adb9182aed5b64b20d5a7d4c24356e5d07c2b188906edb83a3a4ce6f9b90c68d

Analysis

max time kernel
150s
max time network
126s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
20/01/2025, 09:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

adb9182aed5b64b20d5a7d4c24356e5d07c2b188906edb83a3a4ce6f9b90c68d.exe
Size

468KB
MD5

35f0f2a20fe641dabc5e4b23123a8a56
SHA1

a20577a8ca1f2d14ff954b29402254eda1e576d3
SHA256

adb9182aed5b64b20d5a7d4c24356e5d07c2b188906edb83a3a4ce6f9b90c68d
SHA512

1a9cf531610307c9a7fb35541eba218e08c957c4acdc7543ad1a6e95c13fcc7352387cc2bc8b70637f8b164ebd7fdac21abb525e80bd87c7c962a791dafd9513
SSDEEP

3072:UhZlowsWpq8v6bYPfzzz5fw1lgMoIp4N0HevVsRsbdpKCwq+1lq:UhnoGTv6kf/z5fp0GWsbnpwq+

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2792	Unicorn-50549.exe
3052	Unicorn-36756.exe
1984	Unicorn-57923.exe
2408	Unicorn-16990.exe
984	Unicorn-16990.exe
2788	Unicorn-62661.exe
2520	Unicorn-10859.exe
1964	Unicorn-64130.exe
2232	Unicorn-51281.exe
2456	Unicorn-48680.exe
2312	Unicorn-5344.exe
2356	Unicorn-46642.exe
1940	Unicorn-5609.exe
916	Unicorn-62137.exe
2028	Unicorn-13066.exe
2056	Unicorn-8427.exe
1624	Unicorn-52101.exe
564	Unicorn-54670.exe
960	Unicorn-54670.exe
1492	Unicorn-63030.exe
2596	Unicorn-42676.exe
808	Unicorn-48541.exe
2008	Unicorn-42676.exe
1636	Unicorn-38369.exe
2600	Unicorn-28940.exe
1912	Unicorn-48806.exe
680	Unicorn-46145.exe
1980	Unicorn-55075.exe
1564	Unicorn-14426.exe
1608	Unicorn-26853.exe
2784	Unicorn-32984.exe
2852	Unicorn-13118.exe
2744	Unicorn-25501.exe
2148	Unicorn-24467.exe
1212	Unicorn-30034.exe
1060	Unicorn-54530.exe
2536	Unicorn-2376.exe
2132	Unicorn-21282.exe
2164	Unicorn-21282.exe
3060	Unicorn-24723.exe
2396	Unicorn-18799.exe
2252	Unicorn-48150.exe
2220	Unicorn-64486.exe
3048	Unicorn-64486.exe
2376	Unicorn-59124.exe
1440	Unicorn-41304.exe
2752	Unicorn-44185.exe
2616	Unicorn-64761.exe
856	Unicorn-57148.exe
1736	Unicorn-52892.exe
1724	Unicorn-24881.exe
2020	Unicorn-57553.exe
2072	Unicorn-12991.exe
2068	Unicorn-40131.exe
1988	Unicorn-46261.exe
2248	Unicorn-30479.exe
2796	Unicorn-62597.exe
2224	Unicorn-17215.exe
2756	Unicorn-18257.exe
2864	Unicorn-50153.exe
2308	Unicorn-760.exe
2808	Unicorn-25732.exe
2368	Unicorn-54320.exe
2176	Unicorn-38538.exe

