0937c1da81b4cfed4c6b49db1addcf5ede8095eae8585ededafdb330108ec1bc

Analysis

max time kernel
119s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 20:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54b744285a414d87e9619a714eb66f00N.exe
Size

468KB
MD5

54b744285a414d87e9619a714eb66f00
SHA1

26f104c4c4b0bf8fbfd2d0ea276aadcd5bbe05bf
SHA256

0937c1da81b4cfed4c6b49db1addcf5ede8095eae8585ededafdb330108ec1bc
SHA512

6459656043acae7f82912c8b63a61fc4af77a4fa89a937d9e6f1fcb6e68ce5676fd3c66ee0b88aeebda258ea786e21bcb29d740bae7d9d3aace43501f64ef803
SSDEEP

3072:08ACog5dPp8UI70bPzijkx8/9CbCT4pCndHeiVoUnqBJJea2RNl6:081om6UIUPejkxOEBEnq3Ea2R

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2844	Unicorn-31637.exe
2320	Unicorn-62254.exe
2612	Unicorn-46473.exe
2588	Unicorn-36427.exe
2132	Unicorn-40511.exe
2800	Unicorn-10339.exe
2560	Unicorn-11822.exe
2040	Unicorn-56930.exe
1280	Unicorn-60692.exe
1152	Unicorn-58061.exe
2752	Unicorn-24733.exe
1200	Unicorn-12389.exe
1960	Unicorn-137.exe
1336	Unicorn-34683.exe
1944	Unicorn-8305.exe
2468	Unicorn-64112.exe
1784	Unicorn-9357.exe
2160	Unicorn-15487.exe
1408	Unicorn-48715.exe
1500	Unicorn-39307.exe
2360	Unicorn-3105.exe
1708	Unicorn-22971.exe
2376	Unicorn-19463.exe
2412	Unicorn-23547.exe
2408	Unicorn-65134.exe
1732	Unicorn-48143.exe
2860	Unicorn-2477.exe
2488	Unicorn-59349.exe
1572	Unicorn-2742.exe
1568	Unicorn-2742.exe
2172	Unicorn-48414.exe
2616	Unicorn-31907.exe
2736	Unicorn-12041.exe
2496	Unicorn-21601.exe
1644	Unicorn-14563.exe
1020	Unicorn-34429.exe
2292	Unicorn-27942.exe
2532	Unicorn-54849.exe
3060	Unicorn-26736.exe
2900	Unicorn-30729.exe
1052	Unicorn-29145.exe
2216	Unicorn-37335.exe
2992	Unicorn-55103.exe
1716	Unicorn-63640.exe
2104	Unicorn-6826.exe
1292	Unicorn-49.exe
1092	Unicorn-22507.exe
1656	Unicorn-28638.exe
604	Unicorn-38128.exe
1616	Unicorn-41466.exe
572	Unicorn-41466.exe
2348	Unicorn-15378.exe
1040	Unicorn-6463.exe
2344	Unicorn-63070.exe
1972	Unicorn-43967.exe
2780	Unicorn-33682.exe
2832	Unicorn-33682.exe
2640	Unicorn-3951.exe
3040	Unicorn-49888.exe
2596	Unicorn-63623.exe
2696	Unicorn-49888.exe
1724	Unicorn-4216.exe
2232	Unicorn-4216.exe
2928	Unicorn-60115.exe

Loads dropped DLL 64 IoCs

pid	Process
2704	54b744285a414d87e9619a714eb66f00N.exe
2704	54b744285a414d87e9619a714eb66f00N.exe
2844	Unicorn-31637.exe
2704	54b744285a414d87e9619a714eb66f00N.exe
2844	Unicorn-31637.exe
2704	54b744285a414d87e9619a714eb66f00N.exe
2320	Unicorn-62254.exe
2320	Unicorn-62254.exe
2844	Unicorn-31637.exe
2612	Unicorn-46473.exe
2612	Unicorn-46473.exe
2844	Unicorn-31637.exe
2704	54b744285a414d87e9619a714eb66f00N.exe
2704	54b744285a414d87e9619a714eb66f00N.exe
2588	Unicorn-36427.exe
2588	Unicorn-36427.exe
2320	Unicorn-62254.exe
2320	Unicorn-62254.exe
2612	Unicorn-46473.exe
2132	Unicorn-40511.exe
2612	Unicorn-46473.exe
2844	Unicorn-31637.exe
2132	Unicorn-40511.exe
2844	Unicorn-31637.exe
2704	54b744285a414d87e9619a714eb66f00N.exe
2800	Unicorn-10339.exe
2560	Unicorn-11822.exe
2704	54b744285a414d87e9619a714eb66f00N.exe
2800	Unicorn-10339.exe
2560	Unicorn-11822.exe
1280	Unicorn-60692.exe
1280	Unicorn-60692.exe
2320	Unicorn-62254.exe
2320	Unicorn-62254.exe
2040	Unicorn-56930.exe
2040	Unicorn-56930.exe
2588	Unicorn-36427.exe
2588	Unicorn-36427.exe
1200	Unicorn-12389.exe
1200	Unicorn-12389.exe
2132	Unicorn-40511.exe
1960	Unicorn-137.exe
2132	Unicorn-40511.exe
1960	Unicorn-137.exe
2752	Unicorn-24733.exe
2752	Unicorn-24733.exe
1152	Unicorn-58061.exe
1152	Unicorn-58061.exe
2612	Unicorn-46473.exe
2800	Unicorn-10339.exe
2612	Unicorn-46473.exe
2800	Unicorn-10339.exe
2704	54b744285a414d87e9619a714eb66f00N.exe
2844	Unicorn-31637.exe
2704	54b744285a414d87e9619a714eb66f00N.exe
1944	Unicorn-8305.exe
1336	Unicorn-34683.exe
2844	Unicorn-31637.exe
1944	Unicorn-8305.exe
1336	Unicorn-34683.exe
2560	Unicorn-11822.exe
2560	Unicorn-11822.exe
2468	Unicorn-64112.exe
1280	Unicorn-60692.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1700	2768	WerFault.exe	135
3660	2688	WerFault.exe	134

