PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38345.exe
      4⤵
      PID:5936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39290.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39290.exe
    3⤵
    PID:1652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8006.exe
      4⤵
      PID:3396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21864.exe
      4⤵
      PID:5488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33050.exe
      4⤵
      PID:6796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56945.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56945.exe
    3⤵
    PID:3832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45410.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45410.exe
    3⤵
    PID:5032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16356.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16356.exe
    3⤵
    PID:5440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2249.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2249.exe
    3⤵
    PID:6768
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13608.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13608.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52854.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52854.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63332.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34760.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46870.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11860.exe
        7⤵
        
        PID:1832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25028.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23662.exe
        8⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32479.exe
        8⤵
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45484.exe
        7⤵
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9539.exe
        7⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30139.exe
        7⤵
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54701.exe
        6⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32523.exe
        7⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54296.exe
        7⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64960.exe
        7⤵
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14048.exe
        6⤵
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4887.exe
        6⤵
        
        PID:4112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62854.exe
        6⤵
        
        PID:4596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24605.exe
        6⤵
        
        PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57596.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20026.exe
        6⤵
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe
        7⤵
        
        PID:1036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50824.exe
        7⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1077.exe
        7⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21323.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51953.exe
        6⤵
        
        PID:2628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21350.exe
        6⤵
        
        PID:4868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31629.exe
        6⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61660.exe
        6⤵
        
        PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35598.exe
        5⤵
        
        PID:1956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe
        6⤵
        
        PID:3060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50824.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15960.exe
        6⤵
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38345.exe
        6⤵
        
        PID:5888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6016.exe
        5⤵
        
        PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61759.exe
        5⤵
        
        PID:4104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61970.exe
        5⤵
        
        PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3075.exe
        5⤵
        
        PID:6704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39022.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36149.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31726.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37161.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20694.exe
        7⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15458.exe
        7⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40710.exe
        6⤵
        
        PID:3948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
        6⤵
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27730.exe
        6⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24384.exe
        6⤵
        
        PID:6896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11860.exe
        5⤵
        
        PID:1928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1763.exe
        6⤵
        
        PID:3220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21864.exe
        6⤵
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33050.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54446.exe
        5⤵
        
        PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9539.exe
        5⤵
        
        PID:5044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42692.exe
        5⤵
        
        PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7849.exe
        5⤵
        
        PID:6852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12831.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26447.exe
        5⤵
        
        PID:2364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36819.exe
        5⤵
        
        PID:3892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18674.exe
        5⤵
        
        PID:4880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38345.exe
        5⤵
        
        PID:5948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60032.exe
      4⤵
      PID:2368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44605.exe
      4⤵
      PID:4076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46510.exe
      4⤵
      PID:4260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13188.exe
      4⤵
      PID:5712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11178.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11178.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1319.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22070.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64701.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19426.exe
        7⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31103.exe
        7⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-117.exe
        7⤵
        
        PID:1276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24075.exe
        7⤵
        
        PID:6596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43633.exe
        6⤵
        
        PID:2940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10630.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5982.exe
        6⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7540.exe
        6⤵
        
        PID:6632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28032.exe
        5⤵
        
        PID:776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57797.exe
        6⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29213.exe
        7⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11225.exe
        7⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-117.exe
        7⤵
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24075.exe
        7⤵
        
        PID:6656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35413.exe
        6⤵
        
        PID:1236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50555.exe
        6⤵
        
        PID:3884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6174.exe
        6⤵
        
        PID:4136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3028.exe
        6⤵
        
        PID:7032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25595.exe
        5⤵
        
        PID:1844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31019.exe
        6⤵
        
        PID:2856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24990.exe
        6⤵
        
        PID:3980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15960.exe
        6⤵
        
        PID:4408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21323.exe
        6⤵
        
        PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6016.exe
        5⤵
        
        PID:1796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61759.exe
        5⤵
        
