8c1def86396a846bf2e5e11d5d15899bf935d2b887512be290f2a0b4560c1ae4

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 08:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c1def86396a846bf2e5e11d5d15899bf935d2b887512be290f2a0b4560c1ae4N.exe
Size

468KB
MD5

5c4bdc1f551690f3096bdc4ae6ddb5f0
SHA1

4152aba937db9eece49ce1c0ff9e564b370cb761
SHA256

8c1def86396a846bf2e5e11d5d15899bf935d2b887512be290f2a0b4560c1ae4
SHA512

a46665b2742af49c7f2c74dc5fd34c710ee68e6514d243298fb042bf51f7aea05bb2df8bdd0564e28104dc1596a591d3e53ea1aebaf70fff38b0572957f5a907
SSDEEP

3072:bRcSogu1zU8hwbY4PzrjOf8FlC5dSZpCndH2ZVTUszf3GVONztlQ:bRZoRZhwvPPjOfIv5MszfiONz

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3004	Unicorn-3483.exe
2928	Unicorn-53810.exe
2712	Unicorn-42112.exe
2736	Unicorn-27944.exe
2944	Unicorn-27944.exe
2852	Unicorn-18990.exe
3056	Unicorn-5255.exe
2680	Unicorn-7326.exe
2552	Unicorn-5717.exe
2140	Unicorn-26844.exe
1912	Unicorn-63470.exe
1720	Unicorn-17799.exe
1976	Unicorn-17533.exe
1692	Unicorn-49314.exe
548	Unicorn-62313.exe
2812	Unicorn-5520.exe
2460	Unicorn-48281.exe
868	Unicorn-1575.exe
1088	Unicorn-48546.exe
2012	Unicorn-16066.exe
988	Unicorn-61737.exe
616	Unicorn-20407.exe
2476	Unicorn-6672.exe
1908	Unicorn-17607.exe
3064	Unicorn-26538.exe
1728	Unicorn-26538.exe
1092	Unicorn-56408.exe
1000	Unicorn-50056.exe
2880	Unicorn-4384.exe
2492	Unicorn-21606.exe
2780	Unicorn-3424.exe
2796	Unicorn-30233.exe
2716	Unicorn-32270.exe
1144	Unicorn-62749.exe
1716	Unicorn-55230.exe
1448	Unicorn-10371.exe
1016	Unicorn-24670.exe
1960	Unicorn-65132.exe
1936	Unicorn-8525.exe
1684	Unicorn-22748.exe
556	Unicorn-48214.exe
1680	Unicorn-54197.exe
1452	Unicorn-8525.exe
2128	Unicorn-48214.exe
1940	Unicorn-20887.exe
304	Unicorn-12012.exe
772	Unicorn-14756.exe
1080	Unicorn-17549.exe
964	Unicorn-37415.exe
1552	Unicorn-14124.exe
1800	Unicorn-55214.exe
700	Unicorn-15022.exe
932	Unicorn-18509.exe
2516	Unicorn-46735.exe
2240	Unicorn-44467.exe
2744	Unicorn-55095.exe
2300	Unicorn-14446.exe
2760	Unicorn-8316.exe
2620	Unicorn-40020.exe
3020	Unicorn-62059.exe
2428	Unicorn-26314.exe
1724	Unicorn-54348.exe
2168	Unicorn-61364.exe
2644	Unicorn-61099.exe

Loads dropped DLL 64 IoCs

pid	Process
2936	8c1def86396a846bf2e5e11d5d15899bf935d2b887512be290f2a0b4560c1ae4N.exe
2936	8c1def86396a846bf2e5e11d5d15899bf935d2b887512be290f2a0b4560c1ae4N.exe
3004	Unicorn-3483.exe
3004	Unicorn-3483.exe
2936	8c1def86396a846bf2e5e11d5d15899bf935d2b887512be290f2a0b4560c1ae4N.exe
2936	8c1def86396a846bf2e5e11d5d15899bf935d2b887512be290f2a0b4560c1ae4N.exe
2712	Unicorn-42112.exe
2928	Unicorn-53810.exe
2928	Unicorn-53810.exe
2712	Unicorn-42112.exe
2936	8c1def86396a846bf2e5e11d5d15899bf935d2b887512be290f2a0b4560c1ae4N.exe
2936	8c1def86396a846bf2e5e11d5d15899bf935d2b887512be290f2a0b4560c1ae4N.exe
3004	Unicorn-3483.exe
3004	Unicorn-3483.exe
2944	Unicorn-27944.exe
2944	Unicorn-27944.exe
2712	Unicorn-42112.exe
2712	Unicorn-42112.exe
3056	Unicorn-5255.exe
3056	Unicorn-5255.exe
2928	Unicorn-53810.exe
2936	8c1def86396a846bf2e5e11d5d15899bf935d2b887512be290f2a0b4560c1ae4N.exe
2928	Unicorn-53810.exe
2852	Unicorn-18990.exe
2936	8c1def86396a846bf2e5e11d5d15899bf935d2b887512be290f2a0b4560c1ae4N.exe
2852	Unicorn-18990.exe
2680	Unicorn-7326.exe
2680	Unicorn-7326.exe
2944	Unicorn-27944.exe
2944	Unicorn-27944.exe
2736	Unicorn-27944.exe
2736	Unicorn-27944.exe
3004	Unicorn-3483.exe
3004	Unicorn-3483.exe
2552	Unicorn-5717.exe
2712	Unicorn-42112.exe
2712	Unicorn-42112.exe
2552	Unicorn-5717.exe
3056	Unicorn-5255.exe
2140	Unicorn-26844.exe
2140	Unicorn-26844.exe
3056	Unicorn-5255.exe
2928	Unicorn-53810.exe
2928	Unicorn-53810.exe
2852	Unicorn-18990.exe
2852	Unicorn-18990.exe
2936	8c1def86396a846bf2e5e11d5d15899bf935d2b887512be290f2a0b4560c1ae4N.exe
2936	8c1def86396a846bf2e5e11d5d15899bf935d2b887512be290f2a0b4560c1ae4N.exe
1720	Unicorn-17799.exe
1976	Unicorn-17533.exe
1720	Unicorn-17799.exe
1976	Unicorn-17533.exe
1556	WerFault.exe
1556	WerFault.exe
1556	WerFault.exe
1556	WerFault.exe
1556	WerFault.exe
1556	WerFault.exe
1556	WerFault.exe
1692	Unicorn-49314.exe
1692	Unicorn-49314.exe
2680	Unicorn-7326.exe
548	Unicorn-62313.exe
2680	Unicorn-7326.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1556	1912	WerFault.exe	41
1924	888	WerFault.exe	138
4000	1812	WerFault.exe	137