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25907.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50768.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34105.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1771.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53665.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12389.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9357.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3951.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52366.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12044.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55433.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29937.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62413.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54552.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65080.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40873.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33045.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52467.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19872.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61286.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19242.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7519.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55512.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29937.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41466.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33682.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6219.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31910.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29684.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58246.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-858.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45865.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32178.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51514.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26599.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50243.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38455.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23547.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4216.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3121.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32844.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60172.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43673.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37129.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53249.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8490.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8305.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39307.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64309.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48143.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53077.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18506.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56465.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2477.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58671.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2704	54b744285a414d87e9619a714eb66f00N.exe
2844	Unicorn-31637.exe
2320	Unicorn-62254.exe
2612	Unicorn-46473.exe
2588	Unicorn-36427.exe
2132	Unicorn-40511.exe
2560	Unicorn-11822.exe
2800	Unicorn-10339.exe
1280	Unicorn-60692.exe
2040	Unicorn-56930.exe
1200	Unicorn-12389.exe
2752	Unicorn-24733.exe
1960	Unicorn-137.exe
1152	Unicorn-58061.exe
1336	Unicorn-34683.exe
1944	Unicorn-8305.exe
2468	Unicorn-64112.exe
1784	Unicorn-9357.exe
2160	Unicorn-15487.exe
1408	Unicorn-48715.exe
2360	Unicorn-3105.exe
1500	Unicorn-39307.exe
1708	Unicorn-22971.exe
2376	Unicorn-19463.exe
2408	Unicorn-65134.exe
2172	Unicorn-48414.exe
2496	Unicorn-21601.exe
1568	Unicorn-2742.exe
2488	Unicorn-59349.exe
2616	Unicorn-31907.exe
1732	Unicorn-48143.exe
1572	Unicorn-2742.exe
2412	Unicorn-23547.exe
2736	Unicorn-12041.exe
1020	Unicorn-34429.exe
1644	Unicorn-14563.exe
2532	Unicorn-54849.exe
2900	Unicorn-30729.exe
2292	Unicorn-27942.exe
3060	Unicorn-26736.exe
2216	Unicorn-37335.exe
1052	Unicorn-29145.exe
2992	Unicorn-55103.exe
2104	Unicorn-6826.exe
1092	Unicorn-22507.exe
1716	Unicorn-63640.exe
1656	Unicorn-28638.exe
1292	Unicorn-49.exe
604	Unicorn-38128.exe
1616	Unicorn-41466.exe
572	Unicorn-41466.exe
2348	Unicorn-15378.exe
1040	Unicorn-6463.exe
2344	Unicorn-63070.exe
1972	Unicorn-43967.exe
2832	Unicorn-33682.exe
2780	Unicorn-33682.exe
3040	Unicorn-49888.exe
2640	Unicorn-3951.exe
1724	Unicorn-4216.exe
2596	Unicorn-63623.exe
2696	Unicorn-49888.exe
1884	Unicorn-48518.exe
2232	Unicorn-4216.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2844	2704	54b744285a414d87e9619a714eb66f00N.exe	30
PID 2704 wrote to memory of 2844	2704	54b744285a414d87e9619a714eb66f00N.exe	30
PID 2704 wrote to memory of 2844	2704	54b744285a414d87e9619a714eb66f00N.exe	30
PID 2704 wrote to memory of 2844	2704	54b744285a414d87e9619a714eb66f00N.exe	30
PID 2844 wrote to memory of 2320	2844	Unicorn-31637.exe	31
PID 2844 wrote to memory of 2320	2844	Unicorn-31637.exe	31
PID 2844 wrote to memory of 2320	2844	Unicorn-31637.exe	31
PID 2844 wrote to memory of 2320	2844	Unicorn-31637.exe	31
PID 2704 wrote to memory of 2612	2704	54b744285a414d87e9619a714eb66f00N.exe	32
PID 2704 wrote to memory of 2612	2704	54b744285a414d87e9619a714eb66f00N.exe	32
PID 2704 wrote to memory of 2612	2704	54b744285a414d87e9619a714eb66f00N.exe	32
PID 2704 wrote to memory of 2612	2704	54b744285a414d87e9619a714eb66f00N.exe	32
PID 2320 wrote to memory of 2588	2320	Unicorn-62254.exe	33
PID 2320 wrote to memory of 2588	2320	Unicorn-62254.exe	33
PID 2320 wrote to memory of 2588	2320	Unicorn-62254.exe	33
PID 2320 wrote to memory of 2588	2320	Unicorn-62254.exe	33
PID 2612 wrote to memory of 2132	2612	Unicorn-46473.exe	35
PID 2612 wrote to memory of 2132	2612	Unicorn-46473.exe	35
PID 2612 wrote to memory of 2132	2612	Unicorn-46473.exe	35
PID 2612 wrote to memory of 2132	2612	Unicorn-46473.exe	35
PID 2844 wrote to memory of 2800	2844	Unicorn-31637.exe	34
PID 2844 wrote to memory of 2800	2844	Unicorn-31637.exe	34
PID 2844 wrote to memory of 2800	2844	Unicorn-31637.exe	34
PID 2844 wrote to memory of 2800	2844	Unicorn-31637.exe	34
PID 2704 wrote to memory of 2560	2704	54b744285a414d87e9619a714eb66f00N.exe	36
PID 2704 wrote to memory of 2560	2704	54b744285a414d87e9619a714eb66f00N.exe	36
PID 2704 wrote to memory of 2560	2704	54b744285a414d87e9619a714eb66f00N.exe	36
PID 2704 wrote to memory of 2560	2704	54b744285a414d87e9619a714eb66f00N.exe	36
PID 2588 wrote to memory of 2040	2588	Unicorn-36427.exe	37
PID 2588 wrote to memory of 2040	2588	Unicorn-36427.exe	37
PID 2588 wrote to memory of 2040	2588	Unicorn-36427.exe	37
PID 2588 wrote to memory of 2040	2588	Unicorn-36427.exe	37
PID 2320 wrote to memory of 1280	2320	Unicorn-62254.exe	38
PID 2320 wrote to memory of 1280	2320	Unicorn-62254.exe	38
PID 2320 wrote to memory of 1280	2320	Unicorn-62254.exe	38
PID 2320 wrote to memory of 1280	2320	Unicorn-62254.exe	38
PID 2612 wrote to memory of 1152	2612	Unicorn-46473.exe	39
PID 2612 wrote to memory of 1152	2612	Unicorn-46473.exe	39
PID 2612 wrote to memory of 1152	2612	Unicorn-46473.exe	39
PID 2612 wrote to memory of 1152	2612	Unicorn-46473.exe	39
PID 2132 wrote to memory of 1200	2132	Unicorn-40511.exe	40
PID 2132 wrote to memory of 1200	2132	Unicorn-40511.exe	40
PID 2132 wrote to memory of 1200	2132	Unicorn-40511.exe	40
PID 2132 wrote to memory of 1200	2132	Unicorn-40511.exe	40
PID 2844 wrote to memory of 2752	2844	Unicorn-31637.exe	41
PID 2844 wrote to memory of 2752	2844	Unicorn-31637.exe	41
PID 2844 wrote to memory of 2752	2844	Unicorn-31637.exe	41
PID 2844 wrote to memory of 2752	2844	Unicorn-31637.exe	41
PID 2704 wrote to memory of 1336	2704	54b744285a414d87e9619a714eb66f00N.exe	42
PID 2704 wrote to memory of 1336	2704	54b744285a414d87e9619a714eb66f00N.exe	42
PID 2704 wrote to memory of 1336	2704	54b744285a414d87e9619a714eb66f00N.exe	42
PID 2704 wrote to memory of 1336	2704	54b744285a414d87e9619a714eb66f00N.exe	42
PID 2800 wrote to memory of 1960	2800	Unicorn-10339.exe	43
PID 2800 wrote to memory of 1960	2800	Unicorn-10339.exe	43
PID 2800 wrote to memory of 1960	2800	Unicorn-10339.exe	43
PID 2800 wrote to memory of 1960	2800	Unicorn-10339.exe	43
PID 2560 wrote to memory of 1944	2560	Unicorn-11822.exe	44
PID 2560 wrote to memory of 1944	2560	Unicorn-11822.exe	44
PID 2560 wrote to memory of 1944	2560	Unicorn-11822.exe	44
PID 2560 wrote to memory of 1944	2560	Unicorn-11822.exe	44
PID 1280 wrote to memory of 2468	1280	Unicorn-60692.exe	45
PID 1280 wrote to memory of 2468	1280	Unicorn-60692.exe	45
PID 1280 wrote to memory of 2468	1280	Unicorn-60692.exe	45
PID 1280 wrote to memory of 2468	1280	Unicorn-60692.exe	45