        PID:3196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46318.exe
        5⤵
        
        PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64100.exe
        5⤵
        
        PID:7040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27004.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28939.exe
        5⤵
        
        PID:1316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31966.exe
        6⤵
        
        PID:3872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23662.exe
        6⤵
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32479.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45480.exe
        5⤵
        
        PID:3812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
        5⤵
        
        PID:5000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44371.exe
        5⤵
        
        PID:5272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58626.exe
      4⤵
      PID:2244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46143.exe
        5⤵
        
        PID:3428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2225.exe
        5⤵
        
        PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32479.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59569.exe
      4⤵
      PID:4068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12685.exe
      4⤵
      PID:4844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15094.exe
      4⤵
      PID:5816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30210.exe
      4⤵
      PID:5872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28629.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28629.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60658.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25536.exe
        5⤵
        
        PID:300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5861.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5982.exe
        5⤵
        
        PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7540.exe
        5⤵
        
        PID:6668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30950.exe
      4⤵
      PID:1592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37513.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15106.exe
      4⤵
      PID:4512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13144.exe
      4⤵
      PID:5988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61353.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61353.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64756.exe
      4⤵
      PID:2896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16953.exe
        5⤵
        
        PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42650.exe
        5⤵
        
        PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15458.exe
        5⤵
        
        PID:5640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22947.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58618.exe
      4⤵
      PID:4220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51357.exe
      4⤵
      PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24384.exe
      4⤵
      PID:6912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55826.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55826.exe
    3⤵
    PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17379.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2225.exe
      4⤵
      PID:4400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17347.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17347.exe
    3⤵
    PID:3008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13215.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13215.exe
    3⤵
    PID:4884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10629.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10629.exe
    3⤵
    PID:5840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51859.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51859.exe
    3⤵
    PID:5584
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16189.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16189.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61085.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61085.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57902.exe
      4⤵
      Executes dropped EXE
      PID:1236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5733.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15176.exe
        5⤵
        
        PID:2792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4311.exe
        6⤵
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2225.exe
        6⤵
        
        PID:4148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15458.exe
        6⤵
        
        PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38003.exe
        5⤵
        
        PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
        5⤵
        
        PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51357.exe
        5⤵
        
        PID:5388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24384.exe
        5⤵
        
        PID:6876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7318.exe
      4⤵
      PID:2608
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 240
        5⤵
        Program crash
        
        PID:2756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28948.exe
      4⤵
      PID:2184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41678.exe
      4⤵
      PID:3508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46510.exe
      4⤵
      PID:4176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13188.exe
      4⤵
      PID:5720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38036.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38036.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12500.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32033.exe
        5⤵
        
        PID:680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38557.exe
        5⤵
        
        PID:3232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18674.exe
        5⤵
        
        PID:4900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38345.exe
        5⤵
        
        PID:5976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14697.exe
      4⤵
      PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10980.exe
      4⤵
      PID:3320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42692.exe
      4⤵
      PID:5520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7849.exe
      4⤵
      PID:6844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9961.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9961.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50816.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31647.exe
      4⤵
      PID:3352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21825.exe
      4⤵
      PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12658.exe
      4⤵
      PID:5800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18096.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18096.exe
    3⤵
    PID:2372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8180.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8180.exe
    3⤵
    PID:3308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46318.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46318.exe
    3⤵
    PID:1808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28648.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28648.exe
    3⤵
    PID:5312
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63835.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63835.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34760.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34760.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28178.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34563.exe
        5⤵
        
        PID:2552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62782.exe
        5⤵
        
        PID:3332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-117.exe
        5⤵
        
        PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18045.exe
        5⤵
        
        PID:6552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36352.exe
      4⤵
      PID:2568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12350.exe
      4⤵
      PID:3412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5982.exe
      4⤵
      PID:4492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44563.exe
      4⤵
      PID:5652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-440.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-440.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53926.exe
      4⤵
      PID:2772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe
        5⤵
        