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24114.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37787.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18103.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39206.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17814.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6823.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49773.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28753.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36732.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60533.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61069.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23325.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46798.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39206.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39142.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51222.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4559.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58070.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62749.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14124.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6139.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62490.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23737.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56292.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23437.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64407.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7407.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19481.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37007.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23437.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54197.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31838.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29303.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32838.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8178.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6672.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4384.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55768.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10760.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4559.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42760.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46597.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57733.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43409.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19531.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50981.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-861.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48546.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2493.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6328.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26224.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23517.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62059.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2936	8c1def86396a846bf2e5e11d5d15899bf935d2b887512be290f2a0b4560c1ae4N.exe
3004	Unicorn-3483.exe
2712	Unicorn-42112.exe
2928	Unicorn-53810.exe
2736	Unicorn-27944.exe
2944	Unicorn-27944.exe
2852	Unicorn-18990.exe
3056	Unicorn-5255.exe
2680	Unicorn-7326.exe
2552	Unicorn-5717.exe
2140	Unicorn-26844.exe
1912	Unicorn-63470.exe
1720	Unicorn-17799.exe
1976	Unicorn-17533.exe
1692	Unicorn-49314.exe
548	Unicorn-62313.exe
2812	Unicorn-5520.exe
868	Unicorn-1575.exe
2460	Unicorn-48281.exe
988	Unicorn-61737.exe
1908	Unicorn-17607.exe
616	Unicorn-20407.exe
1728	Unicorn-26538.exe
3064	Unicorn-26538.exe
2476	Unicorn-6672.exe
1088	Unicorn-48546.exe
2012	Unicorn-16066.exe
1092	Unicorn-56408.exe
1000	Unicorn-50056.exe
2880	Unicorn-4384.exe
2492	Unicorn-21606.exe
2780	Unicorn-3424.exe
2716	Unicorn-32270.exe
2796	Unicorn-30233.exe
1144	Unicorn-62749.exe
1716	Unicorn-55230.exe
1448	Unicorn-10371.exe
1016	Unicorn-24670.exe
1960	Unicorn-65132.exe
1936	Unicorn-8525.exe
1684	Unicorn-22748.exe
556	Unicorn-48214.exe
2128	Unicorn-48214.exe
1080	Unicorn-17549.exe
304	Unicorn-12012.exe
1940	Unicorn-20887.exe
772	Unicorn-14756.exe
1680	Unicorn-54197.exe
1452	Unicorn-8525.exe
964	Unicorn-37415.exe
1552	Unicorn-14124.exe
1800	Unicorn-55214.exe
700	Unicorn-15022.exe
932	Unicorn-18509.exe
2516	Unicorn-46735.exe
2744	Unicorn-55095.exe
2620	Unicorn-40020.exe
3020	Unicorn-62059.exe
2428	Unicorn-26314.exe
1724	Unicorn-54348.exe
2240	Unicorn-44467.exe
2300	Unicorn-14446.exe
2760	Unicorn-8316.exe
2168	Unicorn-61364.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 3004	2936	8c1def86396a846bf2e5e11d5d15899bf935d2b887512be290f2a0b4560c1ae4N.exe	30
PID 2936 wrote to memory of 3004	2936	8c1def86396a846bf2e5e11d5d15899bf935d2b887512be290f2a0b4560c1ae4N.exe	30
PID 2936 wrote to memory of 3004	2936	8c1def86396a846bf2e5e11d5d15899bf935d2b887512be290f2a0b4560c1ae4N.exe	30
PID 2936 wrote to memory of 3004	2936	8c1def86396a846bf2e5e11d5d15899bf935d2b887512be290f2a0b4560c1ae4N.exe	30
PID 3004 wrote to memory of 2928	3004	Unicorn-3483.exe	32
PID 3004 wrote to memory of 2928	3004	Unicorn-3483.exe	32
PID 3004 wrote to memory of 2928	3004	Unicorn-3483.exe	32
PID 3004 wrote to memory of 2928	3004	Unicorn-3483.exe	32
PID 2936 wrote to memory of 2712	2936	8c1def86396a846bf2e5e11d5d15899bf935d2b887512be290f2a0b4560c1ae4N.exe	33
PID 2936 wrote to memory of 2712	2936	8c1def86396a846bf2e5e11d5d15899bf935d2b887512be290f2a0b4560c1ae4N.exe	33
PID 2936 wrote to memory of 2712	2936	8c1def86396a846bf2e5e11d5d15899bf935d2b887512be290f2a0b4560c1ae4N.exe	33
PID 2936 wrote to memory of 2712	2936	8c1def86396a846bf2e5e11d5d15899bf935d2b887512be290f2a0b4560c1ae4N.exe	33
PID 2928 wrote to memory of 2736	2928	Unicorn-53810.exe	35
PID 2928 wrote to memory of 2736	2928	Unicorn-53810.exe	35
PID 2928 wrote to memory of 2736	2928	Unicorn-53810.exe	35
PID 2928 wrote to memory of 2736	2928	Unicorn-53810.exe	35
PID 2712 wrote to memory of 2944	2712	Unicorn-42112.exe	34
PID 2712 wrote to memory of 2944	2712	Unicorn-42112.exe	34
PID 2712 wrote to memory of 2944	2712	Unicorn-42112.exe	34
PID 2712 wrote to memory of 2944	2712	Unicorn-42112.exe	34
PID 2936 wrote to memory of 2852	2936	8c1def86396a846bf2e5e11d5d15899bf935d2b887512be290f2a0b4560c1ae4N.exe	36
PID 2936 wrote to memory of 2852	2936	8c1def86396a846bf2e5e11d5d15899bf935d2b887512be290f2a0b4560c1ae4N.exe	36
PID 2936 wrote to memory of 2852	2936	8c1def86396a846bf2e5e11d5d15899bf935d2b887512be290f2a0b4560c1ae4N.exe	36
PID 2936 wrote to memory of 2852	2936	8c1def86396a846bf2e5e11d5d15899bf935d2b887512be290f2a0b4560c1ae4N.exe	36
PID 3004 wrote to memory of 3056	3004	Unicorn-3483.exe	37
PID 3004 wrote to memory of 3056	3004	Unicorn-3483.exe	37
PID 3004 wrote to memory of 3056	3004	Unicorn-3483.exe	37
PID 3004 wrote to memory of 3056	3004	Unicorn-3483.exe	37
PID 2944 wrote to memory of 2680	2944	Unicorn-27944.exe	38
PID 2944 wrote to memory of 2680	2944	Unicorn-27944.exe	38
PID 2944 wrote to memory of 2680	2944	Unicorn-27944.exe	38
PID 2944 wrote to memory of 2680	2944	Unicorn-27944.exe	38
PID 2712 wrote to memory of 2552	2712	Unicorn-42112.exe	39
PID 2712 wrote to memory of 2552	2712	Unicorn-42112.exe	39
PID 2712 wrote to memory of 2552	2712	Unicorn-42112.exe	39
PID 2712 wrote to memory of 2552	2712	Unicorn-42112.exe	39
PID 3056 wrote to memory of 2140	3056	Unicorn-5255.exe	40
PID 3056 wrote to memory of 2140	3056	Unicorn-5255.exe	40
PID 3056 wrote to memory of 2140	3056	Unicorn-5255.exe	40
PID 3056 wrote to memory of 2140	3056	Unicorn-5255.exe	40
PID 2928 wrote to memory of 1912	2928	Unicorn-53810.exe	41
PID 2928 wrote to memory of 1912	2928	Unicorn-53810.exe	41
PID 2928 wrote to memory of 1912	2928	Unicorn-53810.exe	41
PID 2928 wrote to memory of 1912	2928	Unicorn-53810.exe	41
PID 2936 wrote to memory of 1976	2936	8c1def86396a846bf2e5e11d5d15899bf935d2b887512be290f2a0b4560c1ae4N.exe	42
PID 2936 wrote to memory of 1976	2936	8c1def86396a846bf2e5e11d5d15899bf935d2b887512be290f2a0b4560c1ae4N.exe	42
PID 2936 wrote to memory of 1976	2936	8c1def86396a846bf2e5e11d5d15899bf935d2b887512be290f2a0b4560c1ae4N.exe	42
PID 2936 wrote to memory of 1976	2936	8c1def86396a846bf2e5e11d5d15899bf935d2b887512be290f2a0b4560c1ae4N.exe	42
PID 2852 wrote to memory of 1720	2852	Unicorn-18990.exe	43
PID 2852 wrote to memory of 1720	2852	Unicorn-18990.exe	43
PID 2852 wrote to memory of 1720	2852	Unicorn-18990.exe	43
PID 2852 wrote to memory of 1720	2852	Unicorn-18990.exe	43
PID 2680 wrote to memory of 1692	2680	Unicorn-7326.exe	44
PID 2680 wrote to memory of 1692	2680	Unicorn-7326.exe	44
PID 2680 wrote to memory of 1692	2680	Unicorn-7326.exe	44
PID 2680 wrote to memory of 1692	2680	Unicorn-7326.exe	44
PID 2944 wrote to memory of 548	2944	Unicorn-27944.exe	45
PID 2944 wrote to memory of 548	2944	Unicorn-27944.exe	45
PID 2944 wrote to memory of 548	2944	Unicorn-27944.exe	45
PID 2944 wrote to memory of 548	2944	Unicorn-27944.exe	45
PID 2736 wrote to memory of 2812	2736	Unicorn-27944.exe	46
PID 2736 wrote to memory of 2812	2736	Unicorn-27944.exe	46
PID 2736 wrote to memory of 2812	2736	Unicorn-27944.exe	46
PID 2736 wrote to memory of 2812	2736	Unicorn-27944.exe	46