C:\Users\Admin\AppData\Local\Temp\54b744285a414d87e9619a714eb66f00N.exe
"C:\Users\Admin\AppData\Local\Temp\54b744285a414d87e9619a714eb66f00N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31637.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31637.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62254.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62254.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36427.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56930.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15487.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21601.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40816.exe
        8⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17503.exe
        8⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1241.exe
        8⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33045.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54552.exe
        7⤵
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        7⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2111.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50111.exe
        7⤵
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14563.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4216.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3985.exe
        7⤵
        
        PID:548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1929.exe
        7⤵
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20949.exe
        7⤵
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60115.exe
        6⤵
        Executes dropped EXE
        
        PID:2928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15116.exe
        6⤵
        
        PID:1672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64666.exe
        6⤵
        
        PID:3092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24337.exe
        6⤵
        
        PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48715.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54849.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33682.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26351.exe
        7⤵
        
        PID:876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51514.exe
        7⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-858.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49888.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8059.exe
        7⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29937.exe
        7⤵
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46501.exe
        6⤵
        
        PID:1184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57379.exe
        6⤵
        
        PID:3360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40873.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26736.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45865.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57379.exe
        6⤵
        
        PID:3400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12284.exe
        6⤵
        
        PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30843.exe
        5⤵
        
        PID:2692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12044.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21446.exe
        6⤵
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62330.exe
        6⤵
        
        PID:964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33202.exe
        5⤵
        
        PID:3036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32178.exe
        5⤵
        
        PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12814.exe
        5⤵
        
        PID:3956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60692.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64112.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31907.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41466.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33329.exe
        8⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6653.exe
        9⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37778.exe
        8⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43673.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32129.exe
        7⤵
        
        PID:1012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51514.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20949.exe
        7⤵
        
        PID:4076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15378.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7140.exe
        6⤵
        
        PID:2116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43068.exe
        6⤵
        
        PID:3592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24337.exe
        6⤵
        
        PID:3640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12041.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28970.exe
        6⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50986.exe
        7⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4603.exe
        7⤵
        
        PID:5108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63440.exe
        6⤵
        
        PID:1800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59272.exe
        6⤵
        
        PID:4036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62330.exe
        6⤵
        
        PID:3784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20317.exe
        5⤵
        
        PID:316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12864.exe
        6⤵
        
        PID:3772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe
        6⤵
        
        PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15143.exe
        5⤵
        
        PID:1856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50326.exe
        5⤵
        
        PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19192.exe
        5⤵
        
        PID:4684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9357.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34429.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6463.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5926.exe
        7⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55843.exe
        7⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62413.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25907.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8059.exe
        7⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29937.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51514.exe
        6⤵
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21919.exe
        6⤵
        
        PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43967.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19222.exe
        6⤵
        
        PID:2652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7519.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38455.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39643.exe
        5⤵
        
        PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55433.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40873.exe
        5⤵
        
        PID:3520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27942.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1320.exe
        5⤵
        
        PID:2108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60172.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24337.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22177.exe
      4⤵
      PID:2764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27577.exe
        5⤵
        
        PID:3524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38645.exe
        5⤵
        
        PID:4068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57840.exe
      4⤵
      PID:2484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1771.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1938.exe
      4⤵
      PID:4248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10339.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10339.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-137.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22971.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30729.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63640.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52467.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11638.exe
        8⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65137.exe
        8⤵
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59579.exe
        8⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22730.exe
        7⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32844.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8059.exe
        9⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60824.exe
        9⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26599.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49538.exe
        8⤵
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24411.exe
        7⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8059.exe
        8⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29937.exe
        8⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64666.exe
        7⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24337.exe
        7⤵
        
        PID:3556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6826.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60215.exe
        7⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20596.exe
        7⤵
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58998.exe
        7⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28968.exe
        7⤵
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17411.exe
        6⤵
        
        PID:2156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5661.exe
        6⤵
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33797.exe
        6⤵
        
        PID:3940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64309.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29145.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25680.exe
        6⤵
        
        PID:2340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51598.exe
        6⤵
        
        PID:2884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4041.exe
        6⤵
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58246.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55512.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17503.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33797.exe
        5⤵
        
        PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29499.exe
        5⤵
        
        PID:4472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65134.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60215.exe
        6⤵
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53461.exe
        6⤵
        
        PID:584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13278.exe
        6⤵
        
        PID:3816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54546.exe
        6⤵
        
        PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40349.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11956.exe
        6⤵
        
        PID:536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22485.exe
        6⤵
        
        PID:3768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5318.exe
        6⤵
        
        PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11965.exe
        5⤵
        
        PID:2180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56393.exe
        5⤵
        
        PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40873.exe
        5⤵
        
        PID:3424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22507.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21596.exe
        5⤵
        
        PID:1304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23851.exe
        6⤵
        
        PID:932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53731.exe
        6⤵
        
        PID:3104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43673.exe
        6⤵
        
        PID:3312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53077.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45868.exe
        5⤵
        
        PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21919.exe
        5⤵
        
        PID:4396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30843.exe
      4⤵
      PID:2328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
      4⤵
      PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43143.exe
      4⤵
      PID:3896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54195.exe
      4⤵
      PID:4184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24733.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24733.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23547.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6219.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29245.exe
        6⤵
        
        PID:2688
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 220
        7⤵
        Program crash
        
        PID:3660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37778.exe
        6⤵
        
        PID:3440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe
        6⤵
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32957.exe
        5⤵
        
        PID:2028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59486.exe
        6⤵
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8059.exe
        7⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29937.exe
        7⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53731.exe
        6⤵
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe
        6⤵
        
        PID:3852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13091.exe
        5⤵
        
        PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27120.exe
        5⤵
        
        PID:2276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49389.exe
        5⤵
        
        PID:4640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35170.exe
      4⤵
      PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8059.exe
        5⤵
        
        PID:3196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1349.exe
        5⤵
        
        PID:3528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11638.exe
      4⤵
      PID:2864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9906.exe
      4⤵
      PID:3192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49581.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2477.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2477.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41466.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38184.exe
        5⤵
        
        PID:3700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29937.exe
        5⤵
        
        PID:3656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23961.exe
      4⤵
      PID:556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51514.exe
      4⤵
      PID:3344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27297.exe
      4⤵
      PID:3564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63070.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63070.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31910.exe
      4⤵
      PID:1104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9657.exe
      4⤵
      PID:632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56465.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20307.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20307.exe
    3⤵
    PID:2816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49244.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49244.exe
    3⤵
    PID:3496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19872.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19872.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2516
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46473.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46473.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40511.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40511.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12389.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39307.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28638.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3121.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51598.exe
        7⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59272.exe
        7⤵
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62330.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51891.exe
        6⤵
        
        PID:1868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56523.exe
        7⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31910.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11603.exe
        8⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1042.exe
        8⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18078.exe
        7⤵
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50333.exe
        7⤵
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12433.exe
        7⤵
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7606.exe
        6⤵
        