        PID:684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50824.exe
        5⤵
        
        PID:3392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28911.exe
        5⤵
        
        PID:5552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51739.exe
      4⤵
      PID:3448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9539.exe
      4⤵
      PID:5080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19064.exe
      4⤵
      PID:5448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15459.exe
      4⤵
      PID:6240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62466.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62466.exe
    3⤵
    PID:1056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56885.exe
      4⤵
      PID:3708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4939.exe
      4⤵
      PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32479.exe
      4⤵
      PID:5240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60311.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60311.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-874.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-874.exe
    3⤵
    PID:4948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26156.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26156.exe
    3⤵
    PID:5452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24915.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24915.exe
    3⤵
    PID:6812
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39535.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39535.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31707.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31707.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45815.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe
        5⤵
        
        PID:2468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50824.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-309.exe
        5⤵
        
        PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21323.exe
        5⤵
        
        PID:5708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-151.exe
      4⤵
      PID:2620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4887.exe
      4⤵
      PID:4120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62854.exe
      4⤵
      PID:4632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24605.exe
      4⤵
      PID:6684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63920.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63920.exe
    3⤵
    PID:2776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20934.exe
      4⤵
      PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2993.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28229.exe
      4⤵
      PID:7060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25364.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25364.exe
    3⤵
    PID:3720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9539.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9539.exe
    3⤵
    PID:5064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19693.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19693.exe
    3⤵
    PID:5260
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57471.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57471.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33569.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33569.exe
    3⤵
    PID:968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40093.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40093.exe
    3⤵
    PID:3160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15960.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15960.exe
    3⤵
    PID:4344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21323.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21323.exe