Loads dropped DLL 64 IoCs

pid	Process
2892	adb9182aed5b64b20d5a7d4c24356e5d07c2b188906edb83a3a4ce6f9b90c68d.exe
2892	adb9182aed5b64b20d5a7d4c24356e5d07c2b188906edb83a3a4ce6f9b90c68d.exe
2892	adb9182aed5b64b20d5a7d4c24356e5d07c2b188906edb83a3a4ce6f9b90c68d.exe
2792	Unicorn-50549.exe
2892	adb9182aed5b64b20d5a7d4c24356e5d07c2b188906edb83a3a4ce6f9b90c68d.exe
2792	Unicorn-50549.exe
2792	Unicorn-50549.exe
2792	Unicorn-50549.exe
2892	adb9182aed5b64b20d5a7d4c24356e5d07c2b188906edb83a3a4ce6f9b90c68d.exe
1984	Unicorn-57923.exe
3052	Unicorn-36756.exe
3052	Unicorn-36756.exe
1984	Unicorn-57923.exe
2892	adb9182aed5b64b20d5a7d4c24356e5d07c2b188906edb83a3a4ce6f9b90c68d.exe
984	Unicorn-16990.exe
984	Unicorn-16990.exe
3052	Unicorn-36756.exe
3052	Unicorn-36756.exe
2408	Unicorn-16990.exe
2792	Unicorn-50549.exe
2520	Unicorn-10859.exe
2892	adb9182aed5b64b20d5a7d4c24356e5d07c2b188906edb83a3a4ce6f9b90c68d.exe
2408	Unicorn-16990.exe
2792	Unicorn-50549.exe
2892	adb9182aed5b64b20d5a7d4c24356e5d07c2b188906edb83a3a4ce6f9b90c68d.exe
2520	Unicorn-10859.exe
1984	Unicorn-57923.exe
1984	Unicorn-57923.exe
2788	Unicorn-62661.exe
2788	Unicorn-62661.exe
1964	Unicorn-64130.exe
1964	Unicorn-64130.exe
984	Unicorn-16990.exe
984	Unicorn-16990.exe
1940	Unicorn-5609.exe
2232	Unicorn-51281.exe
1940	Unicorn-5609.exe
2232	Unicorn-51281.exe
2456	Unicorn-48680.exe
2456	Unicorn-48680.exe
3052	Unicorn-36756.exe
3052	Unicorn-36756.exe
1984	Unicorn-57923.exe
1984	Unicorn-57923.exe
2792	Unicorn-50549.exe
2792	Unicorn-50549.exe
2520	Unicorn-10859.exe
2408	Unicorn-16990.exe
916	Unicorn-62137.exe
2408	Unicorn-16990.exe
2520	Unicorn-10859.exe
916	Unicorn-62137.exe
2892	adb9182aed5b64b20d5a7d4c24356e5d07c2b188906edb83a3a4ce6f9b90c68d.exe
2312	Unicorn-5344.exe
2312	Unicorn-5344.exe
2892	adb9182aed5b64b20d5a7d4c24356e5d07c2b188906edb83a3a4ce6f9b90c68d.exe
2028	Unicorn-13066.exe
2028	Unicorn-13066.exe
2788	Unicorn-62661.exe
2788	Unicorn-62661.exe
1964	Unicorn-64130.exe
2056	Unicorn-8427.exe
1964	Unicorn-64130.exe
2056	Unicorn-8427.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3128	1724	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37796.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26992.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46858.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31508.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59483.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32625.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39954.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50907.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48304.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8011.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20301.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50710.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55249.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63228.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48010.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-224.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29744.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54943.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60044.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21009.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7756.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24288.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48010.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30944.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43437.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64480.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3927.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54670.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3077.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42676.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1290.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11907.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13992.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16535.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56683.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53181.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48010.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36675.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55882.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53707.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22982.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44414.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55075.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1842.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8109.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58617.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61346.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51683.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33593.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4308.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34072.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26557.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54943.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29542.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54670.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2892	adb9182aed5b64b20d5a7d4c24356e5d07c2b188906edb83a3a4ce6f9b90c68d.exe
2792	Unicorn-50549.exe
3052	Unicorn-36756.exe
1984	Unicorn-57923.exe
984	Unicorn-16990.exe
2408	Unicorn-16990.exe
2520	Unicorn-10859.exe
2788	Unicorn-62661.exe
1964	Unicorn-64130.exe
2456	Unicorn-48680.exe
2232	Unicorn-51281.exe
2312	Unicorn-5344.exe
1940	Unicorn-5609.exe
2356	Unicorn-46642.exe
916	Unicorn-62137.exe
2028	Unicorn-13066.exe
2056	Unicorn-8427.exe
1624	Unicorn-52101.exe
960	Unicorn-54670.exe
564	Unicorn-54670.exe
808	Unicorn-48541.exe
2596	Unicorn-42676.exe
2600	Unicorn-28940.exe
680	Unicorn-46145.exe
1492	Unicorn-63030.exe
1608	Unicorn-26853.exe
2852	Unicorn-13118.exe
1636	Unicorn-38369.exe
1912	Unicorn-48806.exe
1980	Unicorn-55075.exe
2008	Unicorn-42676.exe
1564	Unicorn-14426.exe
2784	Unicorn-32984.exe
2744	Unicorn-25501.exe
2148	Unicorn-24467.exe
1212	Unicorn-30034.exe
2132	Unicorn-21282.exe
2536	Unicorn-2376.exe
2164	Unicorn-21282.exe
1060	Unicorn-54530.exe
3060	Unicorn-24723.exe
2220	Unicorn-64486.exe
2396	Unicorn-18799.exe
2252	Unicorn-48150.exe
3048	Unicorn-64486.exe
1440	Unicorn-41304.exe
2376	Unicorn-59124.exe
2752	Unicorn-44185.exe
856	Unicorn-57148.exe
1736	Unicorn-52892.exe
2616	Unicorn-64761.exe
1724	Unicorn-24881.exe
2072	Unicorn-12991.exe
2864	Unicorn-50153.exe
2756	Unicorn-18257.exe
2020	Unicorn-57553.exe
2308	Unicorn-760.exe
2808	Unicorn-25732.exe
2248	Unicorn-30479.exe
2068	Unicorn-40131.exe
2224	Unicorn-17215.exe
1988	Unicorn-46261.exe
2796	Unicorn-62597.exe
2176	Unicorn-38538.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2792	2892	adb9182aed5b64b20d5a7d4c24356e5d07c2b188906edb83a3a4ce6f9b90c68d.exe	30
PID 2892 wrote to memory of 2792	2892	adb9182aed5b64b20d5a7d4c24356e5d07c2b188906edb83a3a4ce6f9b90c68d.exe	30
PID 2892 wrote to memory of 2792	2892	adb9182aed5b64b20d5a7d4c24356e5d07c2b188906edb83a3a4ce6f9b90c68d.exe	30
PID 2892 wrote to memory of 2792	2892	adb9182aed5b64b20d5a7d4c24356e5d07c2b188906edb83a3a4ce6f9b90c68d.exe	30
PID 2892 wrote to memory of 1984	2892	adb9182aed5b64b20d5a7d4c24356e5d07c2b188906edb83a3a4ce6f9b90c68d.exe	31
PID 2892 wrote to memory of 1984	2892	adb9182aed5b64b20d5a7d4c24356e5d07c2b188906edb83a3a4ce6f9b90c68d.exe	31
PID 2892 wrote to memory of 1984	2892	adb9182aed5b64b20d5a7d4c24356e5d07c2b188906edb83a3a4ce6f9b90c68d.exe	31
PID 2892 wrote to memory of 1984	2892	adb9182aed5b64b20d5a7d4c24356e5d07c2b188906edb83a3a4ce6f9b90c68d.exe	31
PID 2792 wrote to memory of 3052	2792	Unicorn-50549.exe	32
PID 2792 wrote to memory of 3052	2792	Unicorn-50549.exe	32
PID 2792 wrote to memory of 3052	2792	Unicorn-50549.exe	32
PID 2792 wrote to memory of 3052	2792	Unicorn-50549.exe	32
PID 2792 wrote to memory of 2788	2792	Unicorn-50549.exe	33
PID 2792 wrote to memory of 2788	2792	Unicorn-50549.exe	33
PID 2792 wrote to memory of 2788	2792	Unicorn-50549.exe	33
PID 2792 wrote to memory of 2788	2792	Unicorn-50549.exe	33
PID 3052 wrote to memory of 984	3052	Unicorn-36756.exe	36
PID 3052 wrote to memory of 984	3052	Unicorn-36756.exe	36
PID 3052 wrote to memory of 984	3052	Unicorn-36756.exe	36
PID 3052 wrote to memory of 984	3052	Unicorn-36756.exe	36
PID 1984 wrote to memory of 2408	1984	Unicorn-57923.exe	35
PID 1984 wrote to memory of 2408	1984	Unicorn-57923.exe	35
PID 1984 wrote to memory of 2408	1984	Unicorn-57923.exe	35
PID 1984 wrote to memory of 2408	1984	Unicorn-57923.exe	35
PID 2892 wrote to memory of 2520	2892	adb9182aed5b64b20d5a7d4c24356e5d07c2b188906edb83a3a4ce6f9b90c68d.exe	34
PID 2892 wrote to memory of 2520	2892	adb9182aed5b64b20d5a7d4c24356e5d07c2b188906edb83a3a4ce6f9b90c68d.exe	34
PID 2892 wrote to memory of 2520	2892	adb9182aed5b64b20d5a7d4c24356e5d07c2b188906edb83a3a4ce6f9b90c68d.exe	34
PID 2892 wrote to memory of 2520	2892	adb9182aed5b64b20d5a7d4c24356e5d07c2b188906edb83a3a4ce6f9b90c68d.exe	34
PID 984 wrote to memory of 1964	984	Unicorn-16990.exe	37
PID 984 wrote to memory of 1964	984	Unicorn-16990.exe	37
PID 984 wrote to memory of 1964	984	Unicorn-16990.exe	37
PID 984 wrote to memory of 1964	984	Unicorn-16990.exe	37
PID 3052 wrote to memory of 2232	3052	Unicorn-36756.exe	38
PID 3052 wrote to memory of 2232	3052	Unicorn-36756.exe	38
PID 3052 wrote to memory of 2232	3052	Unicorn-36756.exe	38
PID 3052 wrote to memory of 2232	3052	Unicorn-36756.exe	38
PID 2408 wrote to memory of 2356	2408	Unicorn-16990.exe	39
PID 2408 wrote to memory of 2356	2408	Unicorn-16990.exe	39
PID 2408 wrote to memory of 2356	2408	Unicorn-16990.exe	39
PID 2408 wrote to memory of 2356	2408	Unicorn-16990.exe	39
PID 2792 wrote to memory of 2456	2792	Unicorn-50549.exe	40
PID 2792 wrote to memory of 2456	2792	Unicorn-50549.exe	40
PID 2792 wrote to memory of 2456	2792	Unicorn-50549.exe	40
PID 2792 wrote to memory of 2456	2792	Unicorn-50549.exe	40
PID 2892 wrote to memory of 2312	2892	adb9182aed5b64b20d5a7d4c24356e5d07c2b188906edb83a3a4ce6f9b90c68d.exe	42
PID 2892 wrote to memory of 2312	2892	adb9182aed5b64b20d5a7d4c24356e5d07c2b188906edb83a3a4ce6f9b90c68d.exe	42
PID 2892 wrote to memory of 2312	2892	adb9182aed5b64b20d5a7d4c24356e5d07c2b188906edb83a3a4ce6f9b90c68d.exe	42
PID 2892 wrote to memory of 2312	2892	adb9182aed5b64b20d5a7d4c24356e5d07c2b188906edb83a3a4ce6f9b90c68d.exe	42
PID 2520 wrote to memory of 1940	2520	Unicorn-10859.exe	41
PID 2520 wrote to memory of 1940	2520	Unicorn-10859.exe	41
PID 2520 wrote to memory of 1940	2520	Unicorn-10859.exe	41
PID 2520 wrote to memory of 1940	2520	Unicorn-10859.exe	41
PID 1984 wrote to memory of 916	1984	Unicorn-57923.exe	43
PID 1984 wrote to memory of 916	1984	Unicorn-57923.exe	43
PID 1984 wrote to memory of 916	1984	Unicorn-57923.exe	43
PID 1984 wrote to memory of 916	1984	Unicorn-57923.exe	43
PID 2788 wrote to memory of 2028	2788	Unicorn-62661.exe	44
PID 2788 wrote to memory of 2028	2788	Unicorn-62661.exe	44
PID 2788 wrote to memory of 2028	2788	Unicorn-62661.exe	44
PID 2788 wrote to memory of 2028	2788	Unicorn-62661.exe	44
PID 1964 wrote to memory of 2056	1964	Unicorn-64130.exe	45
PID 1964 wrote to memory of 2056	1964	Unicorn-64130.exe	45
PID 1964 wrote to memory of 2056	1964	Unicorn-64130.exe	45
PID 1964 wrote to memory of 2056	1964	Unicorn-64130.exe	45

C:\Users\Admin\AppData\Local\Temp\adb9182aed5b64b20d5a7d4c24356e5d07c2b188906edb83a3a4ce6f9b90c68d.exe
"C:\Users\Admin\AppData\Local\Temp\adb9182aed5b64b20d5a7d4c24356e5d07c2b188906edb83a3a4ce6f9b90c68d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50549.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50549.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36756.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36756.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16990.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64130.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8427.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32984.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64486.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5929.exe
        9⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7756.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7161.exe
        9⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33593.exe
        9⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4730.exe
        8⤵
        
        PID:236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6815.exe
        8⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56683.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13290.exe
        8⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29542.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41304.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27056.exe
        8⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10143.exe
        8⤵
        
        PID:828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10752.exe
        8⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29509.exe
        8⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3447.exe
        7⤵
        
        PID:1352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
        7⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35584.exe
        8⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27727.exe
        8⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21078.exe
        7⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7753.exe
        7⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25458.exe
        7⤵
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13118.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37796.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59109.exe
        8⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64474.exe
        8⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44414.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4024.exe
        8⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23878.exe
        7⤵
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28870.exe
        7⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24927.exe
        7⤵
        
        PID:4684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37796.exe
        6⤵
        
        PID:2732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27590.exe
        6⤵
        
        PID:2380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33003.exe
        6⤵
        
        PID:3932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29514.exe
        6⤵
        
        PID:3816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21201.exe
        6⤵
        
        PID:5028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16101.exe
        6⤵
        
        PID:6076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52101.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25501.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41684.exe
        7⤵
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55249.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26504.exe
        8⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13992.exe
        8⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53707.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exe
        7⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30752.exe
        7⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25458.exe
        7⤵
        
        PID:2236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62659.exe
        6⤵
        
        PID:696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64397.exe
        7⤵
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36675.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24936.exe
        6⤵
        
        PID:940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63931.exe
        6⤵
        
        PID:2292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53181.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30403.exe
        6⤵
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19002.exe
        6⤵
        
        PID:5348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30034.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38368.exe
        6⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58216.exe
        7⤵
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5824.exe
        7⤵
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11907.exe
        6⤵
        
        PID:2960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15144.exe
        6⤵
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42539.exe
        7⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5632.exe
        7⤵
        
        PID:4996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exe
        6⤵
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30752.exe
        6⤵
        
        PID:4248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17097.exe
        6⤵
        
        PID:4200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21574.exe
        5⤵
        
        PID:304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22842.exe
        5⤵
        
        PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61346.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21608.exe
        5⤵
        
        PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20952.exe
        5⤵
        
        PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59969.exe
        5⤵
        
        PID:4208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51281.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54670.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54530.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46261.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55249.exe
        7⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55284.exe
        8⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9908.exe
        8⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8974.exe
        7⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2466.exe
        8⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28900.exe
        8⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exe
        7⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30752.exe
        7⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25458.exe
        7⤵
        
        PID:5048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30479.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30242.exe
        7⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28176.exe
        7⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3077.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37677.exe
        7⤵
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3447.exe
        6⤵
        
        PID:2948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2478.exe
        6⤵
        
        PID:2424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53181.exe
        6⤵
        
        PID:3796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18151.exe
        6⤵
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19002.exe
        6⤵
        
        PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2376.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57553.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45748.exe
        7⤵
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32625.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33593.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55249.exe
        6⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59451.exe
        7⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28900.exe
        7⤵
        
        PID:6044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37262.exe
        6⤵
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exe
        6⤵
        
        PID:1296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30752.exe
        6⤵
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17352.exe
        6⤵
        
        PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40131.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25690.exe
        6⤵
        
        PID:4328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9312.exe
        5⤵
        
        PID:2932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54991.exe
        5⤵
        
        PID:896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4543.exe
        5⤵
        
        PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26287.exe
        5⤵
        
        PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64129.exe
        5⤵
        
        PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42676.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62597.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55249.exe
        5⤵
        
        PID:2508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61581.exe
        6⤵
        
        PID:3776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49488.exe
        6⤵
        
        PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22982.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53828.exe
        6⤵
        
        PID:3660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52030.exe
        6⤵
        
        PID:4848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27727.exe
        6⤵
        
        PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9826.exe
        5⤵
        
        PID:4048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10869.exe
        5⤵
        
        PID:4752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61103.exe
        5⤵
        
        PID:4652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17215.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16883.exe
        5⤵
        
        PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59109.exe
        5⤵
        
        PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64474.exe
        5⤵
        
        PID:5808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-647.exe
      4⤵
      PID:1860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35690.exe
        5⤵
        
        PID:5756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14335.exe
      4⤵
      PID:1960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21608.exe
      4⤵
      PID:3944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52488.exe
      4⤵
      PID:3888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55960.exe
      4⤵
      PID:4748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62661.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62661.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13066.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14426.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24881.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1724
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 200
        7⤵
        Program crash
        
        PID:3128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55249.exe
        6⤵
        
        PID:108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37838.exe
        6⤵
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20204.exe
        6⤵
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-224.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12991.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11254.exe
        6⤵
        
        PID:3604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8455.exe
        6⤵
        
        PID:5128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3447.exe
        5⤵
        
        PID:1040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45748.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32625.exe
        6⤵
        
        PID:3708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33593.exe
        6⤵
        
        PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6178.exe
        5⤵
        
        PID:1600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21078.exe
        5⤵
        
        PID:3192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34563.exe
        6⤵
        
        PID:4484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59109.exe
        6⤵
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64474.exe
        6⤵
        
        PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9097.exe
        5⤵
        
        PID:4432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46324.exe
        5⤵
        
        PID:5868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26853.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54320.exe
        5⤵
        Executes dropped EXE
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9577.exe
        6⤵
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60776.exe
        6⤵
        
        PID:2096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23878.exe
        6⤵
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6447.exe
        6⤵
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55603.exe
        6⤵
        
        PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25642.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36978.exe
        5⤵
        
        PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54943.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48010.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3927.exe
        5⤵
        
        PID:288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20998.exe
      4⤵
      PID:1256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-647.exe
      4⤵
      PID:1776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18419.exe
      4⤵
      PID:2804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21608.exe
      4⤵
      PID:2676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3288.exe
      4⤵
      PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20301.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48680.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48680.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63030.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-760.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25642.exe
        5⤵
        
        PID:756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36978.exe
        5⤵
        
        PID:3136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54943.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48010.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3927.exe
        5⤵
        
        PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38538.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4367.exe
        5⤵
        
        PID:2076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58617.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47583.exe
        6⤵
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18076.exe
        6⤵
        
        PID:4572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21491.exe
        5⤵
        
        PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13026.exe
        5⤵
        
        PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24927.exe
        5⤵
        
        PID:3084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3447.exe
      4⤵
      PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63656.exe
      4⤵
      PID:2592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21078.exe
      4⤵
      PID:3184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7753.exe
      4⤵
      PID:4236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54046.exe
      4⤵
      PID:4172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48541.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48541.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21282.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63303.exe
        5⤵
        
        PID:1240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11907.exe
        5⤵
        
        PID:2016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29474.exe
        6⤵
        
        PID:1804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59483.exe
        6⤵
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38491.exe
        6⤵
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24927.exe
        6⤵
        
        PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6815.exe
        5⤵
        
        PID:1504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56683.exe
        5⤵
        
        PID:3828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13290.exe
        5⤵
        
        PID:3420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34072.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43437.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25642.exe
      4⤵
      PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36978.exe
      4⤵
      PID:3108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54943.exe
      4⤵
      PID:3656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48010.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3927.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18799.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18799.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27014.exe
      4⤵
      PID:2608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22971.exe
        5⤵
        
        PID:5916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62618.exe
      4⤵
      PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16535.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29635.exe
      4⤵
      PID:3384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17547.exe
      4⤵
      PID:4284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8392.exe
      4⤵
      PID:4696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51683.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51683.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38647.exe
      4⤵
      PID:4496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58424.exe
      4⤵
      PID:5328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63367.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63367.exe
    3⤵
    PID:2024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63228.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63228.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43562.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43562.exe
    3⤵
    PID:3520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64245.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64245.exe
    3⤵
    PID:4128
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57923.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57923.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16990.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16990.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46642.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24467.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50153.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51378.exe
        7⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36437.exe
        7⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42648.exe
        8⤵
        
        PID:3812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13992.exe
        8⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23878.exe
        7⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16617.exe
        7⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29011.exe
        7⤵
        
        PID:4940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55249.exe
        6⤵
        
        PID:1328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41364.exe
        6⤵
        
        PID:3904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5010.exe
        6⤵
        
        PID:3768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8949.exe
        6⤵
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3927.exe
        6⤵
        
        PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18257.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9312.exe
        5⤵
        
        PID:2604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61581.exe
        6⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40468.exe
        6⤵
        
        PID:4920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48138.exe
        6⤵
        
        PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50907.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4543.exe
        5⤵
        
        PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26287.exe
        5⤵
        
        PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2676.exe
        5⤵
        
        PID:4932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38369.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64486.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41534.exe
        6⤵
        
        PID:2428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59483.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38491.exe
        6⤵
        
        PID:2736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24927.exe
        6⤵
        
        PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21066.exe
        5⤵
        
        PID:1572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6815.exe
        5⤵
        
        PID:2528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27357.exe
        5⤵
        
        PID:3404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-277.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4308.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59124.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52093.exe
        5⤵
        
        PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24423.exe
        5⤵
        
        PID:5936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9312.exe
      4⤵
      PID:2992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1597.exe
      4⤵
      PID:2360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4543.exe
      4⤵
      PID:3912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8482.exe
      4⤵
      PID:3592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32515.exe
      4⤵
      PID:4844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62137.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62137.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48806.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4543.exe
        5⤵
        
        PID:1868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27620.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8481.exe
        5⤵
        
        PID:1676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exe
        5⤵
        
        PID:3232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46245.exe
        5⤵
        
        PID:4320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26631.exe
        5⤵
        
        PID:6020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10526.exe
      4⤵
      PID:1120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25642.exe
      4⤵
      PID:1312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12795.exe
        5⤵
        
        PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23249.exe
        5⤵
        
        PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19559.exe
        5⤵
        
        PID:4056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36978.exe
      4⤵
      PID:3096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54943.exe
      4⤵
      PID:3716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48010.exe
      4⤵
      PID:4408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8011.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42676.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42676.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27622.exe
        5⤵
        
        PID:3140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54879.exe
        5⤵
        
        PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43126.exe
        5⤵
        
        PID:5924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4730.exe
      4⤵
      PID:1652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6815.exe
      4⤵
      PID:1816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56683.exe
      4⤵
      PID:3844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13290.exe
      4⤵
      PID:3596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21373.exe
      4⤵
      PID:5064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44185.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44185.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47969.exe
      4⤵
      PID:2552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10143.exe
      4⤵
      PID:2124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10752.exe
      4⤵
      PID:3600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25425.exe
      4⤵
      PID:2388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-647.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-647.exe
    3⤵
    PID:1820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63260.exe
      4⤵
      PID:3960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13992.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59535.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59535.exe
    3⤵
    PID:3120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1973.exe
      4⤵
      PID:4160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41319.exe
      4⤵
      PID:4604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21608.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21608.exe
    3⤵
    PID:4060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3288.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3288.exe
    3⤵
    PID:4276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60044.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60044.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4168
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10859.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10859.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5609.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5609.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54670.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25732.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63303.exe
        6⤵
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11907.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45644.exe
        6⤵
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5941.exe
        6⤵
        
        PID:3756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30944.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25458.exe
        6⤵
        
        PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26992.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13758.exe
        6⤵
        
        PID:4548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63193.exe
        6⤵
        
        PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51491.exe
        5⤵
        
        PID:2420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37346.exe
        5⤵
        
        PID:3736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9826.exe
        5⤵
        
        PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51108.exe
        5⤵
        
        PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23202.exe
        5⤵
        
        PID:5716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54683.exe
      4⤵
      PID:332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48304.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31811.exe
        5⤵
        
        PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31508.exe
      4⤵
      PID:2372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12344.exe
      4⤵
      PID:3640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4543.exe
      4⤵
      PID:3952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24818.exe
      4⤵
      PID:4296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65380.exe
      4⤵
      PID:4388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28940.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28940.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21282.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64761.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4985.exe
        6⤵
        
        PID:3964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39006.exe
        6⤵
        
        PID:3992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45236.exe
        6⤵
        
        PID:5096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29509.exe
        6⤵
        
        PID:4192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55249.exe
        5⤵
        
        PID:880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22845.exe
        5⤵
        
        PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exe
        5⤵
        
        PID:3324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24288.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12476.exe
        5⤵
        
        PID:4392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57148.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30392.exe
        5⤵
        
        PID:1812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11907.exe
        5⤵
        
        PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5872.exe
        5⤵
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59226.exe
        5⤵
        
        PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4904.exe
        5⤵
        
        PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50200.exe
        5⤵
        
        PID:5888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24069.exe
      4⤵
      PID:1704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31508.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46208.exe
      4⤵
      PID:2240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6471.exe
      4⤵
      PID:3688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26479.exe
      4⤵
      PID:4412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64129.exe
      4⤵
      PID:2556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24723.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24723.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1741.exe
      4⤵
      PID:2588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4782.exe
      4⤵
      PID:2640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8109.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1290.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20840.exe
        5⤵
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29509.exe
        5⤵
        
        PID:4136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6400.exe
      4⤵
      PID:3800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53947.exe
      4⤵
      PID:3436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1704.exe
      4⤵
      PID:4724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4308.exe
      4⤵
      PID:4556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26557.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26557.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34179.exe
      4⤵
      PID:4624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61957.exe
      4⤵
      PID:5740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3740.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3740.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49415.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49415.exe
    3⤵
    PID:4032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21499.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21499.exe
    3⤵
    PID:3480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62084.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62084.exe
    3⤵
    PID:4196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49081.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49081.exe
    3⤵
    PID:5980
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5344.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5344.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55075.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55075.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30200.exe
      4⤵
      PID:1632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41688.exe
        5⤵
        
        PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57873.exe
        5⤵
        
        PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11907.exe
      4⤵
      PID:2316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15144.exe
      4⤵
      PID:3700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exe
      4⤵
      PID:3220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1128.exe
      4⤵
      PID:4420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-224.exe
      4⤵
      PID:4164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30562.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30562.exe
    3⤵
    PID:2984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29158.exe
      4⤵
      PID:3624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58963.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2285.exe
      4⤵
      PID:5780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25642.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25642.exe
    3⤵
    PID:2452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21009.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21009.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9826.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9826.exe
    3⤵
    PID:4052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51108.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51108.exe
    3⤵
    PID:4960
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46145.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46145.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37962.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37962.exe
    3⤵
    PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14910.exe
      4⤵
      PID:4676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9908.exe
      4⤵
      PID:4352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41356.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41356.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6178.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6178.exe
    3⤵
    PID:876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9826.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9826.exe
    3⤵
    PID:3984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55882.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55882.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55576.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55576.exe
    3⤵
    PID:4984
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52892.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52892.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46858.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46858.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59809.exe
      4⤵
      PID:5040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41319.exe
      4⤵
      PID:4868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11907.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11907.exe
    3⤵
    PID:2152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11254.exe
      4⤵
      PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64750.exe
      4⤵
      PID:5708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15144.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15144.exe
    3⤵
    PID:3680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exe
    3⤵
    PID:3196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30752.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30752.exe
    3⤵
    PID:4644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25458.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25458.exe
    3⤵
    PID:4824
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50710.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50710.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2740
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1842.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1842.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2584
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51545.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51545.exe
  2⤵
  PID:3672
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64480.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64480.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3156
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39954.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39954.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4288
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18308.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18308.exe
  2⤵
  PID:4860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10859.exe

Filesize
468KB

MD5
734ade06b56230f3dbd5d58d16a8dd99

SHA1
fddcdfff4e633259bc8e2bbcd3e637a73691004d

SHA256
6f1bedf099023ee384b251af6f18919c24cd7caf97b2daa36e7e55792364da13

SHA512
af03e6b3415ba516eae815b3346f1b202b2a825cec5739110e3a5fa8a3433a03482f69a5a67a1852c4397284980c93d48b8345fd1f76bcbf398743495ce98d9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16990.exe

Filesize
468KB

MD5
7a8656596f5d7e71efe882499e1fd91b

SHA1
b792823e8374d8ba8fa4b0b2c60a6cc6a6bd6066

SHA256
b1940f63c9c5b7319317855b28df1f01aea57ad25d68f5b5eb863dcbdd147592

SHA512
0b656b8193df7b85f2f5d378434db0607848db7766a8abafea0e2c30fa7a63f24ab25e3e0d11baa0b89950b27cf6e2acb6ada55c9aa550f48ff16d93891735ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1741.exe

Filesize
468KB

MD5
80c160bbd44812e53ecf504a6c685e00

SHA1
a0ce83f635e9b84d13bf44ff95453193acec5749

SHA256
e929535791744ee996592ac8e4eb940c97d53529e5ba4d5f16a21a7a1f67556d

SHA512
11c439850a74d43b227aa5a3f12449a9262dab8e7740b51252ef7ce3d664673600b05cadee95b50a832a905ce73d18d96351df459b5470a8615d912d3954935d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36756.exe

Filesize
468KB

MD5
2f7869e680d46e5a19ff4d5bf9cfc2d1

SHA1
5d86b3d88f6d7335d4a3f3c860a26e5fbc032281

SHA256
d84741d3144329fea32ba7bde5e10ebec1476fe117ba387ed94f17d39d970e56

SHA512
a02926ed65185345109feae5b3150d9e1de922ce98351eed5ba3c7f064887df2cf52e0c5340307763b4678530247e976cf114bcae77d316c6c5e5fa96aeb3836

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62137.exe

Filesize
468KB

MD5
05d5d3c62657a98f8a06b8bdd660a4cc

SHA1
5ec642686e8b8aba648e214f696d0ca14db4eff6

SHA256
e6eef924f49fe724e163280fe8842c72fd331034365a064551ae721e9c91b950

SHA512
1599f153c1ae6a44374b911a87ed30867fd8cf10b2f666111be386c91f48b3ba29ea0c7872b9c69fe9601015eb3b1c80131b2af9f29ed7676027d3b35034823b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9097.exe

Filesize
468KB

MD5
a727f920c7b92c9c4dd2349262504344

SHA1
0e073494adc0ed8ea4fc30a0e570a51c5caf1699

SHA256
7d8aa16e209576da51644c3077a517abed61ee0b3be33a8f21926acee1232c3f

SHA512
56283bff2a53d2444fef28347f9594863bef82c79e71f0fd7b135fb9638e4a58785c7413a0837395078034f23f52e8e7ec714c2ec8a176a7cd290807bf2fe0d9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13066.exe

Filesize
468KB

MD5
46cdb31c6d382c1a3115de9be619050c

SHA1
c8ee69976a4f9cb150a2a2a4dabe5ef397423208

SHA256
89975762194b0d68515b764d6089fdc63fb50d363609cd5775ab1a22071de188

SHA512
bc10adcbabe9d16dba1fb1ea6818c701a860cf57c37c1603a1ab079856fccc45473acd27979a2d877d817b6fbfd83641f639ee3e1433caa1705077c72b1d0ebf

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46642.exe

Filesize
468KB

MD5
424651eaeb82197ee4d20d8ae0cb59bb

SHA1
04c9557f6d3f98307b2907aade78cfe70598fa23

SHA256
7a8550cc8dc630e5661fafeb2bdfbb664b4fca43634a3af596b9b73d4e1d34c9

SHA512
3f7cc19f102bf09128a11e011b6297d9462b2a80a8e3440af7df376e3cc630b749a2d27fcf4265a7467246a34e1195e0228a04ee080d28a3ca9e47c8578ba0f5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-48680.exe

Filesize
468KB

MD5
0ce20395ff612a0e8e5d04a2547caf15

SHA1
1e99c16ff4e7ebcd4f21e1721222fe4614209e82

SHA256
477f126bc3bd19f198213eb6faa63bbd32b2421cef7b3db64a72b62fce4926be

SHA512
6de3ce8c03b9d21b8525895bf58a5d6dc933e8133052d4057d99a7b5fe32419f2e3588f2e57d1116af955b0f5257031f5be9936b0ade0442659f5a7f04550b44

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-50549.exe

Filesize
468KB

MD5
2aebaf25a5682122e816f17b01220783

SHA1
ef8123ec11a7bb0e7a447ade409b8259d0607cab

SHA256
eaf20ac2936b0c664054cd28e92d36c612c0f8196e0c3828a63109713a5f7a09

SHA512
b2bf2db5c1cd854c485571f6dff01e8c8e39ffa9cdf77deebc5704d3330c4297eca1eec3658742cafc432078de491cc71c5a985478aa0f6f7be641383abdeea1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51281.exe

Filesize
468KB

MD5
d583393e309d314a0da77aaeeeea8e5a

SHA1
614b75cfadc51168ca079f2e8dac6837819621c2

SHA256
593b9ab10453f93e16d13c0f77c7a202bd7ff9b1980c81fc2c7f7b17b7000ca4

SHA512
4700b3f30d83f7bc30f0ecd5633ef80a176f36b5dd6623dc92543e387771d7d4f3d12f6345038a6a2f02afee3e4c3ac40fa55f7d894ecda8e9007b2b3a1ad1f7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52101.exe

Filesize
468KB

MD5
512c777338df276d6109fb3c545fa7d5

SHA1
34876444650c66d88ef48a36f7c0d7796e26d709

SHA256
6eb2eb829f64aff34724d2adeaef4d9f697ab10054200ec1d3a3a49191ff702e

SHA512
a85fbb50572482769f141cef8c31e495b32a08cf6a71a4bd5018e8d9096f4547c23fa7fab50b936cf82ddee77c1eab6a46028c0afb5f0be2e9024c86d43b4eb3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-5344.exe

Filesize
468KB

MD5
428101f409886e35f286e7de7dadaf8a

SHA1
c40f871ba3326acc30db4490db71c62816ec8bd0

SHA256
bdf79a8b7c6964ee6ec16094577827cfa68eafeb542e3251d12468c2150c9679

SHA512
c511a50461121fd48d097d4a15fd50525939fd89d800e631d5e8b59e4d2554f74571218c81616fe77c6ad82bba165845479b487c339b4537965dc79ddb4220ee

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54670.exe

Filesize
468KB

MD5
cbef156ed94f1b655d9e5e08b632e3a5

SHA1
4f26859aa991d8389dedf21d7f3850cdf322e612

SHA256
8b4946845a6c1248bb24accbaa5b73ef59815fa5e2373acb402d5cb3522ff4f7

SHA512
d264c95cc5760323299ee6f5adfde68ac983e001eb8dd016a11ea25d8468a09fb30b4c953acf12501118ed4ceb0919cc33e25451a886c3a7d3a6d5e795cb10ed

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-5609.exe

Filesize
468KB

MD5
a0ab2dac83d4391b8bfe4d1e37c3bc01

SHA1
b03ec758a97baa0b65431bdde3b81567521ad524

SHA256
bbf1ccb8d4d968cd0122fa37a799b9a5c60e0a0157f23b3e688f0f251e971036

SHA512
2334028a2e2f60434940287cab2ba8cb556d9c72f31c0b9e269fd3ad749c0636141d9a43286701b8c60486ae6f7d368f455910661b9881d91fa0b0932910696b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57923.exe

Filesize
468KB

MD5
a435d9ce11631f254230e21fabb21d9f

SHA1
cbfd339382e58fb3ffaf40fd8c2f2ec4bde00c01

SHA256
c1e91d6fda1408e347946bf2b7e214250e6b02fb9ce9dc29158a9586565caf44

SHA512
2f9d04a32bdabaf24d89880b0ffd31f81cf1eac326e2321397dd2619b9a81c7ce45519b4f661e3747b60f9741889744f75f6ea2ae57dadbfd4b2f06fa7cc991e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62661.exe

Filesize
468KB

MD5
0d4bc6025ca784f4cde9d507a9f93b2c

SHA1
b033cf5162cc2dfc68099a5213d0447e0b4f598a

SHA256
fba6f749267ffadc43ecf43e7b733df933101062f6811f3cee20a6c70e9b3855

SHA512
23b91875a4b81e12bbc4e239e6bfd0527158c6f9b5d1e9a07c87901e5d6899bcadd695f6c407c1c78cf17330cfff1445d42c4d4cbb041f9e7798187d63354ad7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64130.exe

Filesize
468KB

MD5
c8c93b1cca207134240fe18b8ac3dd00

SHA1
723f3d25485eadba7b9ce77b64e6cdcb39a6be82

SHA256
0cf2edfb25c87228a8f6bf8619170debfaf5b92734b80eafc76185eb21e054bf

SHA512
dc3b47df8dc8f4ca8f6866094406c00374546ed18ddca7b767dbe9ff7fc0e1173e11a98e6d96e074b46a2de599dc2d5aa978b696d149c64fb1e4715377958eb1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8427.exe

Filesize
468KB

MD5
e35edeac120a0d03d8bc99432260e6ef

SHA1
de129d1040b01769046b8c2de8caa0416515c955

SHA256
2e941ddb771451ff5f3d97fc38a6841b5c3f64deaa523f3098ddf5221b53cb43

SHA512
9a5af2faca7ba7885cbee84ba306a285500c7886880501d731ac9d7c81ac87aa462e6d8a6be899c2ced058ed109a41b18101b5ad615b64dcbc2408269115685c

Download Submit
memory/564-218-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/680-284-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/808-242-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/916-266-0x00000000028A0000-0x0000000002915000-memory.dmp

Filesize
468KB

Download
memory/916-252-0x00000000028A0000-0x0000000002915000-memory.dmp

Filesize
468KB

Download
memory/916-155-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/960-381-0x0000000002720000-0x0000000002795000-memory.dmp

Filesize
468KB

Download
memory/960-380-0x0000000002720000-0x0000000002795000-memory.dmp

Filesize
468KB

Download
memory/984-203-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/984-198-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/984-365-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/984-368-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/984-85-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/1060-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1212-372-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1492-230-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1564-297-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1608-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1624-205-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1624-350-0x0000000000330000-0x00000000003A5000-memory.dmp

Filesize
468KB

Download
memory/1624-346-0x0000000000330000-0x00000000003A5000-memory.dmp

Filesize
468KB

Download
memory/1636-267-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1912-269-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1940-214-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/1940-153-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1940-216-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/1964-316-0x0000000000560000-0x00000000005D5000-memory.dmp

Filesize
468KB

Download
memory/1964-190-0x0000000000560000-0x00000000005D5000-memory.dmp

Filesize
468KB

Download
memory/1964-327-0x0000000000560000-0x00000000005D5000-memory.dmp

Filesize
468KB

Download
memory/1964-191-0x0000000000560000-0x00000000005D5000-memory.dmp

Filesize
468KB

Download
memory/1964-87-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1980-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1984-149-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1984-237-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1984-236-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1984-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1984-144-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1984-34-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2028-296-0x00000000025B0000-0x0000000002625000-memory.dmp

Filesize
468KB

Download
memory/2028-295-0x00000000025B0000-0x0000000002625000-memory.dmp

Filesize
468KB

Download
memory/2028-179-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2056-192-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2148-366-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2232-107-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2232-391-0x00000000028F0000-0x0000000002965000-memory.dmp

Filesize
468KB

Download
memory/2232-389-0x00000000028F0000-0x0000000002965000-memory.dmp

Filesize
468KB

Download
memory/2232-215-0x0000000003420000-0x0000000003495000-memory.dmp

Filesize
468KB

Download
memory/2312-282-0x00000000025B0000-0x0000000002625000-memory.dmp

Filesize
468KB

Download
memory/2312-141-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2312-280-0x00000000025B0000-0x0000000002625000-memory.dmp

Filesize
468KB

Download
memory/2356-364-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2356-151-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2356-359-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2408-110-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/2408-264-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/2408-250-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/2408-65-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2456-129-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2456-229-0x0000000003210000-0x0000000003285000-memory.dmp

Filesize
468KB

Download
memory/2456-220-0x0000000003210000-0x0000000003285000-memory.dmp

Filesize
468KB

Download
memory/2520-139-0x0000000002750000-0x00000000027C5000-memory.dmp

Filesize
468KB

Download
memory/2520-265-0x0000000002750000-0x00000000027C5000-memory.dmp

Filesize
468KB

Download
memory/2520-69-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2520-248-0x0000000002750000-0x00000000027C5000-memory.dmp

Filesize
468KB

Download
memory/2536-390-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2596-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2600-395-0x0000000002380000-0x00000000023F5000-memory.dmp

Filesize
468KB

Download
memory/2600-268-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2744-352-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2784-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2788-180-0x00000000026F0000-0x0000000002765000-memory.dmp

Filesize
468KB

Download
memory/2788-317-0x00000000026F0000-0x0000000002765000-memory.dmp

Filesize
468KB

Download
memory/2788-315-0x00000000026F0000-0x0000000002765000-memory.dmp

Filesize
468KB

Download
memory/2788-178-0x00000000026F0000-0x0000000002765000-memory.dmp

Filesize
468KB

Download
memory/2788-67-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2792-320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2792-113-0x0000000000840000-0x00000000008B5000-memory.dmp

Filesize
468KB

Download
memory/2792-238-0x0000000000840000-0x00000000008B5000-memory.dmp

Filesize
468KB

Download
memory/2792-51-0x0000000000840000-0x00000000008B5000-memory.dmp

Filesize
468KB

Download
memory/2792-239-0x0000000000840000-0x00000000008B5000-memory.dmp

Filesize
468KB

Download
memory/2852-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2892-138-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2892-118-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2892-283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2892-271-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2892-10-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2892-281-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2892-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2892-30-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2892-11-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2892-351-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3052-367-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3052-240-0x0000000001D60000-0x0000000001DD5000-memory.dmp

Filesize
468KB

Download
memory/3052-241-0x0000000001D60000-0x0000000001DD5000-memory.dmp

Filesize
468KB

Download
memory/3052-32-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3052-105-0x0000000001D60000-0x0000000001DD5000-memory.dmp

Filesize
468KB

Download