        PID:2196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57379.exe
        6⤵
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40873.exe
        6⤵
        
        PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38128.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50768.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51759.exe
        6⤵
        
        PID:3832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43673.exe
        6⤵
        
        PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37697.exe
        5⤵
        
        PID:528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26918.exe
        6⤵
        
        PID:3548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29937.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57379.exe
        5⤵
        
        PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40873.exe
        5⤵
        
        PID:3316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3105.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33682.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29684.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26351.exe
        5⤵
        
        PID:2392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53249.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49568.exe
        5⤵
        
        PID:3264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20949.exe
        5⤵
        
        PID:3084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63623.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52366.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8490.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46768.exe
      4⤵
      PID:3240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55064.exe
      4⤵
      PID:3208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58061.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58061.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19463.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37335.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40816.exe
        6⤵
        
        PID:2472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65333.exe
        6⤵
        
        PID:1828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12921.exe
        6⤵
        
        PID:3996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53665.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49888.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54525.exe
        6⤵
        
        PID:2296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65080.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19242.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58671.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8059.exe
        6⤵
        
        PID:3256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25853.exe
        6⤵
        
        PID:3076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64666.exe
        5⤵
        
        PID:3124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61286.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55103.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60215.exe
        5⤵
        
        PID:2908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41208.exe
        5⤵
        
        PID:1484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58998.exe
        5⤵
        
        PID:3916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47326.exe
        5⤵
        
        PID:4452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54552.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15714.exe
        5⤵
        
        PID:1400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29937.exe
        5⤵
        
        PID:3748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
      4⤵
      PID:1496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50243.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32747.exe
      4⤵
      PID:4256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48143.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48143.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40816.exe
      4⤵
      PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57317.exe
        5⤵
        
        PID:3636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36507.exe
        5⤵
        
        PID:4656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17503.exe
      4⤵
      PID:1144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34105.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37129.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3951.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3951.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56471.exe
      4⤵
      PID:2920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51759.exe
      4⤵
      PID:3840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52381.exe
      4⤵
      PID:3860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43701.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43701.exe
    3⤵
    PID:1980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32178.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32178.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41403.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41403.exe
    3⤵
    PID:3712
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8305.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8305.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2742.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39835.exe
        5⤵
        
        PID:1160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46175.exe
        5⤵
        
        PID:2428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18506.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6582.exe
      4⤵
      PID:2656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23809.exe
      4⤵
      PID:1628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1324.exe
      4⤵
      PID:3584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2127.exe
      4⤵
      PID:4676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48414.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48414.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25680.exe
      4⤵
      PID:828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51598.exe
      4⤵
      PID:2268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48692.exe
      4⤵
      PID:3780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37328.exe
      4⤵
      PID:4428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44822.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44822.exe
    3⤵
    PID:1328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47810.exe
      4⤵
      PID:2728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7519.exe
      4⤵
      PID:2380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25738.exe
      4⤵
      PID:4236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36772.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36772.exe
    3⤵
    PID:2504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4256.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4256.exe
    3⤵
    PID:3964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11107.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11107.exe
    3⤵
    PID:4320
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34683.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34683.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2742.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2742.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4216.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43949.exe
      4⤵
      PID:912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1929.exe
      4⤵
      PID:3148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20949.exe
      4⤵
      PID:4060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48518.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48518.exe
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35761.exe
      4⤵
      PID:4552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9251.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9251.exe
    3⤵
    PID:1680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7794.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7794.exe
    3⤵
    PID:3164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36788.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36788.exe
    3⤵
    PID:4092
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59349.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59349.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29764.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29764.exe
    3⤵
    PID:780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51598.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51598.exe
    3⤵
    PID:952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59272.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59272.exe
    3⤵
    PID:4012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62330.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62330.exe
    3⤵
    PID:4104
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29570.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29570.exe
  2⤵
  PID:2072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29245.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29245.exe
    3⤵
    PID:2768
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 220
      4⤵
      Program crash
      PID:1700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37778.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37778.exe
    3⤵
    PID:3460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe
    3⤵
    PID:4088
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41709.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41709.exe
  2⤵
  PID:2564
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27713.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27713.exe
  2⤵
  PID:3392
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14537.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14537.exe
  2⤵
  PID:3144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe

Filesize
468KB

MD5
4c6cddec4bf73c350a8db40b58f09b3e

SHA1
0164c5f8917a4e004e37026d82960c7b4225a02b

SHA256
31085638a17459936ce6c2a9d203dfa413eed67cd9c5ca860ee0934365d0d627

SHA512
2b2575de92e9f31a26cac379a835873e176b0f783da298a4c29f21a73f673a3c5d96e509aa8afb8fcc1f5eb836ec09447f398ef719aa4e8bc2a9bb7c890ba725

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11965.exe

Filesize
468KB

MD5
53639623ed2458e6ced9fc4bfb44482d

SHA1
25971afe5c2a962a30e8ffd13301af0c9a9939f4

SHA256
cc54837433675dcc6fecbebea07108cb5ab5852ab35c089302bb8cbade5381a8

SHA512
4cb915f024c8bab0fc6e5eac6460598a986aa60ab6bf2ba461f34973d849778b173dd818979c4c5f917e18d36fd23ba59821fa7761af437648d5f5beda80db71