    3⤵
    PID:5760
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51344.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51344.exe
  2⤵
  PID:2304
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28492.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28492.exe
  2⤵
  PID:3192
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34520.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34520.exe
  2⤵
  PID:4324
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40910.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40910.exe
  2⤵
  PID:5112
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
  2⤵
  PID:5696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-16189.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-16189.exe
Size 468KB
SHA256 bc93aaac25f706571cf397a4d8a9acb989ddfed66c53d578da274c96f4db2b3d
MD5 04500baf2fc191567d519e0d7541546c
SHA1 b371e0d6fbc295d7508981673d57f2ab56e43113
SHA512 3b9f3ad49fdf643c0a85c646cca435dfb6ae4df3d8187439e29965510969537986e2a2b80f7ba2aa3b80cbd599d2b75cea02e1a76c1d7eff8051926c14e8ca6a
SSDEEP 3072:B1sfogFday8Unb/EPz5Fff1/fhW4I8YzmHe7VpmnG8ea3xVLhlVl7:B1wojLUnoP1Fff1xGKG8e43Lhl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-17347.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-17347.exe
Size 468KB
SHA256 b768dd155d8939adfdad48044aaeb44ccba6a1fcda90eca298ef4022dee4dc83
MD5 fba855b9eb9f8cf35e486e879ceddd6c
SHA1 331de07adfb0ebae08b8ab204fe48b806cec61b7
SHA512 4cd2e6fc0bcc487c34c9729e890cb175f47269a3d9d2972cb70b1510a7f8511cff25e94500149e5accc94d59d1d594ba45c6c4f5bca9620b479b0e6a1edf5a21
SSDEEP 3072:G1sfogCday8Unb/EPz5Fff1/fhW4I8YzmHe7VpmnG8ea3YVLhlVl7:G1wosLUnoP1Fff1xGKG8e4gLhl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-17573.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-17573.exe
Size 468KB
SHA256 a7c05be73e3363dc0583acdbe2bfadbc17e0a4b4df4f65bb818e558f3406fd53
MD5 561316d9df68116def1507bc9fc84234
SHA1 e8b931e68101696396249d7e3b208079454f1da2
SHA512 62c3c637b757eccb23a381891d519718343a23163226cbc2ba5c5e338d34c0849eecf6618db57242a20be44ec42007c2cbc443d9295b5981ef6aa5f352dd270e
SSDEEP 3072:B1sfogCday8Unb/WPz5Fuf1/fhW4I8YzmHe7VpmnG8ea3xVLhyVl7:B1wosLUnqP1Fuf1xGKG8e43Lhy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-22320.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-22320.exe
Size 468KB
SHA256 68f55d0800a74187e62350de27793f1998512df3fa3cd7b4cae491ad16ef7dc5
MD5 90008f27f2c7d3770b12664b65f0e139
SHA1 e74398addf6ad1df4c5078ffe4e020117184b118
SHA512 2c622e420d808d7c4981cb91f91ebcb253ca4236d6659336562cc468fdfb7f2ab3507174cebf1a53f0de77a737e9293cd3b54b9995605c04d8ae2a5142e3d603
SSDEEP 3072:B1sfogCday8Unb/WPz5Fff1/fhW408YzmHe7VpmnG8ea3xVLhCVl7:B1wosLUnqP1Fff1tGKG8e43LhC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-40093.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-40093.exe
Size 468KB
SHA256 e8d983031e98a79fe5b232324e8d41f260baf1d73e4e54d0b616ec1cceae4b28
MD5 988be7f34f07590600ef922e7f52162c
SHA1 297fbcfa7e9be3fb028dba4488b41ea0f2696e3e
SHA512 291ebf28cddb6604b7aef0bd66e0bfb9e512066effea47aaeec44c87b737a23509145a107a62611e3af5ac0f13c97bf4211cc4d81133ede804392b0a9eef4d8f
SSDEEP 3072:h1sfogCday8Unb/EPz5Fff1/fhW4I8YzmHe7VpmnG8ea3RVLhlVl7:h1wosLUnoP1Fff1xGKG8e4XLhl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-63332.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-63332.exe
Size 468KB
SHA256 b591fc0331fee28b4c7a6ce39ba3a7331cf79c87d8b3bcbb58369de195101f41
MD5 d966e6196d3bcc2d922c2bb1faed4d60
SHA1 9aa7498d5285c538f31c0f47b5fec45479cfbdc1
SHA512 f0e4e6aba2bc50f9e52b7ff2a92c53f879cf610d0cda25312bfef4aa1639e8b2d4d2d34a88a31e63afa4fd92ebd84fa671a6b868ac9db25b7778cb5fd7742aae
SSDEEP 3072:B1sfogCday8Unb/EPz5Fff1/fhW4I8YzmHe7VpmnG8ea3YVehlVlz:B1wosLUnoP1Fff1xGKG8e4gehl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-11178.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-11178.exe
Size 468KB
