d87a255ed113d19c675f922922bb4d5416a6196d170f6d5ddd0d94c1929a6931

Analysis

max time kernel
119s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 04:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d87a255ed113d19c675f922922bb4d5416a6196d170f6d5ddd0d94c1929a6931N.exe
Size

468KB
MD5

5e0fd9fe9d3c3cbac18019fbde3fa290
SHA1

3d539b30e3aec4e4bc8c6267e50fdd884aaafa95
SHA256

d87a255ed113d19c675f922922bb4d5416a6196d170f6d5ddd0d94c1929a6931
SHA512

81af942f44fa17b73981f315a89337f78aeb559131e6f119dd6a49c2dc5906b3ee3d96c82fa8bcaf691aaefba89b74856e3c0aecb1dc323b88425eedebe148f4
SSDEEP

3072:WqCCogLdjkSv2bYkPj56ffOEChjWIpzOmHevVURgj9NpfFNhTlC:Wqfoonv23PF6ffH0sWgjnxFNh

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2868	Unicorn-48286.exe
2932	Unicorn-29104.exe
2956	Unicorn-8854.exe
3052	Unicorn-21864.exe
2784	Unicorn-18879.exe
2244	Unicorn-24517.exe
2604	Unicorn-56084.exe
2632	Unicorn-6883.exe
2740	Unicorn-39675.exe
2196	Unicorn-19437.exe
2912	Unicorn-62891.exe
2300	Unicorn-37728.exe
2060	Unicorn-46214.exe
2072	Unicorn-14309.exe
1864	Unicorn-37190.exe
1536	Unicorn-85.exe
2536	Unicorn-19951.exe
1916	Unicorn-11513.exe
1772	Unicorn-35903.exe
840	Unicorn-52732.exe
928	Unicorn-61843.exe
604	Unicorn-54579.exe
596	Unicorn-19218.exe
520	Unicorn-2436.exe
2100	Unicorn-12065.exe
1604	Unicorn-25230.exe
2064	Unicorn-44136.exe
2968	Unicorn-55464.exe
2916	Unicorn-49393.exe
2788	Unicorn-16638.exe
2688	Unicorn-63653.exe
2876	Unicorn-14539.exe
1884	Unicorn-33799.exe
3036	Unicorn-56766.exe
3020	Unicorn-3347.exe
2608	Unicorn-49019.exe
3024	Unicorn-3347.exe
2320	Unicorn-3082.exe
2228	Unicorn-47758.exe
2860	Unicorn-2086.exe
2708	Unicorn-52194.exe
2600	Unicorn-58324.exe
2992	Unicorn-58324.exe
2376	Unicorn-5724.exe
892	Unicorn-36979.exe
2124	Unicorn-47915.exe
2500	Unicorn-50331.exe
1896	Unicorn-56461.exe
1784	Unicorn-42538.exe
1404	Unicorn-22672.exe
536	Unicorn-5049.exe
1904	Unicorn-58272.exe
2568	Unicorn-60519.exe
872	Unicorn-41774.exe
3004	Unicorn-14847.exe
2960	Unicorn-13046.exe
2724	Unicorn-15589.exe
1912	Unicorn-17510.exe
1800	Unicorn-11379.exe
2552	Unicorn-46621.exe
3016	Unicorn-3166.exe
1072	Unicorn-38947.exe
1636	Unicorn-21589.exe
2336	Unicorn-3451.exe

Loads dropped DLL 64 IoCs

pid	Process
1872	d87a255ed113d19c675f922922bb4d5416a6196d170f6d5ddd0d94c1929a6931N.exe
1872	d87a255ed113d19c675f922922bb4d5416a6196d170f6d5ddd0d94c1929a6931N.exe
2868	Unicorn-48286.exe
2868	Unicorn-48286.exe
1872	d87a255ed113d19c675f922922bb4d5416a6196d170f6d5ddd0d94c1929a6931N.exe
1872	d87a255ed113d19c675f922922bb4d5416a6196d170f6d5ddd0d94c1929a6931N.exe
2868	Unicorn-48286.exe
2956	Unicorn-8854.exe
2868	Unicorn-48286.exe
1872	d87a255ed113d19c675f922922bb4d5416a6196d170f6d5ddd0d94c1929a6931N.exe
1872	d87a255ed113d19c675f922922bb4d5416a6196d170f6d5ddd0d94c1929a6931N.exe
2704	WerFault.exe
2704	WerFault.exe
2704	WerFault.exe
2704	WerFault.exe
2704	WerFault.exe
2704	WerFault.exe
2956	Unicorn-8854.exe
2704	WerFault.exe
2704	WerFault.exe
2704	WerFault.exe
2784	Unicorn-18879.exe
3052	Unicorn-21864.exe
3052	Unicorn-21864.exe
2784	Unicorn-18879.exe
1872	d87a255ed113d19c675f922922bb4d5416a6196d170f6d5ddd0d94c1929a6931N.exe
1872	d87a255ed113d19c675f922922bb4d5416a6196d170f6d5ddd0d94c1929a6931N.exe
2868	Unicorn-48286.exe
2868	Unicorn-48286.exe
2244	Unicorn-24517.exe
2244	Unicorn-24517.exe
2956	Unicorn-8854.exe
2956	Unicorn-8854.exe
2632	Unicorn-6883.exe
2632	Unicorn-6883.exe
2784	Unicorn-18879.exe
2784	Unicorn-18879.exe
2604	Unicorn-56084.exe
2604	Unicorn-56084.exe
3052	Unicorn-21864.exe
3052	Unicorn-21864.exe
2740	Unicorn-39675.exe
1872	d87a255ed113d19c675f922922bb4d5416a6196d170f6d5ddd0d94c1929a6931N.exe
2740	Unicorn-39675.exe
1872	d87a255ed113d19c675f922922bb4d5416a6196d170f6d5ddd0d94c1929a6931N.exe
2196	Unicorn-19437.exe
2196	Unicorn-19437.exe
2300	Unicorn-37728.exe
2300	Unicorn-37728.exe
2956	Unicorn-8854.exe
2956	Unicorn-8854.exe
2244	Unicorn-24517.exe
2912	Unicorn-62891.exe
2868	Unicorn-48286.exe
2912	Unicorn-62891.exe
2868	Unicorn-48286.exe
2244	Unicorn-24517.exe
2060	Unicorn-46214.exe
2060	Unicorn-46214.exe
2632	Unicorn-6883.exe
2632	Unicorn-6883.exe
1864	Unicorn-37190.exe
1864	Unicorn-37190.exe
2604	Unicorn-56084.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2704	2932	WerFault.exe	31