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15487.exe

Filesize
468KB

MD5
629b7190f5eabf566ab63c6112933fd2

SHA1
6480be6ef29e2f6031ea51332a257599a27ac7f7

SHA256
edae1305671a69f6d6498acc5dc3bcf3a4e65a16b301dace66e77e8776c0a800

SHA512
75b58b353d7e057e1187f06291b445940f2f4d6fd0954b8d881bd7d1fad4dd91f0e9a769f81a8d29eacbd23ea17c5ba462da7d9220afcab9eea892f9a0ab87ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20317.exe

Filesize
468KB

MD5
7de4b2631c5a68ba82d6c974ffcbc8c9

SHA1
45424c2abc449cc40737f1952fac355839424dcc

SHA256
1e044eb6c5e51be17232f0bdbace4cc449faaac410c729430e1d59aa039920ca

SHA512
7ff8dca0a53f65536707d48e811ff792c4e70aefbcb8b14979ab9282d5d42798b9c58ddcda5a0f7f973faf64dc4fd6ec36b84b9a544b686a5f87239b3dcc0106

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24733.exe

Filesize
468KB

MD5
5a036b10cfcd8e171a8cf8ecac8634ab

SHA1
fc089901662f070bb19d39a53c6a2d98bb8f4ffe

SHA256
a53ebcdc01e9716e648c1e641123a9ed03a65d22aeb5f4d2cc5fe14cafe46b1c

SHA512
a079feaee13546cdb136806b8103548496edefb4ac5b830b537391d5ac8c0b04adad4ff186e7506ddaa8fbf63a89e9dcb807166eb9c6c36d5f6b906db3ead286

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56930.exe

Filesize
468KB

MD5
df9720362fdc79c44f8dff0a91d078c1

SHA1
05eb25e05ef1701797f531d51d41db5ce6a5605f

SHA256
8e6c2e72c8f684589a1499eb9219d389d03b9ae39dbaa8b40a77e5dacc6d57f9

SHA512
4f39b1d7a258fd6b37c1fc7dda049caf81a8beac9440b3977f4ec58c67cf6d82a34ef2bb800bde0097ee6a852963cac9d24dd45efac99b591f7770d934b9b734

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7606.exe

Filesize
468KB

MD5
60d5ff7ea4cd5f0a5966e20b24ac08c1

SHA1
7c6e4ed03de2284a574152608a9f059a74af37a1

SHA256
50898692cc5aa9f774349ad9b61df643b6976146508d82141495d1ecbb9eb875

SHA512
65fbb1044b245352df528a71436b26829dda670832e0c458717f95474d748d058d8ffafd585a0845722fe27b9c398d8856979489fb44f4f49ce748302266df51

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9357.exe

Filesize
468KB

MD5
f6fa19e453817668368956af0466157c

SHA1
ba9a6f1737f8bce4a73844f5cf161edb817747ca

SHA256
5639017885de52f8298aedf83674bbc84028c93ad510480347c295d2599bbed1

SHA512
871b52a355bc9521ba10b0d8090c0da986a69bef9f62b4cb2517923d7031ae66fcb2088108e16fcf7dd814889b6730b1514c20c876c863408e1d8ef5ab2bef80

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-10339.exe

Filesize
468KB

MD5
176871406f0930150861ac2bbab14b55

SHA1
f67074160e144d0d6d1359d6436423cec8c87f4f

SHA256
372e028e589ec34f40c39fe1f9d1b19821709a99d8a31526f0c8bdd57d6deb90

SHA512
ba2de61029d1ffa4764267dd703a8630cd72d45ef776b6f280af6a17f1872a4b6d3cb1dabeb62dd24a73d658f8c0a4898ed1127be6bcc4d2e97e9cd3009d82de

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12389.exe

Filesize
468KB

MD5
7f44bfb3ff4c69f5aacba45ccb67016a

SHA1
dd598b2eed62037b7a62382b794f6323e5ce99ce

SHA256
56a24cbf631932d1e40a3ef983d7646b9207b2d5b7dd5d115631e4e7dd4b8dcd

SHA512
ba33f32d887d9942484d14a2afcb3c8ce4726e819b3b2541fbdb58334e72ad36d355f31331033f9d38ad1df4cec6e04265d29648725b471bf2a2295f89ff43af

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-137.exe

Filesize
468KB

MD5
a612c8e1056833a570482c655acfff46

SHA1
905c2041dfafba198ff35da43b46d57a52896a1b

SHA256
5eb98c6a3c37d144dc08a67ae4c19b68e3ffba1d55b20f838b08e786fedd02d5

SHA512
50d53140fe2e59e163d78d9d6c553b3890a66fadd0a7a72f495800ef4d9f20067015e4ce198e420085df4fe7985a3628cb95312c8508950511a1772f8de50a0e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31637.exe

Filesize
468KB

MD5
c1dde5e9d1360767fad6c29ff2bc0cd8

SHA1
db85eb772b58d46b2c1fd0cdf4145a6c819a0961

SHA256
ff57fab893050e4bb133ae8e2408967db3ade7935a52e0774f4fb99b15d53f32

SHA512
1d18deb72badd759b6241fc699b3f86355bfc139a7baf20080b972566573fb232328db1f4486dbe304cda0114dde01f777a911cddfe0799252328e3b2868557e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34683.exe

Filesize
468KB

MD5
5fcf73d827008ddd040df15b02b47c0b

SHA1
e6fb088bb4d2568ecccf0d9e75a1f18ad4e8cb9d

SHA256
b5bef17c4a3f11464c47f371a39edf13a387298983bd0b38e2689d2d2bc082a2

SHA512
feff093592adf59320f97814fa1662812eabd6a67e02df7941da5007b5de05e5afb650a17464c4c598d86047e31179809bf9283e36e4ab3164e127b8f39bb71a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36427.exe