SHA256 00ed84283a64f9b5e59e21b4941314888a8e27bb678610191b44da2321b3a984
MD5 1854dbc98412360a16f024d21ef1f15e
SHA1 91a257413e9602114e597c86e69f4510525499ec
SHA512 cd7e0984dce31ddd32d59d42ebd82c4d6e350b3f6486d7e99780e3bf96d468a1ec9aa2fa7b04c490499a25b79ee316274237ed6ae93308dfa4a802a3c5285ca9
SSDEEP 3072:BYsfogCday8Unb/EPz5Fff1/fhW4I8YzmHe7VpmnG8ea3YVLhlVl7:BYwosLUnoP1Fff1xGKG8e4gLhl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-12895.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-12895.exe
Size 468KB
SHA256 d3fb44d7de3f481a957e20619fb4996593eef552c5ec84030e7826585ea018b2
MD5 2a30f0cfd26309d47ba5f2f723815de4
SHA1 82fe6490170927ed403be95fcbb04679a3bc8265
SHA512 34bdd2c1ede4c831408d56bc294f1a991611ec4d967a4450fdc3df6dd6add7aa1a627168e1d0dc1aca2979fa11384e02730ce8e3e1310ed7070be070a8f1d958
SSDEEP 3072:B1sfogCday8Unb/EPz5Fff1/fhW4I8YzmHe7VpmnG8ea3jVLhCVl7:B1wosLUnoP1Fff1xGKG8e4BLhC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-13608.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-13608.exe
Size 468KB
SHA256 ce7280c41a8427438455ccbee2c90fe07ebd68d05dda214a3047da0ecf2668bf
MD5 851fb1edc777d49c40d526fff377f238
SHA1 6c7fb2e521271085c5e81bbc66e77429013a7bcf
SHA512 6f46db21d2e1019c190fee2c6dcabc1ec2f3a4b5c43bf5ca7c99524eb6ac395674046bd62e96cd97ef089c729cd3f824689f4f3a5af52e2712c479ec00099a84
SSDEEP 3072:B1sfogCday8Unb/EPz5Fff1/fhW4I8YzmHe7VpmnG8ea3YVLhlVl7:B1wosLUnoP1Fff1xGKG8e4gLhl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-13738.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-13738.exe
Size 468KB
SHA256 aa225265c5835cb354a3af0e589fd67f333a5515e29106d632eafd001b421deb
MD5 2c241233f2ecdc060219110de126c382
SHA1 c58012fa2f4fdf1a58ead80821627270b7ed8686
SHA512 aca887d88dd1ca81717f4433376618d102632f62b1e0fe1ee9befb6ff08ca2bfd703086a6953ae2996d6d77d09c04d16dd95ab4c73bc7311c6e85a96f49b260d
SSDEEP 3072:B1sfogCday8Unb/WPz5Fff1/fhW4I8YzmHe7VpmnG8ea3xVLhCVl7:B1wosLUnqP1Fff1xGKG8e43LhC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-20935.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-20935.exe
Size 468KB
SHA256 444a4444c4c73837575b48377d2a4ced9b44a01495855146ea31c49b8439524e
MD5 a56d2848129b55577598979a693e7cb5
SHA1 c707070c05794896ec3ecbaebaa909ba59e87b92
SHA512 2b882db6c9c91ceafb7ed521f1c125747171e69b77a9affaa6589a64272fe70ea86f280d6b47e5a9b0a955f32d228017f4c8ec8030e4224a5d9c5f0e3379bb52
SSDEEP 3072:B1sfogCday8Unb/WPz5Fff1/fhK408YzmHe7VpmnG8ea3xVLhCVl7:B1wosLUnqP1FffhtGKG8e43LhC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-25869.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-25869.exe
Size 468KB
SHA256 4eed9a3b8587134b53d5875e9b68fcb504ea98ce20da67b47ff7a76d3663172a
MD5 ed9d735012c00cfa2b7fe054a05c8a6e
SHA1 124ecaddc3fd6b94981ba0a71ded345373e6b481
SHA512 cefe46245c7babe9b5f39136eb04055a84a664e7370a2a394a0baa937dfcc2560d15869c61bc6a393e568ab0a6ec217ba31df7ac94e8f9979fd7ca34b1414202
SSDEEP 3072:B1sfogCday8Unb/WPz5Fff1/fhW4I8YzmHe7VpmnG8ea3xVLhyVl7:B1wosLUnqP1Fff1xGKG8e43Lhy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-31044.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-31044.exe
Size 468KB
SHA256 c6468881bca8453eb9918aca0bcf1245d94ad2a7ec5788879b38ecdfe07890dc
MD5 8d01f754878144c53d2a754fc6ad3e7d
SHA1 9ae252d8a2cee848a244e47a7739ba04809d9038
SHA512 e668b85a49321fe094c2f03438a9fefeb510f7268b8b09f4276d6362639418d34346087ef7d69be3ffc90bf1bb39c930020a83c79323917004e3d4ea14e5ffed
SSDEEP 3072:B1sfogCday8Unb/EPz5Fff1/fhW4I8YzmHe7VpmnG8ea3jVLhCwl7:B1wosLUnoP1Fff1xGKG8e4BLhC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-42850.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-42850.exe
Size 468KB
SHA256 41c533ecb99fb8e945adfe777a3d636b6d46086b9203c7742398106a7253e89c
MD5 90c8b426d3c194df92b15396ab44b73b
SHA1 bb89fefd93778ef502d75c59d862db7779411242
SHA512 5668370cdd5ee9e04316ff1831c111eface6b4d6c6fa8b72f26857ef057e6a6c71dee673412b54c685c22df16379038f6a5e5b6d342a4d60e66b4cfef910bf93