C:\Users\Admin\AppData\Local\Temp\8c1def86396a846bf2e5e11d5d15899bf935d2b887512be290f2a0b4560c1ae4N.exe
"C:\Users\Admin\AppData\Local\Temp\8c1def86396a846bf2e5e11d5d15899bf935d2b887512be290f2a0b4560c1ae4N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3483.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3483.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53810.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53810.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27944.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5520.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3424.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40020.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10352.exe
        8⤵
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37787.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45560.exe
        9⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64407.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49565.exe
        9⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29623.exe
        8⤵
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23437.exe
        8⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39149.exe
        8⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34273.exe
        8⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44862.exe
        7⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23872.exe
        7⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29303.exe
        7⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15182.exe
        7⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12742.exe
        7⤵
        
        PID:6456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26314.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45059.exe
        7⤵
        
        PID:1012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21965.exe
        8⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9702.exe
        8⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32838.exe
        8⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58230.exe
        8⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37704.exe
        7⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49436.exe
        7⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23298.exe
        7⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36732.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39142.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11840.exe
        7⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34588.exe
        7⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52365.exe
        7⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42872.exe
        6⤵
        
        PID:3532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61431.exe
        6⤵
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58070.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49773.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32270.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54348.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6249.exe
        7⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15493.exe
        7⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48181.exe
        7⤵
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23325.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58323.exe
        6⤵
        
        PID:2392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-951.exe
        6⤵
        
        PID:3876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29303.exe
        6⤵
        
        PID:4796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54121.exe
        6⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58263.exe
        6⤵
        
        PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61099.exe
        5⤵
        Executes dropped EXE
        
        PID:2644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58858.exe
        6⤵
        
        PID:2832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18103.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4911.exe
        6⤵
        
        PID:5084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64407.exe
        6⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57733.exe
        6⤵
        
        PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30576.exe
        5⤵
        
        PID:1508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12503.exe
        5⤵
        
        PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35314.exe
        5⤵
        
        PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34741.exe
        5⤵
        
        PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31397.exe
        5⤵
        
        PID:5384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63470.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1912
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 240
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:1556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20407.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37415.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12599.exe
        6⤵
        
        PID:768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23271.exe
        6⤵
        
        PID:3596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64231.exe
        6⤵
        
        PID:4236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44677.exe
        6⤵
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57733.exe
        6⤵
        
        PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25790.exe
        5⤵
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28753.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34588.exe
        6⤵
        
        PID:4484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62719.exe
        6⤵
        
        PID:6964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37007.exe
        5⤵
        
        PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42760.exe
        5⤵
        
        PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39206.exe
        5⤵
        
        PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58263.exe
        5⤵
        
        PID:6200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55214.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
        5⤵
        
        PID:1316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37969.exe
        6⤵
        
        PID:3324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3235.exe
        6⤵
        
        PID:4536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31434.exe
        6⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49565.exe
        6⤵
        
        PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23271.exe
        5⤵
        
        PID:3580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51425.exe
        5⤵
        
        PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55742.exe
        5⤵
        
        PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41197.exe
        5⤵
        
        PID:6300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36341.exe
      4⤵
      PID:2360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13038.exe
        5⤵
        
        PID:1932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40900.exe
        5⤵
        
        PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6139.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58230.exe
        5⤵
        
        PID:6044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17671.exe
      4⤵
      PID:3432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61961.exe
      4⤵
      PID:4156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53604.exe
      4⤵
      PID:4988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31397.exe
      4⤵
      PID:5360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5255.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5255.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26844.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16066.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20887.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12599.exe
        7⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23271.exe
        7⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-435.exe
        7⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6233.exe
        7⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58263.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17814.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32193.exe
        7⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9702.exe
        7⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32838.exe
        7⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-861.exe
        7⤵
        
        PID:6168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37007.exe
        6⤵
        
        PID:3492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4559.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7001.exe
        6⤵
        
        PID:5796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50095.exe
        6⤵
        
        PID:1700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17549.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55666.exe
        6⤵
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56941.exe
        7⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9702.exe
        7⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32838.exe
        7⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5237.exe
        7⤵
        
        PID:7088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-682.exe
        6⤵
        
        PID:2868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9628.exe
        6⤵
        
        PID:3620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        6⤵
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14450.exe
        6⤵
        
        PID:5684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56360.exe
        5⤵
        
        PID:2648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15665.exe
        6⤵
        
        PID:3932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9702.exe
        6⤵
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13784.exe
        6⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49565.exe
        6⤵
        
        PID:6136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22093.exe
        5⤵
        
        PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6828.exe
        5⤵
        
        PID:3216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31645.exe
        5⤵
        
        PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32415.exe
        5⤵
        
        PID:6076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61737.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48214.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52724.exe
        6⤵
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42555.exe
        6⤵
        
        PID:3632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23437.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38621.exe
        6⤵
        
        PID:4136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57733.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23979.exe
        5⤵
        
        PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17754.exe
        5⤵
        
        PID:3416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29303.exe
        5⤵
        
        PID:4732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8357.exe
        5⤵
        
        PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41197.exe
        5⤵
        
        PID:6292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14756.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
        5⤵
        
        PID:576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23885.exe
        6⤵
        
        PID:3376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9702.exe
        6⤵
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32838.exe
        6⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-861.exe
        6⤵
        
        PID:6152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28231.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42760.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39206.exe
        5⤵
        
        PID:5604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50095.exe
        5⤵
        
        PID:5748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45007.exe
      4⤵
      PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54123.exe
        5⤵
        
        PID:3184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9702.exe
        5⤵
        
        PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32838.exe
        5⤵
        
        PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-861.exe
        5⤵
        
        PID:6176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34206.exe
      4⤵
      PID:3540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44895.exe
      4⤵
      PID:4260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3869.exe
      4⤵
      PID:4896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28564.exe
      4⤵
      PID:6084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48281.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48281.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8525.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29153.exe
        5⤵
        
        PID:2652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31838.exe
        5⤵
        
        PID:3168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-435.exe
        5⤵
        
        PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63532.exe
        5⤵
        
        PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12742.exe
        5⤵
        
        PID:6464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33434.exe
      4⤵
      PID:2052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27655.exe
      4⤵
      PID:3800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42760.exe
      4⤵
      PID:4292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39206.exe
      4⤵
      PID:5564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50095.exe
      4⤵
      PID:5712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65132.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65132.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21842.exe
      4⤵
      PID:2044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63232.exe
      4⤵
      PID:888
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 888 -s 240
        5⤵
        Program crash
        
        PID:1924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37007.exe
      4⤵
      PID:3508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4559.exe
      4⤵
      PID:4180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52540.exe
      4⤵
      PID:2252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33029.exe
      4⤵
      PID:6012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55665.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55665.exe
    3⤵
    PID:2568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49019.exe
      4⤵
      PID:2836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18103.exe
      4⤵
      PID:1872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37584.exe
      4⤵
      PID:4596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64407.exe
      4⤵
      PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57733.exe
      4⤵
      PID:5508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31107.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31107.exe
    3⤵
    PID:1928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8038.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8038.exe
    3⤵
    PID:3172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15739.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15739.exe
    3⤵
    PID:5104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33606.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33606.exe
    3⤵
    PID:5596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7861.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7861.exe
    3⤵
    PID:5376
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42112.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42112.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27944.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27944.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7326.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49314.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56408.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15022.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62490.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37969.exe
        9⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23848.exe
        9⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58542.exe
        9⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-861.exe
        9⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2493.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9628.exe
        8⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        8⤵
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14450.exe
        8⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59345.exe
        7⤵
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43409.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23381.exe
        9⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60952.exe
        8⤵
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23437.exe
        8⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46597.exe
        8⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49565.exe
        8⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1420.exe
        7⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29738.exe
        7⤵
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20637.exe
        7⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45900.exe
        7⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49773.exe
        7⤵
        
        PID:7100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18509.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41349.exe
        7⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42555.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23437.exe
        7⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63125.exe
        7⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57733.exe
        7⤵
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21378.exe
        6⤵
        
        PID:1980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56292.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20637.exe
        6⤵
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13503.exe
        6⤵
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58263.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50056.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55095.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10736.exe
        7⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44808.exe
        7⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23437.exe
        7⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22092.exe
        7⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49565.exe
        7⤵
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53222.exe
        6⤵
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23872.exe
        6⤵
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42760.exe
        6⤵
        
        PID:4220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39206.exe
        6⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50095.exe
        6⤵
        
        PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8316.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53300.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        6⤵
        
        PID:3836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23437.exe
        6⤵
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63125.exe
        6⤵
        
        PID:5000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57733.exe
        6⤵
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53035.exe
        5⤵
        
        PID:2412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24855.exe
        5⤵
        
        PID:3756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4102.exe
        5⤵
        
        PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8887.exe
        5⤵
        
        PID:3428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36732.exe
        5⤵
        
        PID:5352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62313.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4384.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46735.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52864.exe
        7⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32193.exe
        8⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9702.exe
        8⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38097.exe
        8⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57733.exe
        8⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37704.exe
        7⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49436.exe
        7⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53651.exe
        7⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8878.exe
        6⤵
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23885.exe
        7⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9702.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32838.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54054.exe
        7⤵
        
        PID:6988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37007.exe
        6⤵
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4559.exe
        6⤵
        
        PID:4196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
        6⤵
        
        PID:5040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54968.exe
        6⤵
        
        PID:7140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44467.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29868.exe
        6⤵
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61430.exe
        6⤵
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50981.exe
        6⤵
        
        PID:704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8178.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23737.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15493.exe
        5⤵
        
        PID:3832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49250.exe
        5⤵
        
        PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23517.exe
        5⤵
        
        PID:6124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21606.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14446.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
        6⤵
        
        PID:480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39208.exe
        7⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46798.exe
        7⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49262.exe
        7⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23271.exe
        6⤵
        
        PID:3564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64231.exe
        6⤵
        
        PID:4244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12004.exe
        6⤵
        
        PID:4908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49565.exe
        6⤵
        
        PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25406.exe
        5⤵
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60849.exe
        6⤵
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25268.exe
        6⤵
        
        PID:2192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52365.exe
        6⤵
        
        PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37007.exe
        5⤵
        
        PID:3484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4559.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3339.exe
        5⤵
        
        PID:784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33029.exe
        5⤵
        
        PID:6048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62059.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20171.exe
        5⤵
        
        PID:2704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48057.exe
        6⤵
        
        PID:3360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6635.exe
        6⤵
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58542.exe
        6⤵
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62781.exe
        6⤵
        
        PID:6936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31055.exe
        5⤵
        
        PID:3336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9628.exe
        5⤵
        
        PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56846.exe
        5⤵
        
        PID:4108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24401.exe
        5⤵
        
        PID:5908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6471.exe
      4⤵
      PID:1612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24107.exe
        5⤵
        
        PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8037.exe
        5⤵
        
        PID:7056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17671.exe
      4⤵
      PID:3400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3165.exe
      4⤵
      PID:4112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57003.exe
      4⤵
      PID:4976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23229.exe
      4⤵
      PID:5392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5717.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5717.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48546.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48214.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26689.exe
        6⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5306.exe
        7⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9702.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39541.exe
        7⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17207.exe
        7⤵
        
        PID:6432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13287.exe
        6⤵
        
        PID:3700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23437.exe
        6⤵
        
        PID:4676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46597.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49565.exe
        6⤵
        
        PID:5836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23543.exe
        5⤵
        
        PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9150.exe
        5⤵
        
        PID:3768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29303.exe
        5⤵
        
        PID:4788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30038.exe
        5⤵
        
        PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41197.exe
        5⤵
        
        PID:6284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12012.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5505.exe
        5⤵
        
        PID:1484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63232.exe
        5⤵
        
        PID:1812
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 240
        6⤵
        Program crash
        
        PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37007.exe
        5⤵
        
        PID:3524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4559.exe
        5⤵
        
        PID:4228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35627.exe
        5⤵
        
        PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41197.exe
        5⤵
        
        PID:6308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59048.exe
      4⤵
      PID:1040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17066.exe
        5⤵
        
        PID:3696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9702.exe
        5⤵
        
        PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32838.exe
        5⤵
        
        PID:5296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-861.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3484.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6828.exe
      4⤵
      PID:3960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31645.exe
      4⤵
      PID:1628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40583.exe
      4⤵
      PID:5772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1575.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1575.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30233.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61364.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10002.exe
        6⤵
        
        PID:2364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62551.exe
        6⤵
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12896.exe
        6⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50095.exe
        6⤵
        
        PID:5520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6128.exe
        5⤵
        
        PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31838.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43449.exe
        5⤵
        
        PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55742.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33029.exe
        5⤵
        
        PID:5928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25546.exe
      4⤵
      PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11120.exe
        5⤵
        
        PID:1752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23381.exe
        6⤵
        
        PID:5876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28231.exe
        5⤵
        
        PID:3448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29303.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10976.exe
        5⤵
        
        PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58263.exe
        5⤵
        
        PID:6216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20558.exe
      4⤵
      PID:1776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5677.exe
        5⤵
        
        PID:6384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49224.exe
      4⤵
      PID:3664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20637.exe
      4⤵
      PID:4744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21396.exe
      4⤵
      PID:884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50095.exe
      4⤵
      PID:5732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62749.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62749.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12739.exe
      4⤵
      PID:2444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
        5⤵
        
        PID:2164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23531.exe
        6⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46798.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20063.exe
        5⤵
        
        PID:3420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42760.exe
        5⤵
        
        PID:4284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39206.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50095.exe
        5⤵
        
        PID:5784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25406.exe
      4⤵
      PID:264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47843.exe
        5⤵
        
        PID:5888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46798.exe
        5⤵
        
        PID:6256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37007.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4559.exe
      4⤵
      PID:4164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3339.exe
      4⤵
      PID:4940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54584.exe
      4⤵
      PID:7000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44842.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44842.exe
    3⤵
    PID:960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41541.exe
      4⤵
      PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10760.exe
      4⤵
      PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23437.exe
      4⤵
      PID:4708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5756.exe
      4⤵
      PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57733.exe
      4⤵
      PID:6036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-528.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-528.exe
    3⤵
    PID:1052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29569.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29569.exe
    3⤵
    PID:3088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13783.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13783.exe
    3⤵
    PID:4612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29406.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29406.exe
    3⤵
    PID:5540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27429.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27429.exe
    3⤵
    PID:5396
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18990.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18990.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17799.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17799.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26538.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19045.exe
        6⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3715.exe
        7⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10760.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23437.exe
        7⤵
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29431.exe
        7⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33029.exe
        7⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23979.exe
        6⤵
        
        PID:2500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55768.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56787.exe
        6⤵
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39206.exe
        6⤵
        
        PID:5620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49773.exe
        6⤵
        
        PID:7080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50684.exe
        5⤵
        
        PID:2940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29868.exe
        6⤵
        
        PID:1892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61430.exe
        6⤵
        
        PID:3952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50981.exe
        6⤵
        
        PID:592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48526.exe
        6⤵
        
        PID:5924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34128.exe
        5⤵
        
        PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6828.exe
        5⤵
        
        PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30569.exe
        5⤵
        
        PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28564.exe
        5⤵
        
        PID:5824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54197.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28028.exe
        5⤵
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22710.exe
        6⤵
        
        PID:6980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11035.exe
        5⤵
        
        PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23437.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38704.exe
        5⤵
        
        PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57733.exe
        5⤵
        
        PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45691.exe
      4⤵
      PID:1740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21699.exe
      4⤵
      PID:3104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26224.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56272.exe
      4⤵
      PID:5472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28564.exe
      4⤵
      PID:5468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6672.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6672.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55230.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29268.exe
        5⤵
        
        PID:2264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19481.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6587.exe
        7⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22807.exe
        7⤵
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37704.exe
        6⤵
        
        PID:3988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49436.exe
        6⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42001.exe
        6⤵
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7407.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6823.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34529.exe
        6⤵
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41604.exe
        6⤵
        
        PID:4476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60533.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43359.exe
        5⤵
        
        PID:3676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42760.exe
        5⤵
        
        PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39206.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49773.exe
        5⤵
        
        PID:7116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43995.exe
      4⤵
      PID:2180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51222.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37309.exe
        5⤵
        
        PID:3648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61069.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5237.exe
        5⤵
        
        PID:7108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39114.exe
      4⤵
      PID:1240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15493.exe
      4⤵
      PID:2340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48181.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48181.exe
      4⤵
      PID:4356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23517.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10371.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10371.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44701.exe
      4⤵
      PID:1496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29153.exe
        5⤵
        
        PID:2628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31838.exe
        5⤵
        
        PID:4040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-435.exe
        5⤵
        
        PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6233.exe
        5⤵
        
        PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50095.exe
        5⤵
        
        PID:6072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24114.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37704.exe
      4⤵
      PID:4048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34783.exe
      4⤵
      PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39206.exe
      4⤵
      PID:5532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50095.exe
      4⤵
      PID:5720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51452.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51452.exe
    3⤵
    PID:896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29868.exe
      4⤵
      PID:2584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61430.exe
      4⤵
      PID:3660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50981.exe
      4⤵
      PID:4376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48718.exe
      4⤵
      PID:5172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20937.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20937.exe
    3⤵
    PID:1252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55830.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55830.exe
    3⤵
    PID:3644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48711.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48711.exe
    3⤵
    PID:4128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35388.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35388.exe
    3⤵
    PID:5992
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17533.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17533.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26538.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26538.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48764.exe
      4⤵
      PID:580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19531.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9702.exe
        5⤵
        
        PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32838.exe
        5⤵
        
        PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-861.exe
        5⤵
        
        PID:6160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14417.exe
      4⤵
      PID:1104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53886.exe
      4⤵
      PID:4916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13503.exe
      4⤵
      PID:4492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50095.exe
      4⤵
      PID:5856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14124.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14124.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39330.exe
      4⤵
      PID:1580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42719.exe
        5⤵
        
        PID:2024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6328.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23437.exe
        5⤵
        
        PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22092.exe
        5⤵
        
        PID:4132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49565.exe
        5⤵
        
        PID:5840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30061.exe
      4⤵
      PID:2668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44952.exe
      4⤵
      PID:3624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42760.exe
      4⤵
      PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39206.exe
      4⤵
      PID:5440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50095.exe
      4⤵
      PID:5912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14040.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14040.exe
    3⤵
    PID:1488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56919.exe
      4⤵
      PID:928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3461.exe
      4⤵
      PID:5220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50656.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50656.exe
    3⤵
    PID:3348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6828.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6828.exe
    3⤵
    PID:3252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32714.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32714.exe
    3⤵
    PID:3260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40583.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40583.exe
    3⤵
    PID:6140
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17607.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17607.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8525.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8525.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22007.exe
      4⤵
      PID:2008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29868.exe
        5⤵
        
        PID:2820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61430.exe
        5⤵
        
        PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50981.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16830.exe
        5⤵
        
        PID:6556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23737.exe
      4⤵
      PID:1624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15493.exe
      4⤵
      PID:3076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49250.exe
      4⤵
      PID:5072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63452.exe
      4⤵
      PID:5680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36952.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36952.exe
    3⤵
    PID:2368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29868.exe
      4⤵
      PID:816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61430.exe
      4⤵
      PID:3208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52050.exe
      4⤵
      PID:3312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40550.exe
      4⤵
      PID:6024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23737.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23737.exe
    3⤵
    PID:2548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53886.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53886.exe
    3⤵
    PID:4924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57359.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57359.exe
    3⤵
    PID:5012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58263.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58263.exe
    3⤵
    PID:6232
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22748.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22748.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29512.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29512.exe
    3⤵
    PID:2748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46085.exe
      4⤵
      PID:4072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9702.exe
      4⤵
      PID:4828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32838.exe
      4⤵
      PID:5232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58230.exe
      4⤵
      PID:5292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28231.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28231.exe
    3⤵
    PID:3468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42760.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42760.exe
    3⤵
    PID:4144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39206.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39206.exe
    3⤵
    PID:5432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50095.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50095.exe
    3⤵
    PID:5820
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3623.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3623.exe
  2⤵
  PID:3028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18957.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18957.exe
    3⤵
    PID:2044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2099.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2099.exe
    3⤵
    PID:3132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23437.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23437.exe
    3⤵
    PID:4660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46597.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46597.exe
    3⤵
    PID:4568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57733.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57733.exe
    3⤵
    PID:5208
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61600.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61600.exe
  2⤵
  PID:540
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2703.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2703.exe
  2⤵
  PID:4088
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12648.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12648.exe
  2⤵
  PID:4540
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5870.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5870.exe
  2⤵
  PID:5512
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47030.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47030.exe
  2⤵
  PID:1388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-17671.exe

Filesize
468KB

MD5
cdac7589b078720435003e35dc4114e2

SHA1
591c69d11f1682f0893c43e711c5f0109c07f38b

SHA256
7e5be3ab10ecd27bbf08912b5ac687fa86cf06a186718bea55f82a3407f3a731

SHA512
67d7c14ea011db4d95529b50f49e31f6d3881c43434527e043ff0bdb2a3efff44ec455e80f8e0fca74511fff8b9a4b6deb11a60fb79017eda4ce18c4dae4bc9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21842.exe

Filesize
468KB

MD5
76d7f38b8fdd68d2d4fedb4eb3c3aec4

SHA1
06744d17608de92bbd87caa9aafea0e351915b3a

SHA256
de34fe0694a5c53726f987e6c04721c6abc12f2b3e908120a681b741026c5099

SHA512
1685d0ca1b2f1d6792104983d9eb9a623b7e0d6555dc6db9f1ae7cff4e307ac107ff541c0cb570b74fbc349495fda4f724d100c2a19e11f29adc1d7b045534b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26844.exe

Filesize
468KB

MD5
cab6e62373128f7b717ed683be656688

SHA1
bd59fdbd67119b5d4ced8ff257357d48308dac4b

SHA256
f69376321266fb5701502b9361812ecb8af766e59aa7b6c03792375b8ca0e2d4

SHA512
7b2b2698580b4da29659bfc0a6c944c7d180af59e66ffd29d03946492d255ade4c58614dc4aefb012a8dae5651fd22f5cc9fef6cd6acd51c9d144441d1b03335

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42112.exe

Filesize
468KB

MD5
a2babf1c49237a36b24e4600345c8260

SHA1
f9daf04769ee19d545cd7a4f52a768439600bcac

SHA256
c05fad27f64ad4fec5801afe836467e5ad449b3197d2c17676bbaf32f92dea6e

SHA512
caebafc611b724a15e9b65851b96031037e1f7164227b8086d610203949d9bc1a02f6261342231ce4e0fce7efa054afb8212562733a1f1fac9aa2179fcab0757

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48281.exe

Filesize
468KB

MD5
b68fcd43cb1b2d0dba70a6d2621e1c91

SHA1
2fd5a26658442070a78a05409e30332a28a1a77d

SHA256
fd79b371cd9090ea550431da7737ee97b1ac4b785d18d5e2665b933879c9d113

SHA512
f29c6039bb4641d228d3c0325faa4dd390b1e98765466f91b2feee51ae253826f67113d4f9d1da92cbbcbb0b61ce23743859feebd856745c543bbc31886f1e38

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62313.exe

Filesize
468KB

MD5
fc2206f40ae52459c0e55746da8685ee

SHA1
25c6f06d387739222b66032bb1cca17f13335b3e

SHA256
35853bb92ad5135961d7d2496fb91e90952f79015e553e8578587f4f32fbfa9a

SHA512
e27e27b0f6a5fad85db790226f607a0f735b367db0f48c95f9fb3f0ddc5fd6f8353fca6d5caf2d6c81d9c619fdc2ca68106abd941800fa4ab9e534d9fc960cc3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1575.exe

Filesize
468KB

MD5
f75c4fc604da2151c2fc9f0d2b2e0a1f

SHA1
3ea8c6077c81cbbf2b914b2ba0fc2c97be4951ed

SHA256
66310e2d7dd3f427e41cf554fa3277ff64e1c1bda9a3eef736fa12002acc2cca

SHA512
9f53891eb94123baa48107d085f773a13938e768f99718d0c838f95d8693c847252365f700cb4198dbfb794b23ac8f5f32c70d1046b5ddb52f4b3a13fba78d8a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17533.exe

Filesize
468KB

MD5
36d61794e9158facc8ebe68b790d00b8

SHA1
014576525925a9739373eca0924f3ab8d5a38bdb

SHA256
c14fa31657533e696f498c8356a25633cad101a4f7e3560ba2a5ac3f57b3533d

SHA512
ded51c1b9f6d1bf2cdc7b942998cca705b30398838fcb27ad64e6e81000401e61289bace26740ccf663eda6b2c8542191f932a224b65d574d6cb291eccfe85ca

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17799.exe

Filesize
468KB

MD5
e07dd726f38360f4494c1a4717478fe0

SHA1
e839a9af82cbafa30f0689bc1508933993c04e06

SHA256
ea7320f293cd93cf4011d32439db59ec751070f20740ad23a188058fb993c296

SHA512
2dd74525d5823fb6d9a6ba46032b1cad22ec2c07958f8547257bf57908e42ac3c12486035fb8dc44ea4d5d679e089150b2e3600473b617fd46ad4ce84eef4288

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18990.exe

Filesize
468KB

MD5
ba902460af6df28522ea47f7131ec5c0

SHA1
4e1094c4ba7ca3de4e275b69648a57ed0188c120

SHA256
2b2558cc78c88709790d52a236eb81b94ce3950759f612f0706c3ffea1b0f417

SHA512
72217adfd138f3542d5bef59f8bdc26a9e479218f0e4b5619bf424bbb086baf0748eb22b7539441aa349a26c4e2e469d9fd59d05f85c2fc5006b0935e4f49974

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27944.exe

Filesize
468KB

MD5
712ef95c0d128c6582f7858e61d911f3

SHA1
25c3819c7042dee376044cab01efd64efbd5ef66

SHA256
98b0602f47bc5628ca85ca85119113b44d04e3c989ef4ac5377d7feed6858ce8

SHA512
fcecfd7b68042563c241af3e94b418890a9b871b8dec5291dfa19f171bec5ea0ff8f4e4d575d58e67d073728b69cf5f8b631c25fb178adba1fb2e7c88ec4d6d7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3483.exe

Filesize
468KB

MD5
b0f1064f38b464f170d05f11723d0207

SHA1
577ea193051c89ef528de669566593ebfd514d97

SHA256
45b6ea24118f126d7af66b7bf3836e07c746bd86f583540cfb9ebea50d0916e6

SHA512
345145946d9ca1752230d7d971877a352eb1776319d0e02be2779ad308d341f7c4a7f7ed247a91c68e2ee566ba92d6734d0c55f89e068fb57b37db45c70dee65

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-48546.exe

Filesize
468KB

MD5
c5dba6387a4db92f816614243378e1b2

SHA1
e246a21db79d4f52e62a7a6a738752ef048e3cac

SHA256
54ea5ded3d349982f483b9f046638d0acca8c9d9cffbfc0336aa09542044eff5

SHA512
cc72d21564881dbd2c6c5b72122b9c19ad9c321655d76891cd11af5f66194677c432f4414ce0e48faf7bbfd36d657eaf1f10f0879287098d7255f7fc7a2af373

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49314.exe

Filesize
468KB

MD5
6e20fd58ba1f3121af1c2e8d1e5eaba1

SHA1
b0e9730a57853e15c42ffd87f40013a5dfc7ca63

SHA256
e6c24e37dbdf6e2b904c807d5b2f43b002d74973f0720661d923f80c1abe2e53

SHA512
a91528d914d5f9fa0491e95bd22358ddc517c1ae73ccaf55c1e15ce6c37acfdd8d7534fe483de2c3945d71f183afed9fe3e440b44a4d7e7f578404d0011b9ed3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-5255.exe

Filesize
468KB

MD5
622c27840a5b4fbf0439f5b953d2dc99

SHA1
59fd4b9bbf5c6801fa02a121c1e4c5b54f274b06

SHA256
17dfba963bb84bb802dff5d6b9a332d62f3f331c8527de5b258cb478156b3007

SHA512
71f1bbb1699f5a53ed7bbbaddf84f4b20e4f530a6182e103635f73741122467f0706438ae02a2435473bae10973c89d0e09be4f179a718eaf3ae84f0411013e1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53810.exe

Filesize
468KB

MD5
b9262e4ec4dd123313c24431f727dfa2

SHA1
26ab8ceafda7dd8761f9bb4766b239e9b59ce79a

SHA256
c06efb2421ab2112e2ff456888eed031cb47a8fb5d3c160730544215ba4c258b

SHA512
b8ee05066aaa793463e85f98e30047b1e1ca1bacd25a7703df121c247c497e5a66a2392153cfc9e79f9164d7cdd497eb906690c23fb17bc7a9e3c25fef61a49b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-5520.exe

Filesize
468KB

MD5
33547229be28691a17de452661846172

SHA1
678ae9c4278e5a9d8eb4a00a05eb1e53c85c38b8

SHA256
a2afa530844fa445f134bfc13bf731c2125820311fabbea3872426b606d1e24d

SHA512
f6744255131839772246877596bab29c22565015d3fc708bbcca8394a14c7817d1db9006d106dfeb4fa9141f73886981dbb856466f741c4577fe1673e1cef2fa

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-5717.exe

Filesize
468KB

MD5
4e955a68ad05c4301d05c22e240d598c

SHA1
49d83d2fe4257308bac8f7744a51a3e01f862e8a

SHA256
54487900f1fe900aaead7b56bb7b1508ba919ab2be00e36ac7b44c83c91eb051

SHA512
e511e5a10b04c6d6b8697c9463d4e985591309f833124cb0446e7bdd3494507aa401b39dfa65bdd4c5d2fe6b51f15cf6a24b73d866035d6568b561f132f773e1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63470.exe

Filesize
468KB

MD5
ac45553bc3983fd25625f60e7010016f

SHA1
ed76755b182f1b5413c16f15e3033ef56dd9c388

SHA256
4ee04153714c1ecdd347d9f95dba8a02d3881ba739e0f79f589457c8505b5702

SHA512
1c79f2d8f2b409dbb2bffedf3bfb2ce5047a81cfab2b8d0c7c114a87e4ef7066bcb765a2b8b4486758d834700eb7df114e71844494806708c3f4eb66c3c975ff

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-7326.exe

Filesize
468KB

MD5
1b9db04a50c6ea2528a0e7963a2ec33d

SHA1
a33b0950501420784af7226babb4c03cf04f5df0

SHA256
6d644bb65fde94be37e72a3594d44c77cbe22a68af124842bcd1bfcb41abd01f

SHA512
5281e631fb0f617779467d5bf4d3f8181ae8e41883f5d068d230112040db990c2e43449e78a6a4726505825a0cd5d323ed309376d05e55487115edadb14ac225

Download Submit
memory/548-178-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/548-316-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/548-306-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/616-263-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/868-355-0x0000000001EF0000-0x0000000001F65000-memory.dmp

Filesize
468KB

Download
memory/868-225-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/988-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1000-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1016-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1088-226-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1092-300-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1144-367-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1448-390-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1692-297-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/1692-296-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/1692-164-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1716-379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1720-272-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/1720-270-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/1720-424-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/1720-143-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1908-420-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/1908-269-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1908-405-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/1912-141-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1936-429-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1976-144-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1976-271-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/1976-274-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/2012-238-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2140-237-0x0000000002850000-0x00000000028C5000-memory.dmp

Filesize
468KB

Download
memory/2140-230-0x0000000002850000-0x00000000028C5000-memory.dmp

Filesize
468KB

Download
memory/2140-107-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2460-404-0x0000000002890000-0x0000000002905000-memory.dmp

Filesize
468KB

Download
memory/2460-220-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2476-268-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2476-376-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/2492-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2552-221-0x0000000002630000-0x00000000026A5000-memory.dmp

Filesize
468KB

Download
memory/2552-95-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2552-223-0x0000000002630000-0x00000000026A5000-memory.dmp

Filesize
468KB

Download
memory/2680-315-0x00000000028B0000-0x0000000002925000-memory.dmp

Filesize
468KB

Download
memory/2680-304-0x00000000028B0000-0x0000000002925000-memory.dmp

Filesize
468KB

Download
memory/2680-162-0x00000000028B0000-0x0000000002925000-memory.dmp

Filesize
468KB

Download
memory/2680-161-0x00000000033E0000-0x0000000003455000-memory.dmp

Filesize
468KB

Download
memory/2712-37-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2712-224-0x0000000002880000-0x00000000028F5000-memory.dmp

Filesize
468KB

Download
memory/2712-46-0x00000000033B0000-0x0000000003425000-memory.dmp

Filesize
468KB

Download
memory/2712-407-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2712-365-0x0000000002880000-0x00000000028F5000-memory.dmp

Filesize
468KB

Download
memory/2712-366-0x0000000002880000-0x00000000028F5000-memory.dmp

Filesize
468KB

Download
memory/2712-222-0x0000000002880000-0x00000000028F5000-memory.dmp

Filesize
468KB

Download
memory/2716-358-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2736-188-0x00000000023A0000-0x0000000002415000-memory.dmp

Filesize
468KB

Download
memory/2736-189-0x00000000023A0000-0x0000000002415000-memory.dmp

Filesize
468KB

Download
memory/2736-354-0x00000000023A0000-0x0000000002415000-memory.dmp

Filesize
468KB

Download
memory/2736-356-0x00000000023A0000-0x0000000002415000-memory.dmp

Filesize
468KB

Download
memory/2780-338-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2796-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2812-337-0x0000000002480000-0x00000000024F5000-memory.dmp

Filesize
468KB

Download
memory/2812-190-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2812-336-0x0000000002480000-0x00000000024F5000-memory.dmp

Filesize
468KB

Download
memory/2852-264-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/2852-265-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/2852-65-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2852-142-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/2880-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2928-406-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2928-138-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2928-136-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2928-252-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2928-251-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2936-140-0x0000000002940000-0x00000000029B5000-memory.dmp

Filesize
468KB

Download
memory/2936-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2936-6-0x0000000003470000-0x00000000034E5000-memory.dmp

Filesize
468KB

Download
memory/2936-266-0x0000000002940000-0x00000000029B5000-memory.dmp

Filesize
468KB

Download
memory/2936-368-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2936-267-0x0000000002940000-0x00000000029B5000-memory.dmp

Filesize
468KB

Download
memory/2936-137-0x0000000002940000-0x00000000029B5000-memory.dmp

Filesize
468KB

Download
memory/2936-382-0x0000000002940000-0x00000000029B5000-memory.dmp

Filesize
468KB

Download
memory/2944-176-0x00000000024B0000-0x0000000002525000-memory.dmp

Filesize
468KB

Download
memory/2944-177-0x00000000024B0000-0x0000000002525000-memory.dmp

Filesize
468KB

Download
memory/2944-326-0x00000000024B0000-0x0000000002525000-memory.dmp

Filesize
468KB

Download
memory/2944-79-0x00000000024B0000-0x0000000002525000-memory.dmp

Filesize
468KB

Download
memory/2944-327-0x00000000024B0000-0x0000000002525000-memory.dmp

Filesize
468KB

Download
memory/3004-24-0x00000000023A0000-0x0000000002415000-memory.dmp

Filesize
468KB

Download
memory/3004-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3004-197-0x00000000023A0000-0x0000000002415000-memory.dmp

Filesize
468KB

Download
memory/3004-12-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3004-205-0x00000000023A0000-0x0000000002415000-memory.dmp

Filesize
468KB

Download
memory/3056-229-0x0000000001D00000-0x0000000001D75000-memory.dmp

Filesize
468KB

Download
memory/3056-239-0x0000000001D00000-0x0000000001D75000-memory.dmp

Filesize
468KB

Download
memory/3056-71-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3064-396-0x0000000003340000-0x00000000033B5000-memory.dmp

Filesize
468KB

Download
memory/3064-273-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3064-395-0x0000000003340000-0x00000000033B5000-memory.dmp

Filesize
468KB

Download