Filesize
468KB

MD5
38ab6a67873489f92c724751210d05dd

SHA1
3940e9bdac7b5a75a432097a48f06731bc81d7ec

SHA256
edb82fb1a73f693008e8eccdcf9b8b235d97afb3cd5da0bc1665e1a9d36c18b9

SHA512
bae08cb897362f32cace5288838e6cf7edf25c345830fae1321400da9086398d110c2c1d588d0145d3a21cf80d24f678cdbc00f898f70c144f0792a91d67c71f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40511.exe

Filesize
468KB

MD5
b4ff6dc7a10b74f37f322408cdf479ca

SHA1
b0dfe22501d59655939e59456221b94cf0dc76c3

SHA256
040163f369979548f0915c3556e4ce4cc803d03c3ffc1857452d6a060104a55a

SHA512
c533b3d006e6ac2aacee346a0707f5db18da5e6086d727a5c1bbb6768491fd1a107e20cec85e1015cbaac4b6c1f2bf6588cf484003298e50d686ade8977f243a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46473.exe

Filesize
468KB

MD5
afd693f3eaea6903bb0d449303a70e7a

SHA1
b3af0f336b975937628871d17aefffe2077a0292

SHA256
03a4ee43f670fff1a96a9521b38193908aa43cf91b0f785f034d55ca3a51393a

SHA512
966186a81a1ce0e8ab0c9c73c2d1046e638934f49721dc031368efe5182834d997236b438888e75dd1ea68a842792071e7f575dc910b3d71224074a4dcfcbf75

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-48715.exe

Filesize
468KB

MD5
e47e25b976199245515e83b4518567ec

SHA1
c2ae566eb94e7fa4117774ebe68191754797ae23

SHA256
92832d8dd192be51e7fd22e754e01c4e55a0d21ba2bd6435d182db9a586ecef0

SHA512
fcea49467ae8af1ef588765dca42a07ec7ba22c95368c520f4552f619e08bdedfd25b942fe67ba922412d4030a391270ecc463a520c9727d9233a66c280d0607

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58061.exe

Filesize
468KB

MD5
813f6a4bbd28f1b83d33ecaecc30d0b9

SHA1
8bb40ecd0f48ff6295d6137f2d415247ae1cb153

SHA256
201f92b65281e614048b123831d90e53895c78370ce9293b7e08d7eba46a4197

SHA512
8606b635c1ff8a6f5ec21a37ee6dae9dab70dba44f72bbb6ec8a89608e56c0f38c1dfa37e7314c55e023d2d91a20b2cc3efbd46f2caaa26d21726f57ea4c4f0b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60692.exe

Filesize
468KB

MD5
e5aafd2b2b5ee78027d77e8e007a655d

SHA1
7e948477f246748ec59347d63bf22ea5bfea2b68

SHA256
9a9bb354086d1c958925e6ab4ed4df093d59bc5533beebb1d525a90a328aa0cf

SHA512
d63b9db66faec5c8f3973c999739c20bd978be6a18f724401a2f23dbc8246e79bc5e61e71ec54ad0921df7e5954daa11c1eca0ec6077ed36bbd5e4244b05d13e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62254.exe

Filesize
468KB

MD5
57a0e987845a666c5bdcec70e93e22ff

SHA1
b030d5850b5ff4ab84b44c9c0d40688f782de06f

SHA256
686252bf4a37e13b4bb95e06dfec4484444da019e7d67bd524e9cd007e290731

SHA512
515a48d9d29e08b644738948ed866d6c28581698340a8b543f77d4791286c25e8d2c8d8f47ce961c5189c20c298d3bac9cc6eaa5607735eef4098a75c014ff28

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64112.exe

Filesize
468KB

MD5
c769131a7257b4c368d4dbb113b344dd

SHA1
a89452b152c83811c3df6e5a4ef04006bd8d5057

SHA256
8fc4412c7306bec1cc375b787b481f91abbc80f100a5c9fabdc166fc599d46ed

SHA512
739b55f47e2081bb80f1034fe6e83e5c712619bdbf2f1d9a53b8f3e3b3219e10c65a216eadfbc2b8e27cad44cda49fff0978c35f4560bbc5afcbaf2d56e8c249

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8305.exe

Filesize
468KB

MD5
a58f0a9c711e6dfccbcd66d57e0dcc42

SHA1
68b493d497c169d917b411cfa7ccc8ccf004ff44

SHA256
9ea0e01c1f34138e993a2d2882c03e8288a7332274fb7d42b95ac6ae80a16121

SHA512
abc141f8d85d6b6c87e64ca1f2f1dc51ed16526586b45ad118ea2dc49978fb40fd0db79872dc7543cb59139b673951be30050726d4984dc6896c06a2b46a97fc

Download Submit
memory/1020-386-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1152-292-0x0000000001E90000-0x0000000001F05000-memory.dmp

Filesize
468KB

Download
memory/1152-137-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1200-248-0x0000000000370000-0x00000000003E5000-memory.dmp

Filesize
468KB

Download
memory/1200-242-0x0000000000370000-0x00000000003E5000-memory.dmp

Filesize
468KB

Download
memory/1200-162-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1280-197-0x0000000000370000-0x00000000003E5000-memory.dmp

Filesize
468KB

Download
memory/1280-196-0x0000000000370000-0x00000000003E5000-memory.dmp

Filesize
468KB

Download
memory/1280-105-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1280-349-0x0000000000370000-0x00000000003E5000-memory.dmp

Filesize
468KB

Download
memory/1280-344-0x0000000000370000-0x00000000003E5000-memory.dmp

Filesize
468KB

Download
memory/1336-317-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1336-322-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1336-174-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1408-399-0x0000000002A00000-0x0000000002A75000-memory.dmp

Filesize
468KB

Download
memory/1408-237-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1408-400-0x0000000002A00000-0x0000000002A75000-memory.dmp

Filesize
468KB

Download
memory/1500-249-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1572-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1644-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1708-267-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1732-300-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1784-373-0x00000000033F0000-0x0000000003465000-memory.dmp

Filesize
468KB

Download
memory/1784-221-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1784-382-0x00000000028C0000-0x0000000002935000-memory.dmp

Filesize
468KB

Download
memory/1944-315-0x0000000002870000-0x00000000028E5000-memory.dmp

Filesize
468KB

Download
memory/1944-318-0x0000000002870000-0x00000000028E5000-memory.dmp

Filesize
468KB

Download
memory/1944-175-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1960-260-0x0000000002940000-0x00000000029B5000-memory.dmp

Filesize
468KB

Download
memory/1960-259-0x0000000002940000-0x00000000029B5000-memory.dmp

Filesize
468KB

Download
memory/1960-168-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2040-103-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2040-380-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2040-372-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2040-222-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2040-223-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2132-70-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2132-141-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/2132-264-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/2132-258-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/2160-366-0x0000000002890000-0x0000000002905000-memory.dmp

Filesize
468KB

Download
memory/2160-365-0x0000000002890000-0x0000000002905000-memory.dmp

Filesize
468KB

Download
memory/2160-224-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2172-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2196-961-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2292-398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2320-219-0x00000000023E0000-0x0000000002455000-memory.dmp

Filesize
468KB

Download
memory/2320-393-0x00000000023E0000-0x0000000002455000-memory.dmp

Filesize
468KB

Download
memory/2320-47-0x00000000023E0000-0x0000000002455000-memory.dmp

Filesize
468KB

Download
memory/2320-394-0x00000000023E0000-0x0000000002455000-memory.dmp

Filesize
468KB

Download
memory/2320-220-0x00000000023E0000-0x0000000002455000-memory.dmp

Filesize
468KB

Download
memory/2360-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2376-293-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2408-299-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2412-296-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2468-347-0x0000000002850000-0x00000000028C5000-memory.dmp

Filesize
468KB

Download
memory/2468-338-0x0000000002850000-0x00000000028C5000-memory.dmp

Filesize
468KB

Download
memory/2468-199-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2488-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2496-367-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2532-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2560-79-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2560-335-0x00000000026A0000-0x0000000002715000-memory.dmp

Filesize
468KB

Download
memory/2560-329-0x00000000026A0000-0x0000000002715000-memory.dmp

Filesize
468KB

Download
memory/2560-167-0x00000000026A0000-0x0000000002715000-memory.dmp

Filesize
468KB

Download
memory/2588-232-0x0000000002410000-0x0000000002485000-memory.dmp

Filesize
468KB

Download
memory/2588-49-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2588-102-0x0000000002410000-0x0000000002485000-memory.dmp

Filesize
468KB

Download
memory/2588-236-0x0000000002410000-0x0000000002485000-memory.dmp

Filesize
468KB

Download
memory/2612-36-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2612-134-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2612-297-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2612-294-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2616-348-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2704-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2704-325-0x00000000024A0000-0x0000000002515000-memory.dmp

Filesize
468KB

Download
memory/2704-11-0x00000000024A0000-0x0000000002515000-memory.dmp

Filesize
468KB

Download
memory/2704-6-0x00000000024A0000-0x0000000002515000-memory.dmp

Filesize
468KB

Download
memory/2704-313-0x00000000024A0000-0x0000000002515000-memory.dmp

Filesize
468KB

Download
memory/2704-170-0x00000000024A0000-0x0000000002515000-memory.dmp

Filesize
468KB

Download
memory/2704-155-0x00000000024A0000-0x0000000002515000-memory.dmp

Filesize
468KB

Download
memory/2736-350-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2752-291-0x0000000001E20000-0x0000000001E95000-memory.dmp

Filesize
468KB

Download
memory/2752-290-0x0000000001E20000-0x0000000001E95000-memory.dmp

Filesize
468KB

Download
memory/2752-142-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2800-71-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2800-171-0x0000000002950000-0x00000000029C5000-memory.dmp

Filesize
468KB

Download
memory/2800-169-0x0000000002950000-0x00000000029C5000-memory.dmp

Filesize
468KB

Download
memory/2800-295-0x0000000002950000-0x00000000029C5000-memory.dmp

Filesize
468KB

Download
memory/2800-298-0x0000000002950000-0x00000000029C5000-memory.dmp

Filesize
468KB

Download
memory/2844-136-0x0000000001F50000-0x0000000001FC5000-memory.dmp

Filesize
468KB

Download
memory/2844-138-0x0000000001F50000-0x0000000001FC5000-memory.dmp

Filesize
468KB

Download
memory/2844-326-0x0000000001D50000-0x0000000001DC5000-memory.dmp

Filesize
468KB

Download
memory/2844-324-0x0000000001D50000-0x0000000001DC5000-memory.dmp

Filesize
468KB

Download
memory/2844-21-0x0000000001F50000-0x0000000001FC5000-memory.dmp

Filesize
468KB

Download
memory/2844-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2860-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download