SSDEEP 3072:B1sfogCday8Unb/WPz5Fff1/fhK408YzmHe7VpmnG8eG3xVLhCVl7:B1wosLUnqP1FffhtGKG8eM3LhC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-47209.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-47209.exe
Size 468KB
SHA256 61051ccc9a2ed3f4dea0b1c575c240542b5cfddf7d58f1b004dd528476b47f1f
MD5 a9c3f348567ceab1312847aed6c3f144
SHA1 e8191bbc46c4a3c3cfe1c8d0eebe1f115d6d83ea
SHA512 1f460131f9638d123672736e772c5ce72359db309cd8838e7bbd966c5735ec5ceb49c939ea23b113a78766a88c8d309b7c456beddb07b1bd29377e30d934f4d2
SSDEEP 3072:B1sfogCday8Ubb/WPz5Fff1/fhW408YzmHe7VpmnG8ea3xVLhCVl7:B1wosLUbqP1Fff1tGKG8e43LhC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-52854.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-52854.exe
Size 468KB
SHA256 76de1e804d7cc1ac0bcff67aea1d0414d76e9c55a7cee7feffb8f475f1bd6359
MD5 897ca5bf728e0533ddc8a16b135f5436
SHA1 33840364043496ad646871eefd623b1b910afd97
SHA512 d83a430c2da62c682d7646a236b0a3771ee532a33cc86fd0753dd302a74cca279339b4f68a5562c0dd28b3a99de71c0defa83030161eb1a5d86502df85b37793
SSDEEP 3072:B1sfogCday8Unb/EPz5Fff1/fhW4I8YzmHe7VpmnG8ea3YVehlVl7:B1wosLUnoP1Fff1xGKG8e4gehl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-54955.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-54955.exe
Size 468KB
SHA256 870d52cd5314bc2323f4889e49e17d6d2fc52f02d389f97e7c3e26b7903a2b7f
MD5 25e6f77513ae7403da6eab3ca1eb889c
SHA1 d5b86c5081b256002f9c20d08c0f91f70f6db245
SHA512 5ad20d06a72b318fcf08a35e532b4efc6f2b276440a68b3c2404f149829887711dd23db9771f4349f8dba9b6bb769495d4c7a7dfeecbdc2e396c9dd6f680e0e7
SSDEEP 3072:B1sfogCday8Unb/EPz5Fff1/fhW4I8YzmHe7VpmnG8ea3x3LhCVl7:B1wosLUnoP1Fff1xGKG8e4VLhC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-58180.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-58180.exe
Size 468KB
SHA256 c25d456be427fe10948ae12185f6e1d989904afb852be7608e7debd31d224f80
MD5 7393a7a36e53d7e86a2340e823b12c76
SHA1 019c4324a69dbaf5e204b6a8db0e1167d1741f3a
SHA512 58a4f0ce0e526e0cedee8d7ba578b4c82c512e00d80f8c893eee7584569054dfded2c181d03ba20f52e77885d9242f450128d7859d1909820d423d1a1b0f828c
SSDEEP 3072:B1sfogCday8Unb/EPz5Fff1/fhW4I8YzmHe7VpmnG8ea3xVLhCVl7:B1wosLUnoP1Fff1xGKG8e43LhC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-61085.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-61085.exe
Size 468KB
SHA256 9902a43f48e54706f124e293f6f1f8d1351f379d65da6476dc915b2f61d94da2
MD5 75f50edd6b6b3dc8660a37ed2c14f2ef
SHA1 b5f91e43989cc39f05a349b489fbba34d2b873a0
SHA512 9530eedb1dd3dbfc095101eeb1e08aa34f734312ce12508407b769b119bc9f6f39a5f7e80337b8df8ca1d7376024a57033b4cf59a103c3108be130ee2c4506eb
SSDEEP 3072:B1sfogFday8Unb/EPz5Fff1/fhW4I8YzmHe7VpmnG8ea3xVLhlVl+:B1wojLUnoP1Fff1xGKG8e43Lhl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-63835.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-63835.exe
Size 468KB
SHA256 8d571ec70704c43b82dce328d5c1e7575f5fb4710ca68d91484b1f47187aed37
MD5 eb87cd23bfe8ca0d5036aa3b3dc3b756
SHA1 545d9fe64d93ee7fa54068ed4928c488d3fadc74
SHA512 5dd058413214031a1ab2de83645b0f7fe9e2ed16d77061bffe12173e7fb12ba41aaaeac76291250ffe8a0b26bfa2cd9c17f0e86cef57b99bbb861ddd26ae64ae
SSDEEP 3072:B1sfogCday8Unb/EPz5vff1/fhW4I8YzmHe7VpmnG8ea3xVLhlVl7:B1wosLUnoP1vff1xGKG8e43Lhl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-8536.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-8536.exe
Size 468KB
SHA256 71e149521df757b13035856b70f3fddf24164a6071cc54077b26987ae83b1d1d
MD5 4b69ff4c53c4b438e51e64fb0ffa55b8
SHA1 c8415bea89d978d2c5e060f93f73722635b6a7ec
SHA512 13e2fbe05e9890a938f22416508df642381990afdd577a717a6569ca52d7638687cf57b50f60334420c376b02c0060ebb8df2f03776fa234f47640ce903e167a
SSDEEP 3072:B1sfogCday8Unb/WPz5Fff1/fhW4I8YzmHe7VpmnG8ea3xVLhCVlq:B1wosLUnqP1Fff1xGKG8e43LhC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/264-386-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/340-222-0x0000000002590000-0x0000000002605000-memory.dmp

