6fcd18ab8241f017198f3fc323e4c6f93760c43e3b85df837a31b86d0a1bc715

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 05:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6fcd18ab8241f017198f3fc323e4c6f93760c43e3b85df837a31b86d0a1bc715N.exe
Size

468KB
MD5

4a2c35e474622c8c3bbc58247419a680
SHA1

279da969b8491019e7fc3dd45fab28ff22eec255
SHA256

6fcd18ab8241f017198f3fc323e4c6f93760c43e3b85df837a31b86d0a1bc715
SHA512

c2c67045bc8b5bb68663dba96336fc6a8c1f3f51f6a0496df0079ee4b62b479099e6242e3a7ffd4c472c5f5d2a47186b96c2ebf8b58c304f86c021d0db07dad0
SSDEEP

3072:Dqb5ogsG5x812bYVPz3yzf8/HCejZILrPmHxvVQc0xV+Jy6GEBle:Dq1oCy122PDyzf4OOf0xQA6GE

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2100	Unicorn-59771.exe
2796	Unicorn-4597.exe
2144	Unicorn-59013.exe
2748	Unicorn-10788.exe
2880	Unicorn-55308.exe
1704	Unicorn-60875.exe
1516	Unicorn-43456.exe
2004	Unicorn-29411.exe
3056	Unicorn-29676.exe
2680	Unicorn-58819.exe
2432	Unicorn-23545.exe
2528	Unicorn-29676.exe
1788	Unicorn-15857.exe
436	Unicorn-41958.exe
1556	Unicorn-61824.exe
2384	Unicorn-9670.exe
2960	Unicorn-61824.exe
752	Unicorn-61559.exe
916	Unicorn-20605.exe
1056	Unicorn-20792.exe
968	Unicorn-29536.exe
2996	Unicorn-8518.exe
2552	Unicorn-4647.exe
2120	Unicorn-64054.exe
2212	Unicorn-54445.exe
1576	Unicorn-24906.exe
2888	Unicorn-20076.exe
2276	Unicorn-45239.exe
2200	Unicorn-44974.exe
1980	Unicorn-12380.exe
2868	Unicorn-62151.exe
2716	Unicorn-32965.exe
2764	Unicorn-41517.exe
2708	Unicorn-52831.exe
2648	Unicorn-43039.exe
2632	Unicorn-9084.exe
2652	Unicorn-39156.exe
3040	Unicorn-38078.exe
2088	Unicorn-38078.exe
2312	Unicorn-12229.exe
1816	Unicorn-27532.exe
1636	Unicorn-38161.exe
3044	Unicorn-47398.exe
2916	Unicorn-37199.exe
1084	Unicorn-43183.exe
1764	Unicorn-50392.exe
2140	Unicorn-12888.exe
888	Unicorn-48175.exe
2420	Unicorn-29609.exe
1756	Unicorn-9446.exe
2976	Unicorn-30953.exe
1628	Unicorn-23806.exe
2512	Unicorn-18710.exe
1584	Unicorn-29665.exe
2828	Unicorn-21026.exe
2744	Unicorn-51513.exe
2812	Unicorn-13516.exe
2876	Unicorn-33339.exe
2884	Unicorn-29085.exe
3016	Unicorn-55701.exe
2576	Unicorn-46251.exe
3048	Unicorn-18953.exe
2792	Unicorn-58332.exe
2240	Unicorn-49234.exe

Loads dropped DLL 64 IoCs

pid	Process
2436	6fcd18ab8241f017198f3fc323e4c6f93760c43e3b85df837a31b86d0a1bc715N.exe
2436	6fcd18ab8241f017198f3fc323e4c6f93760c43e3b85df837a31b86d0a1bc715N.exe
2100	Unicorn-59771.exe
2100	Unicorn-59771.exe
2436	6fcd18ab8241f017198f3fc323e4c6f93760c43e3b85df837a31b86d0a1bc715N.exe
2436	6fcd18ab8241f017198f3fc323e4c6f93760c43e3b85df837a31b86d0a1bc715N.exe
2144	Unicorn-59013.exe
2144	Unicorn-59013.exe
2100	Unicorn-59771.exe
2100	Unicorn-59771.exe
2436	6fcd18ab8241f017198f3fc323e4c6f93760c43e3b85df837a31b86d0a1bc715N.exe
2436	6fcd18ab8241f017198f3fc323e4c6f93760c43e3b85df837a31b86d0a1bc715N.exe
2768	WerFault.exe
2768	WerFault.exe
2768	WerFault.exe
2768	WerFault.exe
2768	WerFault.exe
2768	WerFault.exe
2768	WerFault.exe
1704	Unicorn-60875.exe
1704	Unicorn-60875.exe
2100	Unicorn-59771.exe
2436	6fcd18ab8241f017198f3fc323e4c6f93760c43e3b85df837a31b86d0a1bc715N.exe
2436	6fcd18ab8241f017198f3fc323e4c6f93760c43e3b85df837a31b86d0a1bc715N.exe
2748	Unicorn-10788.exe
2880	Unicorn-55308.exe
2748	Unicorn-10788.exe
2880	Unicorn-55308.exe
2144	Unicorn-59013.exe
2144	Unicorn-59013.exe
2100	Unicorn-59771.exe
3056	Unicorn-29676.exe
3056	Unicorn-29676.exe
2432	Unicorn-23545.exe
2880	Unicorn-55308.exe
2432	Unicorn-23545.exe
2880	Unicorn-55308.exe
1704	Unicorn-60875.exe
1516	Unicorn-43456.exe
1516	Unicorn-43456.exe
1704	Unicorn-60875.exe
2100	Unicorn-59771.exe
2004	Unicorn-29411.exe
2680	Unicorn-58819.exe
2100	Unicorn-59771.exe
2436	6fcd18ab8241f017198f3fc323e4c6f93760c43e3b85df837a31b86d0a1bc715N.exe
2436	6fcd18ab8241f017198f3fc323e4c6f93760c43e3b85df837a31b86d0a1bc715N.exe
2680	Unicorn-58819.exe
2004	Unicorn-29411.exe
2528	Unicorn-29676.exe
2748	Unicorn-10788.exe
2528	Unicorn-29676.exe
2748	Unicorn-10788.exe
2144	Unicorn-59013.exe
2144	Unicorn-59013.exe
1788	Unicorn-15857.exe
1788	Unicorn-15857.exe
3056	Unicorn-29676.exe
3056	Unicorn-29676.exe
2120	Unicorn-64054.exe
2120	Unicorn-64054.exe
752	Unicorn-61559.exe
752	Unicorn-61559.exe
2144	Unicorn-59013.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2768	2796	WerFault.exe	30
2204	2088	WerFault.exe	68
2016	3040	WerFault.exe	67