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23580.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18822.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58937.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2451.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45482.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6883.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16638.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5343.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37561.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8425.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2451.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27224.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56766.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-836.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25474.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3245.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16198.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34179.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35116.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42538.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35618.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5251.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46214.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60519.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24743.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46078.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19760.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28426.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32270.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3082.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11379.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3451.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5946.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5251.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53271.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2981.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13046.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14515.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51943.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27875.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51437.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d87a255ed113d19c675f922922bb4d5416a6196d170f6d5ddd0d94c1929a6931N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14539.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28912.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5251.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11116.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35206.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41774.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3166.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37011.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53776.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11116.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49167.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45638.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5146.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19415.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33782.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52128.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1872	d87a255ed113d19c675f922922bb4d5416a6196d170f6d5ddd0d94c1929a6931N.exe
2868	Unicorn-48286.exe
2932	Unicorn-29104.exe
2956	Unicorn-8854.exe
3052	Unicorn-21864.exe
2784	Unicorn-18879.exe
2244	Unicorn-24517.exe
2632	Unicorn-6883.exe
2604	Unicorn-56084.exe
2196	Unicorn-19437.exe
2912	Unicorn-62891.exe
2300	Unicorn-37728.exe
2740	Unicorn-39675.exe
2060	Unicorn-46214.exe
1864	Unicorn-37190.exe
2072	Unicorn-14309.exe
2536	Unicorn-19951.exe
596	Unicorn-19218.exe
1536	Unicorn-85.exe
604	Unicorn-54579.exe
840	Unicorn-52732.exe
1916	Unicorn-11513.exe
1772	Unicorn-35903.exe
928	Unicorn-61843.exe
520	Unicorn-2436.exe
2100	Unicorn-12065.exe
1604	Unicorn-25230.exe
2064	Unicorn-44136.exe
2968	Unicorn-55464.exe
2916	Unicorn-49393.exe
2788	Unicorn-16638.exe
2688	Unicorn-63653.exe
1884	Unicorn-33799.exe
2228	Unicorn-47758.exe
3024	Unicorn-3347.exe
3036	Unicorn-56766.exe
2860	Unicorn-2086.exe
2600	Unicorn-58324.exe
2708	Unicorn-52194.exe
2992	Unicorn-58324.exe
2376	Unicorn-5724.exe
2608	Unicorn-49019.exe
3020	Unicorn-3347.exe
2876	Unicorn-14539.exe
2320	Unicorn-3082.exe
1784	Unicorn-42538.exe
2500	Unicorn-50331.exe
892	Unicorn-36979.exe
872	Unicorn-41774.exe
1404	Unicorn-22672.exe
2124	Unicorn-47915.exe
536	Unicorn-5049.exe
1896	Unicorn-56461.exe
2568	Unicorn-60519.exe
1904	Unicorn-58272.exe
3004	Unicorn-14847.exe
2724	Unicorn-15589.exe
1912	Unicorn-17510.exe
2960	Unicorn-13046.exe
1800	Unicorn-11379.exe
3016	Unicorn-3166.exe
2552	Unicorn-46621.exe
1072	Unicorn-38947.exe
1636	Unicorn-21589.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2868	1872	d87a255ed113d19c675f922922bb4d5416a6196d170f6d5ddd0d94c1929a6931N.exe	30
PID 1872 wrote to memory of 2868	1872	d87a255ed113d19c675f922922bb4d5416a6196d170f6d5ddd0d94c1929a6931N.exe	30
PID 1872 wrote to memory of 2868	1872	d87a255ed113d19c675f922922bb4d5416a6196d170f6d5ddd0d94c1929a6931N.exe	30
PID 1872 wrote to memory of 2868	1872	d87a255ed113d19c675f922922bb4d5416a6196d170f6d5ddd0d94c1929a6931N.exe	30
PID 2868 wrote to memory of 2932	2868	Unicorn-48286.exe	31
PID 2868 wrote to memory of 2932	2868	Unicorn-48286.exe	31
PID 2868 wrote to memory of 2932	2868	Unicorn-48286.exe	31
PID 2868 wrote to memory of 2932	2868	Unicorn-48286.exe	31
PID 1872 wrote to memory of 2956	1872	d87a255ed113d19c675f922922bb4d5416a6196d170f6d5ddd0d94c1929a6931N.exe	32
PID 1872 wrote to memory of 2956	1872	d87a255ed113d19c675f922922bb4d5416a6196d170f6d5ddd0d94c1929a6931N.exe	32
PID 1872 wrote to memory of 2956	1872	d87a255ed113d19c675f922922bb4d5416a6196d170f6d5ddd0d94c1929a6931N.exe	32
PID 1872 wrote to memory of 2956	1872	d87a255ed113d19c675f922922bb4d5416a6196d170f6d5ddd0d94c1929a6931N.exe	32
PID 2932 wrote to memory of 2704	2932	Unicorn-29104.exe	33
PID 2932 wrote to memory of 2704	2932	Unicorn-29104.exe	33
PID 2932 wrote to memory of 2704	2932	Unicorn-29104.exe	33
PID 2932 wrote to memory of 2704	2932	Unicorn-29104.exe	33
PID 2868 wrote to memory of 3052	2868	Unicorn-48286.exe	34
PID 2868 wrote to memory of 3052	2868	Unicorn-48286.exe	34
PID 2868 wrote to memory of 3052	2868	Unicorn-48286.exe	34
PID 2868 wrote to memory of 3052	2868	Unicorn-48286.exe	34
PID 1872 wrote to memory of 2784	1872	d87a255ed113d19c675f922922bb4d5416a6196d170f6d5ddd0d94c1929a6931N.exe	36
PID 1872 wrote to memory of 2784	1872	d87a255ed113d19c675f922922bb4d5416a6196d170f6d5ddd0d94c1929a6931N.exe	36
PID 1872 wrote to memory of 2784	1872	d87a255ed113d19c675f922922bb4d5416a6196d170f6d5ddd0d94c1929a6931N.exe	36
PID 1872 wrote to memory of 2784	1872	d87a255ed113d19c675f922922bb4d5416a6196d170f6d5ddd0d94c1929a6931N.exe	36
PID 2956 wrote to memory of 2244	2956	Unicorn-8854.exe	35
PID 2956 wrote to memory of 2244	2956	Unicorn-8854.exe	35
PID 2956 wrote to memory of 2244	2956	Unicorn-8854.exe	35
PID 2956 wrote to memory of 2244	2956	Unicorn-8854.exe	35
PID 3052 wrote to memory of 2604	3052	Unicorn-21864.exe	38
PID 3052 wrote to memory of 2604	3052	Unicorn-21864.exe	38
PID 3052 wrote to memory of 2604	3052	Unicorn-21864.exe	38
PID 3052 wrote to memory of 2604	3052	Unicorn-21864.exe	38
PID 2784 wrote to memory of 2632	2784	Unicorn-18879.exe	37
PID 2784 wrote to memory of 2632	2784	Unicorn-18879.exe	37
PID 2784 wrote to memory of 2632	2784	Unicorn-18879.exe	37
PID 2784 wrote to memory of 2632	2784	Unicorn-18879.exe	37
PID 1872 wrote to memory of 2740	1872	d87a255ed113d19c675f922922bb4d5416a6196d170f6d5ddd0d94c1929a6931N.exe	39
PID 1872 wrote to memory of 2740	1872	d87a255ed113d19c675f922922bb4d5416a6196d170f6d5ddd0d94c1929a6931N.exe	39
PID 1872 wrote to memory of 2740	1872	d87a255ed113d19c675f922922bb4d5416a6196d170f6d5ddd0d94c1929a6931N.exe	39
PID 1872 wrote to memory of 2740	1872	d87a255ed113d19c675f922922bb4d5416a6196d170f6d5ddd0d94c1929a6931N.exe	39
PID 2868 wrote to memory of 2912	2868	Unicorn-48286.exe	40
PID 2868 wrote to memory of 2912	2868	Unicorn-48286.exe	40
PID 2868 wrote to memory of 2912	2868	Unicorn-48286.exe	40
PID 2868 wrote to memory of 2912	2868	Unicorn-48286.exe	40
PID 2244 wrote to memory of 2196	2244	Unicorn-24517.exe	41
PID 2244 wrote to memory of 2196	2244	Unicorn-24517.exe	41
PID 2244 wrote to memory of 2196	2244	Unicorn-24517.exe	41
PID 2244 wrote to memory of 2196	2244	Unicorn-24517.exe	41
PID 2956 wrote to memory of 2300	2956	Unicorn-8854.exe	42
PID 2956 wrote to memory of 2300	2956	Unicorn-8854.exe	42
PID 2956 wrote to memory of 2300	2956	Unicorn-8854.exe	42
PID 2956 wrote to memory of 2300	2956	Unicorn-8854.exe	42
PID 2632 wrote to memory of 2060	2632	Unicorn-6883.exe	43
PID 2632 wrote to memory of 2060	2632	Unicorn-6883.exe	43
PID 2632 wrote to memory of 2060	2632	Unicorn-6883.exe	43
PID 2632 wrote to memory of 2060	2632	Unicorn-6883.exe	43
PID 2784 wrote to memory of 2072	2784	Unicorn-18879.exe	44
PID 2784 wrote to memory of 2072	2784	Unicorn-18879.exe	44
PID 2784 wrote to memory of 2072	2784	Unicorn-18879.exe	44
PID 2784 wrote to memory of 2072	2784	Unicorn-18879.exe	44
PID 2604 wrote to memory of 1864	2604	Unicorn-56084.exe	45
PID 2604 wrote to memory of 1864	2604	Unicorn-56084.exe	45
PID 2604 wrote to memory of 1864	2604	Unicorn-56084.exe	45
PID 2604 wrote to memory of 1864	2604	Unicorn-56084.exe	45

C:\Users\Admin\AppData\Local\Temp\d87a255ed113d19c675f922922bb4d5416a6196d170f6d5ddd0d94c1929a6931N.exe
"C:\Users\Admin\AppData\Local\Temp\d87a255ed113d19c675f922922bb4d5416a6196d170f6d5ddd0d94c1929a6931N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48286.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48286.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29104.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29104.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2932
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 240
      4⤵
      Loads dropped DLL
      Program crash
      PID:2704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21864.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21864.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56084.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37190.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44136.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42538.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22404.exe
        8⤵
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16444.exe
        8⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37561.exe
        8⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
        8⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26500.exe
        8⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50971.exe
        7⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59106.exe
        8⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32342.exe
        8⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32594.exe
        8⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62018.exe
        8⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3391.exe
        7⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51943.exe
        7⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13292.exe
        7⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59303.exe
        7⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5049.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52606.exe
        7⤵
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59319.exe
        7⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17926.exe
        7⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53773.exe
        7⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56869.exe
        7⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45023.exe
        6⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14368.exe
        7⤵
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62193.exe
        7⤵
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38007.exe
        7⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37643.exe
        6⤵
        
        PID:2556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5946.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28572.exe
        6⤵
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8006.exe
        6⤵
        
        PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55464.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        6⤵
        
        PID:2464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56164.exe
        6⤵
        
        PID:2636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31963.exe
        6⤵
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35206.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56870.exe
        5⤵
        
        PID:2540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30513.exe
        5⤵
        
        PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16278.exe
        5⤵
        
        PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51453.exe
        5⤵
        
        PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40871.exe
        5⤵
        
        PID:5532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-85.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-85.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2086.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32440.exe
        6⤵
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56714.exe
        6⤵
        
        PID:2452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34179.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57302.exe
        6⤵
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40341.exe
        6⤵
        
        PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24743.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33616.exe
        6⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        7⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18859.exe
        7⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5251.exe
        7⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49006.exe
        7⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43569.exe
        6⤵
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37561.exe
        6⤵
        
        PID:3832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
        6⤵
        
        PID:4624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40341.exe
        6⤵
        
        PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7558.exe
        5⤵
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25474.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16198.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32594.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12652.exe
        6⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40341.exe
        6⤵
        
        PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28162.exe
        5⤵
        
        PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39848.exe
        5⤵
        
        PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13259.exe
        5⤵
        
        PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2981.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19340.exe
        5⤵
        
        PID:5548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52194.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3166.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33782.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9444.exe
        7⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27224.exe
        7⤵
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34908.exe
        7⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16141.exe
        7⤵
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28878.exe
        6⤵
        
        PID:3960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27272.exe
        6⤵
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20598.exe
        6⤵
        
        PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35701.exe
        5⤵
        
        PID:1500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46078.exe
        5⤵
        
        PID:3312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38460.exe
        5⤵
        
        PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51351.exe
        5⤵
        
        PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56478.exe
        5⤵
        
        PID:5612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38947.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27379.exe
        5⤵
        
        PID:2588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5343.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19413.exe
        5⤵
        
        PID:5952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12091.exe
      4⤵
      PID:2476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5280.exe
      4⤵
      PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45638.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35676.exe
      4⤵
      PID:6136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62891.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62891.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2436.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3347.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64617.exe
        6⤵
        
        PID:2080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13310.exe
        6⤵
        
        PID:3848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7135.exe
        6⤵
        
        PID:3276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
        6⤵
        
        PID:4852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40341.exe
        6⤵
        
        PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13916.exe
        5⤵
        
        PID:1260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8654.exe
        5⤵
        
        PID:4016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43426.exe
        5⤵
        
        PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2451.exe
        5⤵
        
        PID:4708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63769.exe
        5⤵
        
        PID:5660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47758.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15589.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1900.exe
        6⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36310.exe
        7⤵
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23825.exe
        7⤵
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5146.exe
        7⤵
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32972.exe
        6⤵
        
        PID:1900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53705.exe
        6⤵
        
        PID:3308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60317.exe
        6⤵
        
        PID:2264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56869.exe
        6⤵
        
        PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4915.exe
        5⤵
        
        PID:540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25474.exe
        6⤵
        
        PID:2352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16198.exe
        6⤵
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32594.exe
        6⤵
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62018.exe
        6⤵
        
        PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19151.exe
        5⤵
        
        PID:3000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48513.exe
        5⤵
        
        PID:3548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43389.exe
        5⤵
        
        PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11585.exe
        5⤵
        
        PID:6016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11379.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33295.exe
        5⤵
        
        PID:2252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23825.exe
        5⤵
        
        PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5251.exe
        5⤵
        
        PID:4680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28520.exe
      4⤵
      PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59522.exe
        5⤵
        
        PID:3416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65454.exe
        5⤵
        
        PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61936.exe
        5⤵
        
        PID:5852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52128.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63184.exe
      4⤵
      PID:4872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32270.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54579.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54579.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58324.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21589.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31608.exe
        6⤵
        
        PID:1652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28912.exe
        6⤵
        
        PID:3524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32594.exe
        6⤵
        
        PID:4280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62018.exe
        6⤵
        
        PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27118.exe
        5⤵
        
        PID:1512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-186.exe
        6⤵
        
        PID:6000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42648.exe
        5⤵
        
        PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38460.exe
        5⤵
        
        PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51351.exe
        5⤵
        
        PID:5580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3451.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51101.exe
        5⤵
        
        PID:1956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33517.exe
        6⤵
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39564.exe
        6⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10276.exe
        6⤵
        
        PID:4936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15349.exe
        5⤵
        
        PID:1836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7135.exe
        5⤵
        
        PID:3688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40774.exe
        5⤵
        
        PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14767.exe
        5⤵
        
        PID:5564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50363.exe
      4⤵
      PID:1544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8930.exe
      4⤵
      PID:3192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4335.exe
      4⤵
      PID:992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63950.exe
      4⤵
      PID:5968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47915.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47915.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32018.exe
      4⤵
      PID:1960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28912.exe
      4⤵
      PID:3580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32594.exe
      4⤵
      PID:4360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
      4⤵
      PID:4796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40341.exe
      4⤵
      PID:5900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13874.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13874.exe
    3⤵
    PID:1360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43808.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43808.exe
    3⤵
    PID:3172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8794.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8794.exe
    3⤵
    PID:4288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41652.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41652.exe
    3⤵
    PID:4664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2061.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2061.exe
    3⤵
    PID:6112
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8854.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8854.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19437.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35903.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3347.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30712.exe
        7⤵
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19372.exe
        8⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39969.exe
        8⤵
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5146.exe
        8⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25328.exe
        7⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49447.exe
        7⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
        7⤵
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59087.exe
        6⤵
        
        PID:796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3253.exe
        7⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23825.exe
        7⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5251.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16141.exe
        7⤵
        
        PID:4924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21248.exe
        6⤵
        
        PID:792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55312.exe
        6⤵
        
        PID:4040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2451.exe
        6⤵
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63769.exe
        6⤵
        
        PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49019.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19415.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14311.exe
        7⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14035.exe
        7⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47908.exe
        7⤵
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65534.exe
        7⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9495.exe
        6⤵
        
        PID:2684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12332.exe
        6⤵
        
        PID:3824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53773.exe
        6⤵
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29236.exe
        5⤵
        
        PID:2996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14560.exe
        6⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47082.exe
        7⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37701.exe
        7⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43141.exe
        7⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49804.exe
        6⤵
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54452.exe
        6⤵
        
        PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4420.exe
        5⤵
        
        PID:2456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7015.exe
        5⤵
        
        PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62548.exe
        5⤵
        
        PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19218.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5724.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34734.exe
        6⤵
        
        PID:916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44784.exe
        6⤵
        
        PID:2736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37753.exe
        6⤵
        
        PID:3424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
        6⤵
        
        PID:4904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40341.exe
        6⤵
        
        PID:5892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30877.exe
        5⤵
        
        PID:940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        6⤵
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46571.exe
        6⤵
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37348.exe
        6⤵
        
        PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58519.exe
        5⤵
        
        PID:1492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59570.exe
        5⤵
        
        PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2451.exe
        5⤵
        
        PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23805.exe
        5⤵
        
        PID:5664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50331.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19031.exe
        5⤵
        
        PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30341.exe
        5⤵
        
        PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53705.exe
        5⤵
        
        PID:4032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62018.exe
        5⤵
        
        PID:5096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21946.exe
      4⤵
      PID:2628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        5⤵
        
        PID:3428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46571.exe
        5⤵
        
        PID:4220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5251.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16333.exe
        5⤵
        
        PID:5784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41277.exe
      4⤵
      PID:1060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34369.exe
      4⤵
      PID:3684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49167.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37728.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37728.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52732.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58324.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18598.exe
        6⤵
        
        PID:832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12926.exe
        6⤵
        
        PID:3932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27272.exe
        6⤵
        
        PID:4828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53271.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23614.exe
        5⤵
        
        PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48745.exe
        5⤵
        
        PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48637.exe
        5⤵
        
        PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23805.exe
        5⤵
        
        PID:5720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36979.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41309.exe
        5⤵
        
        PID:1744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48214.exe
        5⤵
        
        PID:1052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37561.exe
        5⤵
        
        PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
        5⤵
        
        PID:4768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37592.exe
      4⤵
      PID:2220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24691.exe
      4⤵
      PID:3208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18424.exe
      4⤵
      PID:3768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63950.exe
      4⤵
      PID:5972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61843.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61843.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60519.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20510.exe
        5⤵
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18822.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39969.exe
        6⤵
        
        PID:1008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19413.exe
        6⤵
        
        PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56921.exe
        5⤵
        
        PID:3800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43426.exe
        5⤵
        
        PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2451.exe
        5⤵
        
        PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23805.exe
        5⤵
        
        PID:5684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63170.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49942.exe
      4⤵
      PID:1696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50905.exe
      4⤵
      PID:3700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35116.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8006.exe
      4⤵
      PID:5224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3082.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3082.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61638.exe
      4⤵
      PID:1328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46078.exe
      4⤵
      PID:3352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38460.exe
      4⤵
      PID:4548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35206.exe
      4⤵
      PID:5700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23805.exe
      4⤵
      PID:5744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24685.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24685.exe
    3⤵
    PID:2496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11473.exe
      4⤵
      PID:3664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12362.exe
      4⤵
      PID:4484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5142.exe
      4⤵
      PID:5676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37969.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37969.exe
    3⤵
    PID:3752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51435.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51435.exe
    3⤵
    PID:3820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27636.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27636.exe
    3⤵
    PID:5208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14005.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14005.exe
    3⤵
    PID:5528
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18879.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18879.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6883.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6883.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46214.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12065.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56461.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19372.exe
        7⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58937.exe
        7⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4570.exe
        7⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36251.exe
        6⤵
        
        PID:912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28426.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2451.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22672.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58645.exe
        6⤵
        
        PID:3432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58937.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51437.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49006.exe
        6⤵
        
        PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49987.exe
        5⤵
        
        PID:2272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51943.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29794.exe
        5⤵
        
        PID:4348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15573.exe
        5⤵
        
        PID:5140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25230.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58272.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26042.exe
        6⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe
        7⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32342.exe
        7⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32594.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
        7⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7476.exe
        7⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35618.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46078.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38460.exe
        6⤵
        
        PID:4504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59925.exe
        6⤵
        
        PID:4640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58988.exe
        6⤵
        
        PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21993.exe
        5⤵
        
        PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50211.exe
        5⤵
        
        PID:3388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13000.exe
        5⤵
        
        PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44906.exe
        5⤵
        
        PID:5264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41774.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3462.exe
        5⤵
        
        PID:820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47368.exe
        6⤵
        
        PID:808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28912.exe
        6⤵
        
        PID:3620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32594.exe
        6⤵
        
        PID:4244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62018.exe
        6⤵
        
        PID:4980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28052.exe
        5⤵
        
        PID:2120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14500.exe
        6⤵
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17307.exe
        6⤵
        
        PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57864.exe
        5⤵
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
        5⤵
        
        PID:4760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19149.exe
      4⤵
      PID:2304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14503.exe
        5⤵
        
        PID:1356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28912.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32594.exe
        5⤵
        
        PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
        5⤵
        
        PID:4856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56677.exe
        5⤵
        
        PID:5052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38495.exe
      4⤵
      PID:2772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42418.exe
        5⤵
        
        PID:3508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27224.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5146.exe
        5⤵
        
        PID:5032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26742.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30325.exe
      4⤵
      PID:4256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35682.exe
      4⤵
      PID:5084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14309.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14309.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49393.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14847.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1900.exe
        6⤵
        
        PID:836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48925.exe
        6⤵
        
        PID:2116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37561.exe
        6⤵
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
        6⤵
        
        PID:4748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14515.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29084.exe
        5⤵
        
        PID:2508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18606.exe
        5⤵
        
        PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4063.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13046.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13647.exe
        5⤵
        
        PID:360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53776.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28364.exe
        5⤵
        
        PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23433.exe
        5⤵
        
        PID:5544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22789.exe
      4⤵
      PID:1508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48513.exe
      4⤵
      PID:3568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29794.exe
      4⤵
      PID:4376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61972.exe
      4⤵
      PID:5128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14539.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14539.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21764.exe
      4⤵
      PID:2484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27875.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44701.exe
      4⤵
      PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49006.exe
      4⤵
      PID:5644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31296.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31296.exe
    3⤵
    PID:2888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24245.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24245.exe
    3⤵
    PID:3888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53337.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53337.exe
    3⤵
    PID:3600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40441.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40441.exe
    3⤵
    PID:5304
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39675.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39675.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19951.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19951.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16638.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26042.exe
        5⤵
        
        PID:2560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21022.exe
        6⤵
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27216.exe
        6⤵
        
        PID:3900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5251.exe
        6⤵
        
        PID:4620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49006.exe
        6⤵
        
        PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18234.exe
        5⤵
        
        PID:2640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44299.exe
        5⤵
        
        PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61442.exe
        5⤵
        
        PID:5236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56778.exe
      4⤵
      PID:2324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24540.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32342.exe
        5⤵
        
        PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60306.exe
        5⤵
        
        PID:4200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40341.exe
        5⤵
        
        PID:5924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36448.exe
      4⤵
      PID:2872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19760.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62548.exe
      4⤵
      PID:5044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63653.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63653.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17510.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51101.exe
        5⤵
        
        PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64550.exe
        5⤵
        
        PID:2944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37561.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
        5⤵
        
        PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56869.exe
        5⤵
        
        PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37011.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18303.exe
        5⤵
        
        PID:3144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39969.exe
        5⤵
        
        PID:1352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5146.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3065.exe
      4⤵
      PID:3184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59570.exe
      4⤵
      PID:3692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45482.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46621.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46621.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9195.exe
      4⤵
      PID:3264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23825.exe
      4⤵
      PID:3988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5251.exe
      4⤵
      PID:4660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63989.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63989.exe
    3⤵
    PID:1644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21815.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21815.exe
    3⤵
    PID:3916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32101.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32101.exe
    3⤵
    PID:5156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15297.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15297.exe
    3⤵
    PID:5596
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11513.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11513.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33799.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33799.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50743.exe
      4⤵
      PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51167.exe
        5⤵
        
        PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58937.exe
        5⤵
        
        PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5251.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44784.exe
      4⤵
      PID:2840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37561.exe
      4⤵
      PID:3844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
      4⤵
      PID:4776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40341.exe
      4⤵
      PID:5916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-836.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-836.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21598.exe
      4⤵
      PID:888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61617.exe
      4⤵
      PID:3284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29732.exe
      4⤵
      PID:5392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15633.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15633.exe
    3⤵
    PID:1988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50164.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50164.exe
    3⤵
    PID:3652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2451.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2451.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4732
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56766.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56766.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32342.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32342.exe
    3⤵
    PID:3244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32594.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32594.exe
    3⤵
    PID:4384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4884
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39305.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39305.exe
  2⤵
  PID:2308
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3245.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3245.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3880
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8425.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8425.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3204
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45852.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45852.exe
  2⤵
  PID:4668
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47537.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47537.exe
  2⤵
  PID:6088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-19437.exe

Filesize
468KB

MD5
43ad167e235bbb937b61ab797afbca73

SHA1
64e9e684d51cb4180f2dada2d3397791db1ba536

SHA256
2caf72f0f5e0caa9aa54fd941257e0ff6225692a6d169eab62d0c3413fa44536

SHA512
781e3fee89cc723472bfbda9e1451bb2402d79d3f795ace97f804d47d859a9a6a65253d9256452a9fa518bc1e9efd04fcbf1ca5074edadf33f72e60a89d9feff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39675.exe

Filesize
468KB

MD5
0e38cf5b07a252ce2cb005da2ce4b8db

SHA1
3ff6b2146d79f758d8cfff7f92505f05832aa540

SHA256
7a7b7790e9f9bbbdd0a28b2c2491b8e500e3473d2d9ab928102b3c7bf9f6b8d4

SHA512
2127bcea68fa332d5dc8a808e4f061262ae4b1e6d5f19f0e9fe56af3354e1de602cde0367610cb79cc87d11448aba0a2a4ef08e328739edef1aa9636ce8746c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46214.exe

Filesize
468KB

MD5
61377d8d97a585025ec8051c832466d1

SHA1
9cb1a64219c347287cf4fb3d64c645685ebb6356

SHA256
644f9e6878619951de3140a90b75ee09f36330eeed069b6c15d234027b2c6286

SHA512
f1a8b8a8060f00ff6b1eb9ec6f84305af8134cb100c0a06a9f7dbc91a3d0230f6bcb4e30eadf60a1d36928a6ed9574ea3b1e0f805b1ee9b0a4e08b2eadab180c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51453.exe

Filesize
468KB

MD5
429d3c223e44317299b819dfdb004826

SHA1
03657420b665c513f4069e1a4d3370ca6dfffde0

SHA256
da53b5eb731d000e3935353f2c3e0deb1f83bfc04ee133e1f0bdbfda4c32ae87

SHA512
0adad7872516a929a9063cd2ff417ce0644ea57bbacc3d68323cbdd33f278d1ac6cdd42bd934a4260cef424d289edf49b7b54f05c63c26bbbf65cf2ab177d4b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5724.exe

Filesize
468KB

MD5
9af2ba15178476a412b2b59a2784d928

SHA1
499d946f9896eafecf2fcff9a02f96367cc5ea60

SHA256
98a407d4b59702bac28b4a92b258b7e29c56395e5eb849d7a01f8a2b89d21f90

SHA512
35794edf778cc1eefbed43efbcf8b5d639e4eccb63c93e364207496e5cb29b1c0acb4700d30b9c7673abee5604d0cc5f8ba14180e5c241fd2eb8555511fc68ea

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14309.exe

Filesize
468KB

MD5
d9102252e7a9f3fb20cd3f2559eaa909

SHA1
e72988f39dbf706f9eba84f5229c34f60dafe95b

SHA256
d460fa389faa5d64c66b47d0c6679c05509ba5f890e741b5ffdb1ea037465039

SHA512
46e1c0c8dcafade612640507edc1a947fe72a7d722626e06e01c9ca0fc58b8cc8c531e4bde7e096c82bde29a9133932932b18e793e87d1e5d17c80c05b26b40b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18879.exe

Filesize
468KB

MD5
5ab7a94f771fc406225a7a3f86e12e4e

SHA1
8ed317ef63d3520f8c20e772529ef83eb618d595

SHA256
90bd5ae4f0d0017daf129217186317c56be48d128ac9e91b756733001fdf8be9

SHA512
de936c6443f830853854971df1f214e7a6aa56a08f087fc64a6606cecd8eaaa2a24cf2672bfa57351857a9569362dd83e269df9b32758d49b9ef11c7d9d8767b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-21864.exe

Filesize
468KB

MD5
b0352314181ef242ff0c77fcd81dd4d3

SHA1
5e240039a297d6519b33bb7fc1d6afd4e9a95c0e

SHA256
fee60e46afb90b1be59ae5c57d49fba9b97e4fde27700a27b723a65caab9322d

SHA512
680b7a4e0c3e08a3c3a1ab807df56009ff81483e811c5027802f246c399e91df2fe65336d377c659f24b25d9610d5f46f3930107649737175df327bbdf65346e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe

Filesize
468KB

MD5
4f8f71855b58d97819f71e3fd6560f5f

SHA1
a7746cc2a1c44dcf7536ced80b1f9f1293b21151

SHA256
b9275c7f5bcf0e1f2b37e7e79cf07c9ca9524c91081b01dcaf386013a69ce93d

SHA512
478602f862972e8cd3ea703d26e35326e56981d82430c3c9e6157e55509100fe4c0b7ed0fc6e4e3624a813a15846a31a165155f604a2823f33c816df3b9ff1e7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29104.exe

Filesize
468KB

MD5
a7d0852dab6af19e204fb8d5f0ae931c

SHA1
3fcd5199ca2e4b721234abe468b4b48ea3b1c286

SHA256
9acf4781353e7710e758d6da28e6733050aa73f364de4a5fa0674efc08e91828

SHA512
9579719965c2148c01077f957b0d047d0a9257af791d34a65dc7afd532460eb4feee0dc9fa7a87002ff118ce9410edf1a720eaf0abf33fa428ad756305c01105

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37190.exe

Filesize
468KB

MD5
b1c28365c999db6511d20c700cf33ae9

SHA1
efaa934b912dcd94464c5783ad688e2891e2859b

SHA256
d73d34d6adb76d43e7c93705b19d3b2ad281d95fd655870a9579d6473a6e5c7b

SHA512
ca74f6b52e93f4100968c62dbb5a32442650ae461282ee7a37f44926952bc0bcedfc8f21d216824af4fb5255a461700c82e8458bfa9f81a2580889791b5ceb9b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37728.exe

Filesize
468KB

MD5
5668654ed2db144e9149505b0da41b40

SHA1
b081d1cf96553f7bf7ce8b98bd71ff50b4883240

SHA256
7ce1e48bb4f895cbc8de8a8116cd4a68f33142a92baebfbf7b549935c20690d7

SHA512
fd6ff4dc0a9e7e3c41ba2329a124f652f07d42253b3fa69db308c0c742997b8afc75a7207a89bf1e24359f293eb8c9deb37c3afcfa93cfe58fa2806015d676a5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-48286.exe

Filesize
468KB

MD5
00428647af55a9055ad8a75a16891520

SHA1
3c6cd8d271a8d9ea6c425cf1a8892085b5caf1ac

SHA256
21a470ea4365b5896a59a1e8a73571734ed121bec8ba4feaf8894f6bafb2a492

SHA512
e76272715401518ca5cc4e8401d3ffcfa2e52f82fe7feb8070f6390382bb5748c2fe99e6b8ea1984833b7cd16d41a90f3be84a9017e534afe87cb4544b695b97

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56084.exe

Filesize
468KB

MD5
8d2ce289f21cd639d6973257caf80ce8

SHA1
a00b48faa293188707b810f0e9528f55f22e1dd6

SHA256
7803e53d9a80af02623e2a1161742cae1b9c78a3454ab3ffd7f9cc7e81ddb370

SHA512
f0db4c0e8fbb6fc58afe910618f058511ddcdda296aa93bbb63a06647ec260c9ba9c32695382beb9f9842fa37c0c0d3fa07178e319241af39d016a8da1c9c59f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62891.exe

Filesize
468KB

MD5
7cecbf9b318850be4917042f7f0e6fa6

SHA1
96e069fe0fe4d5bbe6326cb31a6707b22e05e081

SHA256
f78dc828d4187b3d3a3605cea2dabe326b5566963108875f3f274c0f79d034f9

SHA512
47f629920c335e48dbb27abb3d7dd5572ba77e37e6b53b372a959470c073b16598140d3a3174a68405d2c64e4d7a8993bc1dfc272caa81701ac98b39282ac3ce

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-6883.exe

Filesize
468KB

MD5
252f4bd37edda061e596aaa4ff891d74

SHA1
332a1f86efba25847f313af40bb09c04382a591d

SHA256
2a4d7e03a939d797de41fb332a500c379e5ef43949b77207a6193bf30db13f83

SHA512
f5004fd8b9a51e21f4a3bf3da8ab38671a526a64b53948280f98a3909382e4680c71f06841623e763facb1d3dab0b7e41a070e59e42724a958610760e12c6098

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-85.exe

Filesize
468KB

MD5
b4433d489e8bfeebf6d5ded0b4a9fe75

SHA1
56fb545510acc327e0917f4e03d02bc3440bfa4f

SHA256
82d538dde835d241dca9e1460cfe0e1b5db6ee4414615bd304985ccc5ba7c3b1

SHA512
28f7c70fd845e259553cab6652efde2204083ef79dd526d7dc9cdcf9dcbd13c680f6a8e475f745e37a44fca85d47c016780b2ba5f8cd687a7c06146ad312d981

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8854.exe

Filesize
468KB

MD5
790df154c3cb7cec1880f4f0a6d198c9

SHA1
bae986dc33d7a66113d4c2dd8c394b1a2f141062

SHA256
dd55689d6d07c0b2bbfa783b15debd89e3c56f6b2a639f7a062b5a576beb7f93

SHA512
66112486de7229767f15099a67661806b2d5f8f2857b2f707abbb10a980e219327c5ff97277db64d33c1b5554803b306d659f56d1fbea44a46cba859df3be8b3

Download Submit
memory/520-405-0x00000000029A0000-0x0000000002A15000-memory.dmp

Filesize
468KB

Download
memory/520-272-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/520-392-0x00000000029A0000-0x0000000002A15000-memory.dmp

Filesize
468KB

Download
memory/596-271-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/604-267-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/840-247-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/928-252-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1536-207-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1604-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1772-391-0x0000000001EB0000-0x0000000001F25000-memory.dmp

Filesize
468KB

Download
memory/1772-230-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1864-314-0x00000000007E0000-0x0000000000855000-memory.dmp

Filesize
468KB

Download
memory/1864-193-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1864-310-0x00000000007E0000-0x0000000000855000-memory.dmp

Filesize
468KB

Download
memory/1872-412-0x00000000026E0000-0x0000000002755000-memory.dmp

Filesize
468KB

Download
memory/1872-13-0x00000000026E0000-0x0000000002755000-memory.dmp

Filesize
468KB

Download
memory/1872-220-0x00000000026E0000-0x0000000002755000-memory.dmp

Filesize
468KB

Download
memory/1872-218-0x00000000026E0000-0x0000000002755000-memory.dmp

Filesize
468KB

Download
memory/1872-354-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1872-380-0x00000000026E0000-0x0000000002755000-memory.dmp

Filesize
468KB

Download
memory/1872-11-0x00000000026E0000-0x0000000002755000-memory.dmp

Filesize
468KB

Download
memory/1872-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1884-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1916-379-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1916-224-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2060-295-0x0000000002930000-0x00000000029A5000-memory.dmp

Filesize
468KB

Download
memory/2060-293-0x0000000002930000-0x00000000029A5000-memory.dmp

Filesize
468KB

Download
memory/2060-167-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2064-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2072-332-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/2072-181-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2072-328-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/2100-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2196-229-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/2196-225-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/2196-138-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2196-387-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/2196-403-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/2244-264-0x00000000026A0000-0x0000000002715000-memory.dmp

Filesize
468KB

Download
memory/2244-133-0x00000000026A0000-0x0000000002715000-memory.dmp

Filesize
468KB

Download
memory/2244-134-0x00000000026A0000-0x0000000002715000-memory.dmp

Filesize
468KB

Download
memory/2244-266-0x00000000026A0000-0x0000000002715000-memory.dmp

Filesize
468KB

Download
memory/2300-236-0x00000000028C0000-0x0000000002935000-memory.dmp

Filesize
468KB

Download
memory/2300-232-0x00000000028C0000-0x0000000002935000-memory.dmp

Filesize
468KB

Download
memory/2300-148-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2536-221-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2536-342-0x0000000002940000-0x00000000029B5000-memory.dmp

Filesize
468KB

Download
memory/2536-338-0x0000000003470000-0x00000000034E5000-memory.dmp

Filesize
468KB

Download
memory/2604-325-0x00000000002F0000-0x0000000000365000-memory.dmp

Filesize
468KB

Download
memory/2604-192-0x00000000002F0000-0x0000000000365000-memory.dmp

Filesize
468KB

Download
memory/2604-191-0x00000000002F0000-0x0000000000365000-memory.dmp

Filesize
468KB

Download
memory/2604-326-0x00000000002F0000-0x0000000000365000-memory.dmp

Filesize
468KB

Download
memory/2604-101-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2632-165-0x0000000000530000-0x00000000005A5000-memory.dmp

Filesize
468KB

Download
memory/2632-103-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2632-303-0x0000000000530000-0x00000000005A5000-memory.dmp

Filesize
468KB

Download
memory/2632-299-0x0000000000530000-0x00000000005A5000-memory.dmp

Filesize
468KB

Download
memory/2632-166-0x0000000000530000-0x00000000005A5000-memory.dmp

Filesize
468KB

Download
memory/2688-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2740-350-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/2740-356-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/2740-132-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2740-209-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/2740-222-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/2784-73-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2784-100-0x0000000002580000-0x00000000025F5000-memory.dmp

Filesize
468KB

Download
memory/2784-179-0x0000000002580000-0x00000000025F5000-memory.dmp

Filesize
468KB

Download
memory/2784-367-0x0000000002580000-0x00000000025F5000-memory.dmp

Filesize
468KB

Download
memory/2784-359-0x0000000002580000-0x00000000025F5000-memory.dmp

Filesize
468KB

Download
memory/2788-343-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2868-131-0x0000000001F60000-0x0000000001FD5000-memory.dmp

Filesize
468KB

Download
memory/2868-265-0x0000000001F60000-0x0000000001FD5000-memory.dmp

Filesize
468KB

Download
memory/2868-12-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2868-23-0x0000000001F60000-0x0000000001FD5000-memory.dmp

Filesize
468KB

Download
memory/2868-45-0x0000000001F60000-0x0000000001FD5000-memory.dmp

Filesize
468KB

Download
memory/2868-268-0x0000000001F60000-0x0000000001FD5000-memory.dmp

Filesize
468KB

Download
memory/2868-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2876-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2912-413-0x0000000001D60000-0x0000000001DD5000-memory.dmp

Filesize
468KB

Download
memory/2912-269-0x0000000001D60000-0x0000000001DD5000-memory.dmp

Filesize
468KB

Download
memory/2912-253-0x0000000001D60000-0x0000000001DD5000-memory.dmp

Filesize
468KB

Download
memory/2912-137-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2912-414-0x0000000001D60000-0x0000000001DD5000-memory.dmp

Filesize
468KB

Download
memory/2916-333-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2932-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2956-390-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2956-248-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2956-406-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2956-60-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2956-36-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2956-249-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2968-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3020-404-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3036-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3052-204-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/3052-203-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download