Download

memory/340-112-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/340-221-0x0000000002590000-0x0000000002605000-memory.dmp

Download

memory/340-371-0x0000000002590000-0x0000000002605000-memory.dmp

Download

memory/552-245-0x0000000000480000-0x00000000004F5000-memory.dmp

Download

memory/552-246-0x0000000000480000-0x00000000004F5000-memory.dmp

Download

memory/552-136-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/552-407-0x0000000000480000-0x00000000004F5000-memory.dmp

Download

memory/676-178-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/676-299-0x0000000001E20000-0x0000000001E95000-memory.dmp

Download

memory/676-297-0x0000000001E20000-0x0000000001E95000-memory.dmp

Download

memory/1072-344-0x0000000000480000-0x00000000004F5000-memory.dmp

Download

memory/1072-343-0x0000000000480000-0x00000000004F5000-memory.dmp

Download

memory/1072-212-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1236-296-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1260-284-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1324-302-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1472-400-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1552-224-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1584-279-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1640-326-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1672-179-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1672-255-0x00000000028C0000-0x0000000002935000-memory.dmp

Download

memory/1672-264-0x00000000028C0000-0x0000000002935000-memory.dmp

Download

memory/1740-263-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1800-174-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1800-298-0x0000000002930000-0x00000000029A5000-memory.dmp

Download

memory/1960-197-0x0000000002560000-0x00000000025D5000-memory.dmp

Download

memory/1960-97-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1960-196-0x0000000002560000-0x00000000025D5000-memory.dmp