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48730.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8534.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44556.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16588.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46928.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32334.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55308.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21396.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20860.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47663.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28875.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41767.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23545.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18523.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14920.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29534.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41958.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36506.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17143.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7875.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5560.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34078.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29950.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5299.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16607.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60849.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50573.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23204.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48431.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39156.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46486.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27178.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31201.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17401.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29085.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49234.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6633.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3515.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8714.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62397.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5444.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5252.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52544.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28875.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4999.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33339.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38288.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7830.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33846.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3153.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59482.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2436	6fcd18ab8241f017198f3fc323e4c6f93760c43e3b85df837a31b86d0a1bc715N.exe
2100	Unicorn-59771.exe
2144	Unicorn-59013.exe
2796	Unicorn-4597.exe
2880	Unicorn-55308.exe
2748	Unicorn-10788.exe
1704	Unicorn-60875.exe
2004	Unicorn-29411.exe
1516	Unicorn-43456.exe
3056	Unicorn-29676.exe
2432	Unicorn-23545.exe
2680	Unicorn-58819.exe
2528	Unicorn-29676.exe
1788	Unicorn-15857.exe
436	Unicorn-41958.exe
2960	Unicorn-61824.exe
2552	Unicorn-4647.exe
2120	Unicorn-64054.exe
1556	Unicorn-61824.exe
2384	Unicorn-9670.exe
752	Unicorn-61559.exe
2996	Unicorn-8518.exe
1056	Unicorn-20792.exe
968	Unicorn-29536.exe
916	Unicorn-20605.exe
2212	Unicorn-54445.exe
1576	Unicorn-24906.exe
2888	Unicorn-20076.exe
2276	Unicorn-45239.exe
2200	Unicorn-44974.exe
2652	Unicorn-39156.exe
2868	Unicorn-62151.exe
2916	Unicorn-37199.exe
1980	Unicorn-12380.exe
1636	Unicorn-38161.exe
2088	Unicorn-38078.exe
3044	Unicorn-47398.exe
2764	Unicorn-41517.exe
2632	Unicorn-9084.exe
2648	Unicorn-43039.exe
1816	Unicorn-27532.exe
1084	Unicorn-43183.exe
1764	Unicorn-50392.exe
2312	Unicorn-12229.exe
2708	Unicorn-52831.exe
2716	Unicorn-32965.exe
3040	Unicorn-38078.exe
2140	Unicorn-12888.exe
888	Unicorn-48175.exe
2420	Unicorn-29609.exe
2976	Unicorn-30953.exe
1756	Unicorn-9446.exe
2512	Unicorn-18710.exe
1628	Unicorn-23806.exe
1584	Unicorn-29665.exe
2828	Unicorn-21026.exe
2744	Unicorn-51513.exe
2812	Unicorn-13516.exe
2876	Unicorn-33339.exe
2884	Unicorn-29085.exe
3016	Unicorn-55701.exe
2576	Unicorn-46251.exe
3048	Unicorn-18953.exe
2792	Unicorn-58332.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2100	2436	6fcd18ab8241f017198f3fc323e4c6f93760c43e3b85df837a31b86d0a1bc715N.exe	29
PID 2436 wrote to memory of 2100	2436	6fcd18ab8241f017198f3fc323e4c6f93760c43e3b85df837a31b86d0a1bc715N.exe	29
PID 2436 wrote to memory of 2100	2436	6fcd18ab8241f017198f3fc323e4c6f93760c43e3b85df837a31b86d0a1bc715N.exe	29
PID 2436 wrote to memory of 2100	2436	6fcd18ab8241f017198f3fc323e4c6f93760c43e3b85df837a31b86d0a1bc715N.exe	29
PID 2100 wrote to memory of 2796	2100	Unicorn-59771.exe	30
PID 2100 wrote to memory of 2796	2100	Unicorn-59771.exe	30
PID 2100 wrote to memory of 2796	2100	Unicorn-59771.exe	30
PID 2100 wrote to memory of 2796	2100	Unicorn-59771.exe	30
PID 2436 wrote to memory of 2144	2436	6fcd18ab8241f017198f3fc323e4c6f93760c43e3b85df837a31b86d0a1bc715N.exe	31
PID 2436 wrote to memory of 2144	2436	6fcd18ab8241f017198f3fc323e4c6f93760c43e3b85df837a31b86d0a1bc715N.exe	31
PID 2436 wrote to memory of 2144	2436	6fcd18ab8241f017198f3fc323e4c6f93760c43e3b85df837a31b86d0a1bc715N.exe	31
PID 2436 wrote to memory of 2144	2436	6fcd18ab8241f017198f3fc323e4c6f93760c43e3b85df837a31b86d0a1bc715N.exe	31
PID 2144 wrote to memory of 2748	2144	Unicorn-59013.exe	32
PID 2144 wrote to memory of 2748	2144	Unicorn-59013.exe	32
PID 2144 wrote to memory of 2748	2144	Unicorn-59013.exe	32
PID 2144 wrote to memory of 2748	2144	Unicorn-59013.exe	32
PID 2100 wrote to memory of 2880	2100	Unicorn-59771.exe	33
PID 2100 wrote to memory of 2880	2100	Unicorn-59771.exe	33
PID 2100 wrote to memory of 2880	2100	Unicorn-59771.exe	33
PID 2100 wrote to memory of 2880	2100	Unicorn-59771.exe	33
PID 2796 wrote to memory of 2768	2796	Unicorn-4597.exe	34
PID 2796 wrote to memory of 2768	2796	Unicorn-4597.exe	34
PID 2796 wrote to memory of 2768	2796	Unicorn-4597.exe	34
PID 2796 wrote to memory of 2768	2796	Unicorn-4597.exe	34
PID 2436 wrote to memory of 1704	2436	6fcd18ab8241f017198f3fc323e4c6f93760c43e3b85df837a31b86d0a1bc715N.exe	35
PID 2436 wrote to memory of 1704	2436	6fcd18ab8241f017198f3fc323e4c6f93760c43e3b85df837a31b86d0a1bc715N.exe	35
PID 2436 wrote to memory of 1704	2436	6fcd18ab8241f017198f3fc323e4c6f93760c43e3b85df837a31b86d0a1bc715N.exe	35
PID 2436 wrote to memory of 1704	2436	6fcd18ab8241f017198f3fc323e4c6f93760c43e3b85df837a31b86d0a1bc715N.exe	35
PID 1704 wrote to memory of 1516	1704	Unicorn-60875.exe	36
PID 1704 wrote to memory of 1516	1704	Unicorn-60875.exe	36
PID 1704 wrote to memory of 1516	1704	Unicorn-60875.exe	36
PID 1704 wrote to memory of 1516	1704	Unicorn-60875.exe	36
PID 2436 wrote to memory of 2004	2436	6fcd18ab8241f017198f3fc323e4c6f93760c43e3b85df837a31b86d0a1bc715N.exe	38
PID 2436 wrote to memory of 2004	2436	6fcd18ab8241f017198f3fc323e4c6f93760c43e3b85df837a31b86d0a1bc715N.exe	38
PID 2436 wrote to memory of 2004	2436	6fcd18ab8241f017198f3fc323e4c6f93760c43e3b85df837a31b86d0a1bc715N.exe	38
PID 2436 wrote to memory of 2004	2436	6fcd18ab8241f017198f3fc323e4c6f93760c43e3b85df837a31b86d0a1bc715N.exe	38
PID 2748 wrote to memory of 2528	2748	Unicorn-10788.exe	39
PID 2748 wrote to memory of 2528	2748	Unicorn-10788.exe	39
PID 2748 wrote to memory of 2528	2748	Unicorn-10788.exe	39
PID 2748 wrote to memory of 2528	2748	Unicorn-10788.exe	39
PID 2880 wrote to memory of 3056	2880	Unicorn-55308.exe	40
PID 2880 wrote to memory of 3056	2880	Unicorn-55308.exe	40
PID 2880 wrote to memory of 3056	2880	Unicorn-55308.exe	40
PID 2880 wrote to memory of 3056	2880	Unicorn-55308.exe	40
PID 2144 wrote to memory of 2680	2144	Unicorn-59013.exe	41
PID 2144 wrote to memory of 2680	2144	Unicorn-59013.exe	41
PID 2144 wrote to memory of 2680	2144	Unicorn-59013.exe	41
PID 2144 wrote to memory of 2680	2144	Unicorn-59013.exe	41
PID 2100 wrote to memory of 2432	2100	Unicorn-59771.exe	37
PID 2100 wrote to memory of 2432	2100	Unicorn-59771.exe	37
PID 2100 wrote to memory of 2432	2100	Unicorn-59771.exe	37
PID 2100 wrote to memory of 2432	2100	Unicorn-59771.exe	37
PID 3056 wrote to memory of 1788	3056	Unicorn-29676.exe	42
PID 3056 wrote to memory of 1788	3056	Unicorn-29676.exe	42
PID 3056 wrote to memory of 1788	3056	Unicorn-29676.exe	42
PID 3056 wrote to memory of 1788	3056	Unicorn-29676.exe	42
PID 2432 wrote to memory of 1556	2432	Unicorn-23545.exe	43
PID 2432 wrote to memory of 1556	2432	Unicorn-23545.exe	43
PID 2432 wrote to memory of 1556	2432	Unicorn-23545.exe	43
PID 2432 wrote to memory of 1556	2432	Unicorn-23545.exe	43
PID 2880 wrote to memory of 436	2880	Unicorn-55308.exe	44
PID 2880 wrote to memory of 436	2880	Unicorn-55308.exe	44
PID 2880 wrote to memory of 436	2880	Unicorn-55308.exe	44
PID 2880 wrote to memory of 436	2880	Unicorn-55308.exe	44

C:\Users\Admin\AppData\Local\Temp\6fcd18ab8241f017198f3fc323e4c6f93760c43e3b85df837a31b86d0a1bc715N.exe
"C:\Users\Admin\AppData\Local\Temp\6fcd18ab8241f017198f3fc323e4c6f93760c43e3b85df837a31b86d0a1bc715N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59771.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59771.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4597.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4597.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 240
      4⤵
      Loads dropped DLL
      Program crash
      PID:2768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55308.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55308.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29676.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15857.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54445.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38161.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20064.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17090.exe
        8⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2313.exe
        8⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46809.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33123.exe
        8⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8218.exe
        7⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50073.exe
        7⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40930.exe
        7⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21608.exe
        7⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33846.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50392.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29085.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61952.exe
        7⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63966.exe
        7⤵
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45564.exe
        7⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12340.exe
        7⤵
        
        PID:4980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18953.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65024.exe
        6⤵
        
        PID:2160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12903.exe
        6⤵
        
        PID:3260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46783.exe
        6⤵
        
        PID:3292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31180.exe
        6⤵
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35648.exe
        6⤵
        
        PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24906.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29609.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55701.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46810.exe
        8⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24796.exe
        8⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        8⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29534.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61952.exe
        7⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38288.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6447.exe
        7⤵
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39659.exe
        7⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16118.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46251.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59747.exe
        7⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12269.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48364.exe
        7⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5252.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59482.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23204.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20860.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29406.exe
        6⤵
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9446.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60987.exe
        6⤵
        
        PID:2252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3250.exe
        6⤵
        
        PID:4080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15691.exe
        6⤵
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5444.exe
        6⤵
        
        PID:5016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27819.exe
        5⤵
        
        PID:2244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33816.exe
        6⤵
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3515.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7653.exe
        6⤵
        
        PID:4340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21863.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31128.exe
        5⤵
        
        PID:3844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54952.exe
        5⤵
        
        PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8585.exe
        5⤵
        
        PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19821.exe
        5⤵
        
        PID:5752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41958.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38078.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3040
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 200
        6⤵
        Program crash
        
        PID:2016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11513.exe
        5⤵
        
        PID:2620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55938.exe
        6⤵
        
        PID:1020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7333.exe
        6⤵
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25496.exe
        6⤵
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13198.exe
        6⤵
        
        PID:5028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57967.exe
        5⤵
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17766.exe
        6⤵
        
        PID:3960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55096.exe
        6⤵
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46.exe
        6⤵
        
        PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63521.exe
        5⤵
        
        PID:3916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-295.exe
        5⤵
        
        PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5560.exe
        5⤵
        
        PID:4836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39156.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31519.exe
        5⤵
        
        PID:2324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17193.exe
        5⤵
        
        PID:928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33321.exe
        5⤵
        
        PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49102.exe
        5⤵
        
        PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16841.exe
        5⤵
        
        PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35633.exe
        5⤵
        
        PID:5864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11876.exe
      4⤵
      PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21782.exe
        5⤵
        
        PID:3476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16130.exe
        6⤵
        
        PID:4336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20382.exe
        6⤵
        
        PID:6064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36104.exe
        5⤵
        
        PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19630.exe
        5⤵
        
        PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14764.exe
        5⤵
        
        PID:4536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27360.exe
      4⤵
      PID:2864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45890.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38118.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7875.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23545.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23545.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61824.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62151.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36070.exe
        6⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26499.exe
        7⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43514.exe
        7⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40388.exe
        7⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5444.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6633.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15340.exe
        6⤵
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-991.exe
        6⤵
        
        PID:4908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5030.exe
        6⤵
        
        PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59349.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39528.exe
        5⤵
        
        PID:1052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31102.exe
        5⤵
        
        PID:3984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5299.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12999.exe
        5⤵
        
        PID:5152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32965.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28369.exe
        5⤵
        
        PID:2968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35688.exe
        5⤵
        
        PID:3036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49549.exe
        5⤵
        
        PID:3264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62397.exe
        5⤵
        
        PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28875.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38959.exe
      4⤵
      PID:2168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14920.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22809.exe
      4⤵
      PID:1328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35731.exe
      4⤵
      PID:3664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21052.exe
      4⤵
      PID:4356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41767.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30976.exe
      4⤵
      PID:5968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61559.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61559.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45239.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30953.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13516.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62311.exe
        7⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59901.exe
        7⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7830.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61952.exe
        6⤵
        
        PID:2116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38288.exe
        6⤵
        
        PID:4044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4654.exe
        6⤵
        
        PID:4316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38160.exe
        6⤵
        
        PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33339.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52544.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30795.exe
        6⤵
        
        PID:3824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40995.exe
        6⤵
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46809.exe
        6⤵
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49652.exe
        6⤵
        
        PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10150.exe
        5⤵
        
        PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44153.exe
        5⤵
        
        PID:4056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5950.exe
        5⤵
        
        PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57057.exe
        5⤵
        
        PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41352.exe
        5⤵
        
        PID:5732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23806.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45089.exe
        5⤵
        
        PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3208.exe
        5⤵
        
        PID:908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38532.exe
        5⤵
        
        PID:3608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46253.exe
        5⤵
        
        PID:4388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62316.exe
        5⤵
        
        PID:5096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49286.exe
      4⤵
      PID:1736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36675.exe
        5⤵
        
        PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27178.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        5⤵
        
        PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29534.exe
        5⤵
        
        PID:2296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34210.exe
      4⤵
      PID:952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53381.exe
      4⤵
      PID:3592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43444.exe
      4⤵
      PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9094.exe
      4⤵
      PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1319.exe
      4⤵
      PID:5940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12380.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12380.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60849.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64137.exe
        5⤵
        
        PID:560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2544.exe
        5⤵
        
        PID:3372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8750.exe
        5⤵
        
        PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16720.exe
        5⤵
        
        PID:4488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40822.exe
        5⤵
        
        PID:5608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36487.exe
      4⤵
      PID:848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14442.exe
      4⤵
      PID:3456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24593.exe
      4⤵
      PID:4172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21608.exe
      4⤵
      PID:4852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41822.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41822.exe
      4⤵
      PID:5476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29950.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29950.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38462.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38462.exe
    3⤵
    PID:3280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1535.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1535.exe
    3⤵
    PID:3452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31527.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31527.exe
    3⤵
    PID:4924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48431.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48431.exe
    3⤵
    PID:4708
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59013.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59013.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10788.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10788.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29676.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4647.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52831.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36506.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65492.exe
        8⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8504.exe
        8⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13695.exe
        8⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52160.exe
        7⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9658.exe
        7⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49280.exe
        7⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24286.exe
        7⤵
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52738.exe
        6⤵
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48730.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17401.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22377.exe
        7⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21689.exe
        6⤵
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5230.exe
        6⤵
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5560.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41517.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55416.exe
        6⤵
        
        PID:1652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26996.exe
        6⤵
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35896.exe
        6⤵
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49280.exe
        6⤵
        
        PID:5104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24286.exe
        6⤵
        
        PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-936.exe
        5⤵
        
        PID:748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46597.exe
        5⤵
        
        PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22535.exe
        5⤵
        
        PID:3404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-295.exe
        5⤵
        
        PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30065.exe
        5⤵
        
        PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8518.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12888.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28945.exe
        6⤵
        
        PID:2180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25792.exe
        6⤵
        
        PID:780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25236.exe
        6⤵
        
        PID:3988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62397.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28875.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34652.exe
        5⤵
        
        PID:2504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34078.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63840.exe
        5⤵
        
        PID:2524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52390.exe
        5⤵
        
        PID:1988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52010.exe
        5⤵
        
        PID:4900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49374.exe
        5⤵
        
        PID:5368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48175.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23735.exe
        5⤵
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
        6⤵
        
        PID:3828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5895.exe
        6⤵
        
        PID:5048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15998.exe
        6⤵
        
        PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16342.exe
        5⤵
        
        PID:1480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22465.exe
        5⤵
        
        PID:3760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8175.exe
        5⤵
        
        PID:3396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        5⤵
        
        PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28344.exe
        5⤵
        
        PID:4480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31254.exe
      4⤵
      PID:1680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25142.exe
        5⤵
        
        PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28128.exe
      4⤵
      PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38490.exe
      4⤵
      PID:3944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58393.exe
      4⤵
      PID:4940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8534.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58819.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58819.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29536.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43039.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61534.exe
        6⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37443.exe
        7⤵
        
        PID:820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3250.exe
        7⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56532.exe
        7⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38200.exe
        7⤵
        
        PID:4588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41121.exe
        6⤵
        
        PID:2820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65226.exe
        6⤵
        
        PID:3324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5320.exe
        6⤵
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62514.exe
        6⤵
        
        PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7159.exe
        5⤵
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62662.exe
        6⤵
        
        PID:4748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18599.exe
        6⤵
        
        PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63456.exe
        5⤵
        
        PID:1924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22550.exe
        5⤵
        
        PID:3872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12891.exe
        5⤵
        
        PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12340.exe
        5⤵
        
        PID:4964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9084.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7920.exe
        5⤵
        
        PID:2112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exe
        5⤵
        
        PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8750.exe
        5⤵
        
        PID:3792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48324.exe
        5⤵
        
        PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40822.exe
        5⤵
        
        PID:5724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17464.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56161.exe
        5⤵
        
        PID:2096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25211.exe
        5⤵
        
        PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8750.exe
        5⤵
        
        PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16720.exe
        5⤵
        
        PID:4524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32653.exe
        5⤵
        
        PID:5572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33312.exe
      4⤵
      PID:2424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36146.exe
      4⤵
      PID:1640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25124.exe
      4⤵
      PID:4156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17143.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14956.exe
      4⤵
      PID:5488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64054.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64054.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20076.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21026.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29843.exe
        6⤵
        
        PID:1732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26996.exe
        6⤵
        
        PID:3316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25335.exe
        6⤵
        
        PID:3628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49280.exe
        6⤵
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24286.exe
        6⤵
        
        PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11129.exe
        5⤵
        
        PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40732.exe
        5⤵
        
        PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38025.exe
        5⤵
        
        PID:3868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24812.exe
        5⤵
        
        PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11653.exe
        5⤵
        
        PID:5704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51513.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45188.exe
        5⤵
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21937.exe
        6⤵
        
        PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36337.exe
        5⤵
        
        PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-582.exe
        5⤵
        
        PID:3388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8552.exe
        5⤵
        
        PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32653.exe
        5⤵
        
        PID:5676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55285.exe
      4⤵
      PID:2456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39794.exe
      4⤵
      PID:3832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5950.exe
      4⤵
      PID:3964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23123.exe
      4⤵
      PID:4680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41352.exe
      4⤵
      PID:5560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44974.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44974.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55416.exe
      4⤵
      PID:1220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53546.exe
        5⤵
        
        PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60552.exe
        5⤵
        
        PID:108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42459.exe
        5⤵
        
        PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49487.exe
        5⤵
        
        PID:5688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26996.exe
      4⤵
      PID:3344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25335.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16607.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29719.exe
      4⤵
      PID:5428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46486.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46486.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21396.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21396.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23065.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23065.exe
    3⤵
    PID:3524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61367.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61367.exe
    3⤵
    PID:4120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44231.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44231.exe
    3⤵
    PID:4576
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60875.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60875.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43456.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43456.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61824.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47398.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5478.exe
        6⤵
        
        PID:860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50573.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10254.exe
        7⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32334.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16150.exe
        6⤵
        
        PID:2560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4266.exe
        6⤵
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49208.exe
        6⤵
        
        PID:1236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41003.exe
        6⤵
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16118.exe
        6⤵
        
        PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3869.exe
        5⤵
        
        PID:1008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30077.exe
        5⤵
        
        PID:2092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28331.exe
        5⤵
        
        PID:3768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7678.exe
        5⤵
        
        PID:4068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65469.exe
        5⤵
        
        PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30226.exe
        5⤵
        
        PID:6048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43183.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14331.exe
        5⤵
        
        PID:2104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3343.exe
        6⤵
        
        PID:1060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56068.exe
        6⤵
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2310.exe
        6⤵
        
        PID:3416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57805.exe
        6⤵
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4999.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58143.exe
        5⤵
        
        PID:1536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20410.exe
        5⤵
        
        PID:3572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14615.exe
        5⤵
        
        PID:4028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39659.exe
        5⤵
        
        PID:4656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16118.exe
        5⤵
        
        PID:5744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64885.exe
      4⤵
      PID:1752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18523.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12269.exe
        5⤵
        
        PID:3812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5817.exe
        5⤵
        
        PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5030.exe
        5⤵
        
        PID:5064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35751.exe
      4⤵
      PID:1280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1466.exe
      4⤵
      PID:3688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22087.exe
      4⤵
      PID:3312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40189.exe
      4⤵
      PID:4640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11653.exe
      4⤵
      PID:5640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9670.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9670.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38078.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2088
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 200
        5⤵
        Program crash
        
        PID:2204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46625.exe
      4⤵
      PID:1492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40732.exe
      4⤵
      PID:3304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31201.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16830.exe
      4⤵
      PID:2676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44556.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18710.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18710.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47663.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17577.exe
      4⤵
      PID:2052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16985.exe
      4⤵
      PID:4072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46061.exe
      4⤵
      PID:4468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28875.exe
      4⤵
      PID:3000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19547.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19547.exe
    3⤵
    PID:2804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30995.exe
      4⤵
      PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
        5⤵
        
        PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46928.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7830.exe
        5⤵
        
        PID:4812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26996.exe
      4⤵
      PID:3268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25335.exe
      4⤵
      PID:3496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49280.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24286.exe
      4⤵
      PID:5592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16904.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16904.exe
    3⤵
    PID:2484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60712.exe
      4⤵
      PID:700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1138.exe
      4⤵
      PID:3860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26817.exe
      4⤵
      PID:4108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46809.exe
      4⤵
      PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33123.exe
      4⤵
      PID:1116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54808.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54808.exe
    3⤵
    PID:2132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34025.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34025.exe
    3⤵
    PID:3952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56031.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56031.exe
    3⤵
    PID:4136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48431.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48431.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4832
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29411.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29411.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20792.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20792.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12229.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36016.exe
        5⤵
        
        PID:2540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64236.exe
        5⤵
        
        PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22356.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38143.exe
        5⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16588.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3153.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49476.exe
      4⤵
      PID:3440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31201.exe
      4⤵
      PID:3584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-72.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-72.exe
      4⤵
      PID:4996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22280.exe
      4⤵
      PID:5400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27532.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27532.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62001.exe
      4⤵
      PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19352.exe
      4⤵
      PID:2724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49549.exe
      4⤵
      PID:3276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5320.exe
      4⤵
      PID:4676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44556.exe
      4⤵
      PID:5376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54719.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54719.exe
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39337.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39337.exe
    3⤵
    PID:2264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40501.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40501.exe
    3⤵
    PID:3432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37196.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37196.exe
    3⤵
    PID:4448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17262.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17262.exe
    3⤵
    PID:4584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1319.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1319.exe
    3⤵
    PID:5948
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20605.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20605.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29665.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29665.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58332.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46862.exe
        5⤵
        
        PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11600.exe
        5⤵
        
        PID:3500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19630.exe
        5⤵
        
        PID:5040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61984.exe
        5⤵
        
        PID:5952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
      4⤵
      PID:2572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16279.exe
      4⤵
      PID:3364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14615.exe
      4⤵
      PID:3536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8714.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24286.exe
      4⤵
      PID:5716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49234.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49234.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28735.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28735.exe
    3⤵
    PID:2472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17610.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17610.exe
    3⤵
    PID:3548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54952.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54952.exe
    3⤵
    PID:3700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-417.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-417.exe
    3⤵
    PID:4296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11653.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11653.exe
    3⤵
    PID:5660
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37199.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37199.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60712.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60712.exe
    3⤵
    PID:1644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52092.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52092.exe
    3⤵
    PID:3876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62689.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62689.exe
    3⤵
    PID:4688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54032.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54032.exe
    3⤵
    PID:4444
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19683.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19683.exe
  2⤵
  PID:2220
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26272.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26272.exe
  2⤵
  PID:3908
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45151.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45151.exe
  2⤵
  PID:3888
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51456.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51456.exe
  2⤵
  PID:4464
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56487.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56487.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10788.exe

Filesize
468KB

MD5
4462120341a0d61eaf7c9f774e05c967

SHA1
711a5621ffbd5d9ef7cea7528c6d3671dda25e68

SHA256
ca00d836f4375329cde39553d34b249032df441dacd14f5fe4bc6106666f1781

SHA512
b8530454ea44a5f0114e7c486b39b1e28418c2032ece3b00b701fae690e651189db7e4c1b50701f07779518ea9d3790dd7c8203370bce424c66d8818834fb8de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29676.exe

Filesize
468KB

MD5
89984280192355a6722cb9006fe52640

SHA1
157a7adbfd60f3796f657d37d27867433930bb11

SHA256
b5fc88dc47e27a1768b2e8c93fad7212ec7006bc257455933ec51fde75a4ecff

SHA512
03134ed12ff995cc30fa6b7162fb78ddb52f77fdb329856bb8546d11a7e453e8207ee4a05e8de466028fb241fdd2eff9a17fd320ef577be582b7663c22b30cd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41958.exe

Filesize
468KB

MD5
383b8314b90e6ec9a9389f30ae6eefad

SHA1
d452bdf39a23f3973145a1e7dd9af3aa62a4d977

SHA256
c74f3fc30b9b5c75249a0f28902396a9f93f45c971554e71d07b280afe51b151

SHA512
3c103962401a45b88cc470d3bbba8d4ebf9d0c645af6869864854b6a2bf763d93ff994daeec2e261d7bccc3fab9114e5b9068007c61d33bdaf568c93d60c91a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43456.exe

Filesize
468KB

MD5
6f5cc5b32c2cf7da43b5d0fb0ee000dc

SHA1
7737b2a1b23b1cc3ce5b9b3f0dd7817d34a41c33

SHA256
7d556557d240e345c8bea5f84d36ffb310be3617012d3c46dd920efbaa2b403f

SHA512
9a9565ff4a1da150c724769e74f2c4cf1827506be4e6268934e68b81b0ff113b9adacbf0bc1bf2ecb9c4f4001208c57ba6f35308157f23a1f563e76f7ad01402

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58819.exe

Filesize
468KB

MD5
548f13b0eebf891dfbf087fd6464e6e1

SHA1
cf808fb3160ce958090a868cf6630eaed6e8c9c2

SHA256
4fd597feba2cd389632c663a0d2fb16e23941650a70eeac306fdfe2e73502f71

SHA512
90547cff74c40dc3cd83f50b4713cb453d429ecc23097419ac2700d4c43a7c6faff476b735d272cabcf6ea5f36094d59e13db358dabba4af4d7e7259a056a13f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60875.exe

Filesize
468KB

MD5
408e770b5eb170dd4bc713cad122de55

SHA1
bee7f59e57e8ed0ecfc4a8ca8c10ef1b19b7f936

SHA256
a803e6c184cdda95c644b7379dc9e41c27e2d79bceb98b31311831727405b7a0

SHA512
5d3e489006662b8d82fbe15d1c5084d9d32931821e248ae11ee86c7b5441ae09f08878739d12de2d958b405b85bccebdcc17f4c9d9d75e0353aa75e0febc9f66

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61824.exe

Filesize
468KB

MD5
265671f6905003b811034964af81d709

SHA1
50832f8abcd63b4e78e221f41f5f785cf1c81bcd

SHA256
e4faf09d505cbb5e501ad75b4921802c912600a83b1a39bdaed77526a4fac387

SHA512
c6bd8db7e76d865442a5528717695e432c16f7f373839d613e8771e9de03051ec1b2223acbe8ba32f82d555a67efe7df3e3cb65b4f7fa8359c8141e645eaebb1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15857.exe

Filesize
468KB

MD5
d2acb37634b2956c1f47d9b4406c6db9

SHA1
bf59f97e27d5c310fd97e6a9958980b557ad239f

SHA256
4513d792acc351f63450287b3216886baaff91d9b77a43fbd73109935cfc4c3e

SHA512
2a4897f89e18cab0239720cb76cfeb4b9015ecdb1fc7a9e0fff4b60f54ab9c14350d1e57d6c9b5be3a784fd3a54e5d3ced0cb53e819db4efc6d9ed25eb3ee689

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23545.exe

Filesize
468KB

MD5
b897ad52187e2ee833930db0864b89e8

SHA1
b4495d51bf602c3917c9623b52ab213b9ead5e82

SHA256
8c2d65a84360ae601dde3e1f732e4e5e9a95beb97ca3adc42b2e5583a83c07d1

SHA512
f2b6253951b1670ccd22254d549fd14deb246181c3ef27a2dd1a31ec0082a4d961d1df43e2b1741bec967617dcb602843f331ba6faf16fe1b2a1dcc1866f42b7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29411.exe

Filesize
468KB

MD5
8ad83b323301ce3a42d0a91b800b6049

SHA1
3dfd6c600a028951b9d0bd230253c767b1f9dbc3

SHA256
eb9db9efbbb9f01e3f8ddab8f3d497faab461ca0cdff60199eba8707002f9abb

SHA512
c30c9bbbaf8094ac98077a0a68c89a95115c3943aedd12bf952ebd0cc4ef11d40a0a524f7039893671d716bcb82f99fb386461a9164b928b102b80370c9f0f71

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4597.exe

Filesize
468KB

MD5
cb3da6b849057514c559e1ecf97a1f06

SHA1
e5d756bd60c3f0aecc9e6cf1d039e467c715474c

SHA256
bf8f1d8b563208f61cbdcab5215897c602854d0943a80cac3f04e108a45933d5

SHA512
c3c966f7658ab2fba64550fca68b70babe21b290abae231534d38739ba252491b1deee8524cd5177cf8ee3628b9073e781f2334585b0b1316c3ab8eda67b4cb3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55308.exe

Filesize
468KB

MD5
0c6a7b02aef92e32afc644be58fd769e

SHA1
91a797b67ebc642e2bd2fd7322dc650a087997db

SHA256
3aeeec7f4c56c65e00e8c77fe64507277f802219a0dd0abca62c7e7ab21d3b01

SHA512
9bb6df68958c79402f812af7a53a2fd39e54ba020c0ddf2d48f3e6452e9968944ea442a37b624688dbb2029e0799cde27e31f5ec9806876f93732dd36f5294af

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59013.exe

Filesize
468KB

MD5
e6bad93f6be5bb6545f221311b09cafc

SHA1
fc0b612a7c5637b1472b46729dc96572141b3298

SHA256
3d292cbd131e430ce9fdbc8a2c74b19e08e661b9e85882134913d930b7a5b7ff

SHA512
17611c4061969d574d686a3fee1d9f0770fa2eb2092a9176390554bc0b24f20fe02a34076e3f73c528360b8f3457366b46f06dda5caf742360a1fc3f4344a576

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59771.exe

Filesize
468KB

MD5
b8147986fd36c61e139322ea946b5e0a

SHA1
87611ac1c84d4491375b73d0098008f3ffc54bb6

SHA256
b0761871221d317c54b61aa5c1b13b9590424dcda689bf48bd30715e717dc467

SHA512
5cc958b16e01bcefb12fd765f66382f6757d4333351b3910289aac24110b0a92c4976919cc6c0e21bf487a0fae3f83f91b7d4958af034fd6aa11f459f0302a87

Download Submit
memory/436-379-0x0000000003370000-0x00000000033E5000-memory.dmp

Filesize
468KB

Download
memory/436-184-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/752-301-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/752-234-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/752-305-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/916-237-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/968-364-0x00000000023C0000-0x0000000002435000-memory.dmp

Filesize
468KB

Download
memory/968-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1056-402-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/1516-92-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1516-191-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/1516-194-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/1556-327-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/1556-335-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/1576-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1704-192-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/1704-90-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/1704-193-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/1704-68-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1788-159-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1788-275-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/1788-276-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/1980-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2004-236-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2004-203-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2004-116-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2100-325-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2100-23-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2100-202-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2100-326-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2100-136-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2100-226-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2100-115-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2100-384-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2120-295-0x00000000024D0000-0x0000000002545000-memory.dmp

Filesize
468KB

Download
memory/2120-296-0x00000000024D0000-0x0000000002545000-memory.dmp

Filesize
468KB

Download
memory/2120-252-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2144-247-0x0000000002710000-0x0000000002785000-memory.dmp

Filesize
468KB

Download
memory/2144-251-0x0000000002710000-0x0000000002785000-memory.dmp

Filesize
468KB

Download
memory/2144-34-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2144-316-0x0000000002710000-0x0000000002785000-memory.dmp

Filesize
468KB

Download
memory/2144-123-0x0000000002710000-0x0000000002785000-memory.dmp

Filesize
468KB

Download
memory/2144-134-0x0000000002710000-0x0000000002785000-memory.dmp

Filesize
468KB

Download
memory/2144-315-0x0000000002710000-0x0000000002785000-memory.dmp

Filesize
468KB

Download
memory/2144-47-0x0000000002710000-0x0000000002785000-memory.dmp

Filesize
468KB

Download
memory/2200-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2212-401-0x0000000000350000-0x00000000003C5000-memory.dmp

Filesize
468KB

Download
memory/2212-277-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2276-313-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2312-405-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2384-195-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2384-380-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2432-181-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/2432-342-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/2432-170-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/2432-353-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/2436-245-0x0000000000340000-0x00000000003B5000-memory.dmp

Filesize
468KB

Download
memory/2436-6-0x0000000000340000-0x00000000003B5000-memory.dmp

Filesize
468KB

Download
memory/2436-118-0x0000000000340000-0x00000000003B5000-memory.dmp

Filesize
468KB

Download
memory/2436-227-0x0000000000340000-0x00000000003B5000-memory.dmp

Filesize
468KB

Download
memory/2436-367-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2436-12-0x0000000000340000-0x00000000003B5000-memory.dmp

Filesize
468KB

Download
memory/2436-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2528-338-0x0000000002360000-0x00000000023D5000-memory.dmp

Filesize
468KB

Download
memory/2528-352-0x0000000002360000-0x00000000023D5000-memory.dmp

Filesize
468KB

Download
memory/2528-240-0x0000000002360000-0x00000000023D5000-memory.dmp

Filesize
468KB

Download
memory/2528-238-0x0000000002360000-0x00000000023D5000-memory.dmp

Filesize
468KB

Download
memory/2552-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2552-341-0x00000000026D0000-0x0000000002745000-memory.dmp

Filesize
468KB

Download
memory/2552-354-0x00000000026D0000-0x0000000002745000-memory.dmp

Filesize
468KB

Download
memory/2632-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2648-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2652-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2680-225-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/2680-235-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/2680-375-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/2680-139-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2680-371-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/2716-356-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2748-239-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2748-242-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2748-49-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2764-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2796-26-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2868-336-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2880-66-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2880-182-0x0000000001CD0000-0x0000000001D45000-memory.dmp

Filesize
468KB

Download
memory/2880-178-0x0000000001CD0000-0x0000000001D45000-memory.dmp

Filesize
468KB

Download
memory/2880-378-0x0000000001CD0000-0x0000000001D45000-memory.dmp

Filesize
468KB

Download
memory/2888-297-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2996-244-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3040-392-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3056-122-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3056-285-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3056-286-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3056-157-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download