Download

memory/1960-335-0x0000000002560000-0x00000000025D5000-memory.dmp

Download

memory/1996-237-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2036-32-0x0000000003390000-0x0000000003405000-memory.dmp

Download

memory/2036-325-0x0000000003390000-0x0000000003405000-memory.dmp

Download

memory/2036-11-0x0000000002860000-0x00000000028D5000-memory.dmp

Download

memory/2036-278-0x0000000002860000-0x00000000028D5000-memory.dmp

Download

memory/2036-268-0x0000000002860000-0x00000000028D5000-memory.dmp

Download

memory/2036-0-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2036-331-0x0000000002860000-0x00000000028D5000-memory.dmp

Download

memory/2036-303-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2036-10-0x0000000003390000-0x0000000003405000-memory.dmp

Download

memory/2036-170-0x0000000002860000-0x00000000028D5000-memory.dmp

Download

memory/2448-305-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2540-372-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2544-361-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2560-304-0x0000000000480000-0x00000000004F5000-memory.dmp

Download

memory/2560-145-0x0000000000480000-0x00000000004F5000-memory.dmp

Download

memory/2560-300-0x0000000000480000-0x00000000004F5000-memory.dmp

Download

memory/2560-416-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2560-168-0x0000000000480000-0x00000000004F5000-memory.dmp

Download

memory/2560-82-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2588-417-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2592-164-0x0000000002590000-0x0000000002605000-memory.dmp

Download

memory/2592-80-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2592-415-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2592-139-0x0000000002590000-0x0000000002605000-memory.dmp

Download

memory/2592-301-0x0000000002590000-0x0000000002605000-memory.dmp

Download

memory/2624-338-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2632-363-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2640-378-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2668-130-0x0000000000480000-0x00000000004F5000-memory.dmp

Download

memory/2668-52-0x0000000000480000-0x00000000004F5000-memory.dmp

Download

memory/2668-360-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2668-260-0x0000000000480000-0x00000000004F5000-memory.dmp

Download

memory/2668-34-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2668-252-0x0000000000480000-0x00000000004F5000-memory.dmp

Download

memory/2668-44-0x0000000000480000-0x00000000004F5000-memory.dmp

Download

memory/2680-270-0x0000000000480000-0x00000000004F5000-memory.dmp

Download

memory/2680-384-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2680-277-0x0000000000480000-0x00000000004F5000-memory.dmp

Download

memory/2684-95-0x00000000024A0000-0x0000000002515000-memory.dmp

Download

memory/2684-211-0x00000000024A0000-0x0000000002515000-memory.dmp

Download

memory/2684-210-0x00000000024A0000-0x0000000002515000-memory.dmp

Download

memory/2684-385-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2684-64-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2700-345-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2704-142-0x0000000001D80000-0x0000000001DF5000-memory.dmp

Download

memory/2704-336-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2704-13-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2704-292-0x0000000001D80000-0x0000000001DF5000-memory.dmp

Download

memory/2704-165-0x0000000001D80000-0x0000000001DF5000-memory.dmp

Download

memory/2704-293-0x0000000001D80000-0x0000000001DF5000-memory.dmp

Download

memory/2724-232-0x0000000002650000-0x00000000026C5000-memory.dmp

Download

memory/2724-236-0x0000000002650000-0x00000000026C5000-memory.dmp

Download

memory/2724-362-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2724-387-0x0000000002650000-0x00000000026C5000-memory.dmp

Download

memory/2724-37-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2784-199-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2784-324-0x0000000000480000-0x00000000004F5000-memory.dmp

Download

memory/2860-120-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2860-254-0x0000000002450000-0x00000000024C5000-memory.dmp

Download

memory/2860-261-0x0000000002450000-0x00000000024C5000-memory.dmp

Download

memory/2920-248-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3032-294-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3036-177-0x0000000000400000-0x0000000000475000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads