1775c1d0968d72634fbbc763aee00e21e7b23079712d552562cc10d8e151f018

Analysis

max time kernel
116s
max time network
17s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 11:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1775c1d0968d72634fbbc763aee00e21e7b23079712d552562cc10d8e151f018N.exe
Size

468KB
MD5

f6d4487d9ba82acedf5f12724c1ff560
SHA1

241afc5db701318f3f3450b0197d77f9e21fc03c
SHA256

1775c1d0968d72634fbbc763aee00e21e7b23079712d552562cc10d8e151f018
SHA512

3a132af9dc7ddf63434c6bc1ee449637571f43717e2c1fc784dc1e12516610431219e9efd9411f0402026350a2bb941ecb9a53688fe5e389561d6d86cff9c45a
SSDEEP

3072:hudCogdEIc5AHbY9zfjcff8wAaJBHpnLJEHCgdSb/ZDLeDJ3+8fn:huEoE0AHezrcffnBxX/ZH4J3+

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1992	Unicorn-3538.exe
1784	Unicorn-15765.exe
2792	Unicorn-4067.exe
2752	Unicorn-25360.exe
2800	Unicorn-42058.exe
2900	Unicorn-61924.exe
2648	Unicorn-63962.exe
2036	Unicorn-38619.exe
1964	Unicorn-16013.exe
1808	Unicorn-1160.exe
2984	Unicorn-60575.exe
2668	Unicorn-51758.exe
2700	Unicorn-11374.exe
2968	Unicorn-52023.exe
2832	Unicorn-32157.exe
1448	Unicorn-60466.exe
1396	Unicorn-35447.exe
1032	Unicorn-27685.exe
448	Unicorn-13002.exe
2580	Unicorn-35661.exe
1644	Unicorn-32131.exe
2044	Unicorn-60165.exe
1780	Unicorn-4140.exe
2060	Unicorn-53896.exe
1716	Unicorn-16393.exe
1748	Unicorn-23990.exe
2264	Unicorn-45173.exe
2272	Unicorn-47211.exe
1756	Unicorn-61509.exe
956	Unicorn-57788.exe
1688	Unicorn-20019.exe
2464	Unicorn-4763.exe
1712	Unicorn-27221.exe
1592	Unicorn-33352.exe
2560	Unicorn-29630.exe
2692	Unicorn-53388.exe
2208	Unicorn-45775.exe
3032	Unicorn-8271.exe
2748	Unicorn-37939.exe
2852	Unicorn-50072.exe
2656	Unicorn-871.exe
2672	Unicorn-9231.exe
2956	Unicorn-46543.exe
2516	Unicorn-21484.exe
1476	Unicorn-28945.exe
2828	Unicorn-48811.exe
2932	Unicorn-48811.exe
2964	Unicorn-62879.exe
1080	Unicorn-9869.exe
1816	Unicorn-24689.exe
892	Unicorn-60553.exe
744	Unicorn-60553.exe
1744	Unicorn-5230.exe
2300	Unicorn-13761.exe
2112	Unicorn-37711.exe
2064	Unicorn-17291.exe
988	Unicorn-17291.exe
2388	Unicorn-8360.exe
1156	Unicorn-4581.exe
1608	Unicorn-64253.exe
544	Unicorn-8930.exe
1724	Unicorn-21545.exe
1324	Unicorn-5998.exe
884	Unicorn-18613.exe

Loads dropped DLL 64 IoCs

pid	Process
1344	1775c1d0968d72634fbbc763aee00e21e7b23079712d552562cc10d8e151f018N.exe
1344	1775c1d0968d72634fbbc763aee00e21e7b23079712d552562cc10d8e151f018N.exe
1992	Unicorn-3538.exe
1992	Unicorn-3538.exe
1344	1775c1d0968d72634fbbc763aee00e21e7b23079712d552562cc10d8e151f018N.exe
1344	1775c1d0968d72634fbbc763aee00e21e7b23079712d552562cc10d8e151f018N.exe
1784	Unicorn-15765.exe
1784	Unicorn-15765.exe
1992	Unicorn-3538.exe
2792	Unicorn-4067.exe
1992	Unicorn-3538.exe
2792	Unicorn-4067.exe
1344	1775c1d0968d72634fbbc763aee00e21e7b23079712d552562cc10d8e151f018N.exe
1344	1775c1d0968d72634fbbc763aee00e21e7b23079712d552562cc10d8e151f018N.exe
2752	Unicorn-25360.exe
2752	Unicorn-25360.exe
1784	Unicorn-15765.exe
1784	Unicorn-15765.exe
2800	Unicorn-42058.exe
1992	Unicorn-3538.exe
1992	Unicorn-3538.exe
2800	Unicorn-42058.exe
2648	Unicorn-63962.exe
2648	Unicorn-63962.exe
1344	1775c1d0968d72634fbbc763aee00e21e7b23079712d552562cc10d8e151f018N.exe
2792	Unicorn-4067.exe
2900	Unicorn-61924.exe
1344	1775c1d0968d72634fbbc763aee00e21e7b23079712d552562cc10d8e151f018N.exe
2900	Unicorn-61924.exe
2792	Unicorn-4067.exe
2036	Unicorn-38619.exe
2036	Unicorn-38619.exe
2752	Unicorn-25360.exe
2752	Unicorn-25360.exe
1964	Unicorn-16013.exe
1964	Unicorn-16013.exe
1784	Unicorn-15765.exe
1784	Unicorn-15765.exe
2968	Unicorn-52023.exe
2968	Unicorn-52023.exe
2900	Unicorn-61924.exe
2900	Unicorn-61924.exe
2984	Unicorn-60575.exe
2984	Unicorn-60575.exe
2668	Unicorn-51758.exe
2668	Unicorn-51758.exe
2800	Unicorn-42058.exe
2800	Unicorn-42058.exe
2832	Unicorn-32157.exe
2832	Unicorn-32157.exe
1344	1775c1d0968d72634fbbc763aee00e21e7b23079712d552562cc10d8e151f018N.exe
1344	1775c1d0968d72634fbbc763aee00e21e7b23079712d552562cc10d8e151f018N.exe
2700	Unicorn-11374.exe
2700	Unicorn-11374.exe
2792	Unicorn-4067.exe
2792	Unicorn-4067.exe
1808	Unicorn-1160.exe
1808	Unicorn-1160.exe
2648	Unicorn-63962.exe
2648	Unicorn-63962.exe
1992	Unicorn-3538.exe
1992	Unicorn-3538.exe
1396	Unicorn-35447.exe
1396	Unicorn-35447.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2240	1324	WerFault.exe	93
3532	2376	WerFault.exe	147
5464	5684	WerFault.exe	483

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41685.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38832.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36184.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62811.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31684.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10741.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64497.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22603.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35686.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50072.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55516.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57942.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41749.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36336.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28797.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47322.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35489.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60553.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24316.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7726.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8961.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30256.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40705.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60466.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10002.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44001.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35447.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54270.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33065.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20456.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15062.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28797.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35866.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50817.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53215.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60553.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9506.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32966.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52262.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58519.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47617.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30256.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50399.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64136.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31216.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50495.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40680.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53896.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13590.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59610.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27978.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4763.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18747.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40150.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50495.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57044.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23191.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38178.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53170.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1344	1775c1d0968d72634fbbc763aee00e21e7b23079712d552562cc10d8e151f018N.exe
1992	Unicorn-3538.exe
1784	Unicorn-15765.exe
2792	Unicorn-4067.exe
2752	Unicorn-25360.exe
2800	Unicorn-42058.exe
2900	Unicorn-61924.exe
2648	Unicorn-63962.exe
2036	Unicorn-38619.exe
1964	Unicorn-16013.exe
2968	Unicorn-52023.exe
2668	Unicorn-51758.exe
2984	Unicorn-60575.exe
1808	Unicorn-1160.exe
2700	Unicorn-11374.exe
2832	Unicorn-32157.exe
1448	Unicorn-60466.exe
1396	Unicorn-35447.exe
1032	Unicorn-27685.exe
448	Unicorn-13002.exe
2580	Unicorn-35661.exe
2044	Unicorn-60165.exe
1644	Unicorn-32131.exe
1780	Unicorn-4140.exe
2060	Unicorn-53896.exe
1716	Unicorn-16393.exe
1748	Unicorn-23990.exe
2264	Unicorn-45173.exe
2272	Unicorn-47211.exe
1756	Unicorn-61509.exe
956	Unicorn-57788.exe
1688	Unicorn-20019.exe
2464	Unicorn-4763.exe
1712	Unicorn-27221.exe
1592	Unicorn-33352.exe
2560	Unicorn-29630.exe
2692	Unicorn-53388.exe
2208	Unicorn-45775.exe
3032	Unicorn-8271.exe
2748	Unicorn-37939.exe
2852	Unicorn-50072.exe
2672	Unicorn-9231.exe
2956	Unicorn-46543.exe
2656	Unicorn-871.exe
2516	Unicorn-21484.exe
1476	Unicorn-28945.exe
2828	Unicorn-48811.exe
2932	Unicorn-48811.exe
2964	Unicorn-62879.exe
744	Unicorn-60553.exe
892	Unicorn-60553.exe
1816	Unicorn-24689.exe
1744	Unicorn-5230.exe
1080	Unicorn-9869.exe
2300	Unicorn-13761.exe
2112	Unicorn-37711.exe
2388	Unicorn-8360.exe
2064	Unicorn-17291.exe
988	Unicorn-17291.exe
544	Unicorn-8930.exe
1156	Unicorn-4581.exe
1608	Unicorn-64253.exe
1724	Unicorn-21545.exe
1324	Unicorn-5998.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 1992	1344	1775c1d0968d72634fbbc763aee00e21e7b23079712d552562cc10d8e151f018N.exe	30
PID 1344 wrote to memory of 1992	1344	1775c1d0968d72634fbbc763aee00e21e7b23079712d552562cc10d8e151f018N.exe	30
PID 1344 wrote to memory of 1992	1344	1775c1d0968d72634fbbc763aee00e21e7b23079712d552562cc10d8e151f018N.exe	30
PID 1344 wrote to memory of 1992	1344	1775c1d0968d72634fbbc763aee00e21e7b23079712d552562cc10d8e151f018N.exe	30
PID 1992 wrote to memory of 1784	1992	Unicorn-3538.exe	31
PID 1992 wrote to memory of 1784	1992	Unicorn-3538.exe	31
PID 1992 wrote to memory of 1784	1992	Unicorn-3538.exe	31
PID 1992 wrote to memory of 1784	1992	Unicorn-3538.exe	31
PID 1344 wrote to memory of 2792	1344	1775c1d0968d72634fbbc763aee00e21e7b23079712d552562cc10d8e151f018N.exe	32
PID 1344 wrote to memory of 2792	1344	1775c1d0968d72634fbbc763aee00e21e7b23079712d552562cc10d8e151f018N.exe	32
PID 1344 wrote to memory of 2792	1344	1775c1d0968d72634fbbc763aee00e21e7b23079712d552562cc10d8e151f018N.exe	32
PID 1344 wrote to memory of 2792	1344	1775c1d0968d72634fbbc763aee00e21e7b23079712d552562cc10d8e151f018N.exe	32
PID 1784 wrote to memory of 2752	1784	Unicorn-15765.exe	34
PID 1784 wrote to memory of 2752	1784	Unicorn-15765.exe	34
PID 1784 wrote to memory of 2752	1784	Unicorn-15765.exe	34
PID 1784 wrote to memory of 2752	1784	Unicorn-15765.exe	34
PID 1992 wrote to memory of 2800	1992	Unicorn-3538.exe	35
PID 1992 wrote to memory of 2800	1992	Unicorn-3538.exe	35
PID 1992 wrote to memory of 2800	1992	Unicorn-3538.exe	35
PID 1992 wrote to memory of 2800	1992	Unicorn-3538.exe	35
PID 2792 wrote to memory of 2900	2792	Unicorn-4067.exe	36
PID 2792 wrote to memory of 2900	2792	Unicorn-4067.exe	36
PID 2792 wrote to memory of 2900	2792	Unicorn-4067.exe	36
PID 2792 wrote to memory of 2900	2792	Unicorn-4067.exe	36
PID 1344 wrote to memory of 2648	1344	1775c1d0968d72634fbbc763aee00e21e7b23079712d552562cc10d8e151f018N.exe	37
PID 1344 wrote to memory of 2648	1344	1775c1d0968d72634fbbc763aee00e21e7b23079712d552562cc10d8e151f018N.exe	37
PID 1344 wrote to memory of 2648	1344	1775c1d0968d72634fbbc763aee00e21e7b23079712d552562cc10d8e151f018N.exe	37
PID 1344 wrote to memory of 2648	1344	1775c1d0968d72634fbbc763aee00e21e7b23079712d552562cc10d8e151f018N.exe	37
PID 2752 wrote to memory of 2036	2752	Unicorn-25360.exe	38
PID 2752 wrote to memory of 2036	2752	Unicorn-25360.exe	38
PID 2752 wrote to memory of 2036	2752	Unicorn-25360.exe	38
PID 2752 wrote to memory of 2036	2752	Unicorn-25360.exe	38
PID 1784 wrote to memory of 1964	1784	Unicorn-15765.exe	39
PID 1784 wrote to memory of 1964	1784	Unicorn-15765.exe	39
PID 1784 wrote to memory of 1964	1784	Unicorn-15765.exe	39
PID 1784 wrote to memory of 1964	1784	Unicorn-15765.exe	39
PID 1992 wrote to memory of 1808	1992	Unicorn-3538.exe	41
PID 1992 wrote to memory of 1808	1992	Unicorn-3538.exe	41
PID 1992 wrote to memory of 1808	1992	Unicorn-3538.exe	41
PID 1992 wrote to memory of 1808	1992	Unicorn-3538.exe	41
PID 2800 wrote to memory of 2984	2800	Unicorn-42058.exe	40
PID 2800 wrote to memory of 2984	2800	Unicorn-42058.exe	40
PID 2800 wrote to memory of 2984	2800	Unicorn-42058.exe	40
PID 2800 wrote to memory of 2984	2800	Unicorn-42058.exe	40
PID 2648 wrote to memory of 2700	2648	Unicorn-63962.exe	42
PID 2648 wrote to memory of 2700	2648	Unicorn-63962.exe	42
PID 2648 wrote to memory of 2700	2648	Unicorn-63962.exe	42
PID 2648 wrote to memory of 2700	2648	Unicorn-63962.exe	42
PID 1344 wrote to memory of 2668	1344	1775c1d0968d72634fbbc763aee00e21e7b23079712d552562cc10d8e151f018N.exe	43
PID 1344 wrote to memory of 2668	1344	1775c1d0968d72634fbbc763aee00e21e7b23079712d552562cc10d8e151f018N.exe	43
PID 1344 wrote to memory of 2668	1344	1775c1d0968d72634fbbc763aee00e21e7b23079712d552562cc10d8e151f018N.exe	43
PID 1344 wrote to memory of 2668	1344	1775c1d0968d72634fbbc763aee00e21e7b23079712d552562cc10d8e151f018N.exe	43
PID 2900 wrote to memory of 2968	2900	Unicorn-61924.exe	45
PID 2900 wrote to memory of 2968	2900	Unicorn-61924.exe	45
PID 2900 wrote to memory of 2968	2900	Unicorn-61924.exe	45
PID 2900 wrote to memory of 2968	2900	Unicorn-61924.exe	45
PID 2792 wrote to memory of 2832	2792	Unicorn-4067.exe	44
PID 2792 wrote to memory of 2832	2792	Unicorn-4067.exe	44
PID 2792 wrote to memory of 2832	2792	Unicorn-4067.exe	44
PID 2792 wrote to memory of 2832	2792	Unicorn-4067.exe	44
PID 2036 wrote to memory of 1448	2036	Unicorn-38619.exe	46
PID 2036 wrote to memory of 1448	2036	Unicorn-38619.exe	46
PID 2036 wrote to memory of 1448	2036	Unicorn-38619.exe	46
PID 2036 wrote to memory of 1448	2036	Unicorn-38619.exe	46

C:\Users\Admin\AppData\Local\Temp\1775c1d0968d72634fbbc763aee00e21e7b23079712d552562cc10d8e151f018N.exe
"C:\Users\Admin\AppData\Local\Temp\1775c1d0968d72634fbbc763aee00e21e7b23079712d552562cc10d8e151f018N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3538.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3538.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15765.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15765.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25360.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38619.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60466.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33352.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34011.exe
        8⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50913.exe
        9⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16613.exe
        9⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11576.exe
        9⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21546.exe
        9⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31047.exe
        8⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23737.exe
        8⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34663.exe
        8⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27518.exe
        8⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51094.exe
        7⤵
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50913.exe
        8⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10002.exe
        8⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28797.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36184.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44783.exe
        7⤵
        
        PID:564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29603.exe
        7⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25997.exe
        7⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10983.exe
        7⤵
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29630.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58899.exe
        7⤵
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27161.exe
        8⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33295.exe
        9⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49661.exe
        9⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56541.exe
        9⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57942.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53215.exe
        9⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8961.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55526.exe
        8⤵
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47876.exe
        8⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30256.exe
        8⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35828.exe
        8⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7295.exe
        7⤵
        
        PID:300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44144.exe
        8⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22130.exe
        8⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57044.exe
        8⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46293.exe
        7⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19955.exe
        7⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42334.exe
        7⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23235.exe
        7⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23796.exe
        6⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50913.exe
        7⤵
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10002.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28797.exe
        7⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36184.exe
        7⤵
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50648.exe
        6⤵
        
        PID:2948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20937.exe
        6⤵
        
        PID:3288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50495.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44001.exe
        6⤵
        
        PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35447.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4763.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5998.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1324
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1324 -s 240
        8⤵
        Program crash
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45718.exe
        7⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55526.exe
        7⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47876.exe
        7⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30256.exe
        7⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23191.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18613.exe
        6⤵
        Executes dropped EXE
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46829.exe
        7⤵
        
        PID:1368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44324.exe
        7⤵
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10158.exe
        7⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43471.exe
        7⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44783.exe
        6⤵
        
        PID:624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29603.exe
        6⤵
        
        PID:3332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25997.exe
        6⤵
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9470.exe
        6⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31684.exe
        6⤵
        
        PID:6784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27221.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9890.exe
        6⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1281.exe
        7⤵
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10002.exe
        7⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28797.exe
        7⤵
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8940.exe
        7⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36149.exe
        7⤵
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31047.exe
        6⤵
        
        PID:332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7948.exe
        6⤵
        
        PID:3664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60578.exe
        6⤵
        
        PID:5108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16.exe
        6⤵
        
        PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58634.exe
        5⤵
        
        PID:768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17290.exe
        6⤵
        
        PID:3212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49887.exe
        6⤵
        
        PID:3148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22603.exe
        6⤵
        
        PID:4952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46792.exe
        6⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53215.exe
        6⤵
        
        PID:6908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41983.exe
        5⤵
        
        PID:1108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4402.exe
        5⤵
        
        PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26528.exe
        5⤵
        
        PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6518.exe
        5⤵
        
        PID:5728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16013.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27685.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53388.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9506.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29019.exe
        8⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49661.exe
        8⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3408.exe
        8⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37900.exe
        8⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41825.exe
        7⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55526.exe
        7⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47876.exe
        7⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30256.exe
        7⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31684.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7129.exe
        6⤵
        
        PID:876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39097.exe
        7⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31216.exe
        7⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57786.exe
        7⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40150.exe
        7⤵
        
        PID:6484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11809.exe
        6⤵
        
        PID:1912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31632.exe
        6⤵
        
        PID:3744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13937.exe
        6⤵
        
        PID:4944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30256.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23191.exe
        6⤵
        
        PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45775.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13590.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19559.exe
        7⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45472.exe
        7⤵
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28797.exe
        7⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36184.exe
        7⤵
        
        PID:5700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7887.exe
        6⤵
        
        PID:2848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23737.exe
        6⤵
        
        PID:3556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34663.exe
        6⤵
        
        PID:5044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57942.exe
        6⤵
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53215.exe
        6⤵
        
        PID:6900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-636.exe
        5⤵
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21702.exe
        6⤵
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16613.exe
        6⤵
        
        PID:3716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33065.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37708.exe
        6⤵
        
        PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21436.exe
        5⤵
        
        PID:992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24988.exe
        5⤵
        
        PID:3932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14467.exe
        5⤵
        
        PID:4904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25791.exe
        5⤵
        
        PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44649.exe
        5⤵
        
        PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13002.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8271.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38178.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39097.exe
        7⤵
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31216.exe
        7⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9654.exe
        7⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28265.exe
        7⤵
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        6⤵
        
        PID:2604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25766.exe
        6⤵
        
        PID:3816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22603.exe
        6⤵
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46792.exe
        6⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6126.exe
        6⤵
        
        PID:6308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22396.exe
        5⤵
        
        PID:2612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34063.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49661.exe
        6⤵
        
        PID:3480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56541.exe
        6⤵
        
        PID:4728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46792.exe
        6⤵
        
        PID:6044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6126.exe
        6⤵
        
        PID:6316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44269.exe
        5⤵
        
        PID:2040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59610.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47876.exe
        5⤵
        
        PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30256.exe
        5⤵
        
        PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31684.exe
        5⤵
        
        PID:6824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37939.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38178.exe
        5⤵
        
        PID:2724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4981.exe
        6⤵
        
        PID:1340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16613.exe
        6⤵
        
        PID:3792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21005.exe
        6⤵
        
        PID:4416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37708.exe
        6⤵
        
        PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3641.exe
        5⤵
        
        PID:1736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51349.exe
        6⤵
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31216.exe
        6⤵
        
        PID:4320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57786.exe
        6⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28265.exe
        6⤵
        
        PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38832.exe
        5⤵
        
        PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31340.exe
        5⤵
        
        PID:4692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14297.exe
        5⤵
        
        PID:5264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29055.exe
      4⤵
      PID:1384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35537.exe
        5⤵
        
        PID:2004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47444.exe
        5⤵
        
        PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16737.exe
        5⤵
        
        PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8940.exe
        5⤵
        
        PID:6140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36149.exe
        5⤵
        
        PID:6804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11690.exe
      4⤵
      PID:3200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47617.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4997.exe
      4⤵
      PID:5060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20456.exe
      4⤵
      PID:5872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3925.exe
      4⤵
      PID:6160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42058.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42058.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60575.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60165.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-871.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5121.exe
        7⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21702.exe
        8⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10002.exe
        8⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16737.exe
        8⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55457.exe
        8⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36149.exe
        8⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34700.exe
        7⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23737.exe
        7⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50999.exe
        7⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39771.exe
        7⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39884.exe
        6⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20740.exe
        7⤵
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48301.exe
        7⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16800.exe
        7⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31025.exe
        6⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18747.exe
        6⤵
        
        PID:3904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16530.exe
        6⤵
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65361.exe
        6⤵
        
        PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28945.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64649.exe
        6⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29131.exe
        7⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22130.exe
        7⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57044.exe
        7⤵
        
        PID:5196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41685.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17598.exe
        6⤵
        
        PID:3768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50999.exe
        6⤵
        
        PID:4464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39771.exe
        6⤵
        
        PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58519.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31762.exe
        6⤵
        
        PID:4084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22130.exe
        6⤵
        
        PID:4276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57044.exe
        6⤵
        
        PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61286.exe
        5⤵
        
        PID:3648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14798.exe
        5⤵
        
        PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9462.exe
        5⤵
        
        PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28049.exe
        5⤵
        
        PID:5668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53896.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48811.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18526.exe
        6⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44229.exe
        7⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27978.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35866.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62909.exe
        8⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20881.exe
        7⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2331.exe
        7⤵
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22603.exe
        7⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57942.exe
        7⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53215.exe
        7⤵
        
        PID:6892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16003.exe
        6⤵
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe
        7⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41749.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32966.exe
        6⤵
        
        PID:3088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50817.exe
        6⤵
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54986.exe
        6⤵
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40680.exe
        6⤵
        
        PID:6468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55837.exe
        5⤵
        
        PID:1776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49465.exe
        6⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12986.exe
        7⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22130.exe
        7⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57044.exe
        7⤵
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19231.exe
        6⤵
        
        PID:3952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44952.exe
        6⤵
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63651.exe
        6⤵
        
        PID:4244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23614.exe
        6⤵
        
        PID:6508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29629.exe
        5⤵
        
        PID:1752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35489.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38832.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42152.exe
        5⤵
        
        PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38450.exe
        5⤵
        
        PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20129.exe
        5⤵
        
        PID:5716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60553.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36336.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19231.exe
        5⤵
        
        PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44952.exe
        5⤵
        
        PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15519.exe
        5⤵
        
        PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40705.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60466.exe
      4⤵
      PID:1192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30166.exe
      4⤵
      PID:3980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25616.exe
      4⤵
      PID:4360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55516.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64136.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1160.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1160.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61509.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5230.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16470.exe
        6⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62811.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32966.exe
        6⤵
        
        PID:3080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50817.exe
        6⤵
        
        PID:4236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50902.exe
        6⤵
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40680.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32531.exe
        5⤵
        
        PID:1732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31762.exe
        6⤵
        
        PID:3900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-641.exe
        6⤵
        
        PID:3356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57044.exe
        6⤵
        
        PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55421.exe
        5⤵
        
        PID:3696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23464.exe
        5⤵
        
        PID:3772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12638.exe
        5⤵
        
        PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54774.exe
        5⤵
        
        PID:5224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13761.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56434.exe
        5⤵
        
        PID:900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48809.exe
        6⤵
        
        PID:3272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3002.exe
        6⤵
        
        PID:4868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49592.exe
        6⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14113.exe
        6⤵
        
        PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53170.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25190.exe
        5⤵
        
        PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30579.exe
        5⤵
        
        PID:4996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46792.exe
        5⤵
        
        PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6126.exe
        5⤵
        
        PID:6292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25223.exe
      4⤵
      PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63090.exe
        5⤵
        
        PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31973.exe
        5⤵
        
        PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62909.exe
        5⤵
        
        PID:5840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52158.exe
      4⤵
      PID:3424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43244.exe
      4⤵
      PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33596.exe
      4⤵
      PID:4820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33243.exe
      4⤵
      PID:5820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20019.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20019.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37711.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29211.exe
        5⤵
        
        PID:2376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39097.exe
        6⤵
        
        PID:4044
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 236
        6⤵
        Program crash
        
        PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19231.exe
        5⤵
        
        PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44952.exe
        5⤵
        
        PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63651.exe
        5⤵
        
        PID:3636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19599.exe
        5⤵
        
        PID:5636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54270.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55526.exe
      4⤵
      PID:3400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52410.exe
      4⤵
      PID:4976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54966.exe
      4⤵
      PID:5584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8360.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8360.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33871.exe
      4⤵
      PID:2924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52262.exe
      4⤵
      PID:3220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12073.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54436.exe
      4⤵
      PID:5532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16381.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16381.exe
    3⤵
    PID:1564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47391.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47391.exe
    3⤵
    PID:3524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26875.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26875.exe
    3⤵
    PID:4624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20456.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20456.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2813.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2813.exe
    3⤵
    PID:6832
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4067.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4067.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61924.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61924.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52023.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35661.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21484.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30586.exe
        7⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60456.exe
        8⤵
        
        PID:1352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47844.exe
        9⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4859.exe
        9⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37658.exe
        9⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19231.exe
        8⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56541.exe
        8⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46792.exe
        8⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6126.exe
        8⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56735.exe
        7⤵
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35686.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3065.exe
        8⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32966.exe
        7⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50817.exe
        7⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6854.exe
        7⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24169.exe
        7⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43392.exe
        6⤵
        
        PID:316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39097.exe
        7⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31216.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57786.exe
        7⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40150.exe
        7⤵
        
        PID:6440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35110.exe
        6⤵
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55752.exe
        6⤵
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1493.exe
        6⤵
        
        PID:928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26935.exe
        6⤵
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9869.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62843.exe
        6⤵
        
        PID:696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3170.exe
        6⤵
        
        PID:3136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61288.exe
        6⤵
        
        PID:4456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63651.exe
        6⤵
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23614.exe
        6⤵
        
        PID:6456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7320.exe
        5⤵
        
        PID:3064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6325.exe
        5⤵
        
        PID:3232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52410.exe
        5⤵
        
        PID:4988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54966.exe
        5⤵
        
        PID:5580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32131.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48811.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36122.exe
        6⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31213.exe
        7⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32966.exe
        6⤵
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50817.exe
        6⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54986.exe
        6⤵
        
        PID:5132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3064.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
        5⤵
        
        PID:1544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38832.exe
        5⤵
        
        PID:3992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42152.exe
        5⤵
        
        PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38450.exe
        5⤵
        
        PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19149.exe
        5⤵
        
        PID:6412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60553.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46211.exe
        5⤵
        
        PID:1972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32966.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50817.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54986.exe
        5⤵
        
        PID:5124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40680.exe
        5⤵
        
        PID:6428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64384.exe
      4⤵
      PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51082.exe
        5⤵
        
        PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44051.exe
        5⤵
        
        PID:5168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22399.exe
        5⤵
        
        PID:5764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52621.exe
      4⤵
      PID:3640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63800.exe
      4⤵
      PID:3736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18359.exe
      4⤵
      PID:4756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22470.exe
      4⤵
      PID:5208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32157.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32157.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16393.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9231.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34670.exe
        6⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21702.exe
        7⤵
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10002.exe
        7⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16737.exe
        7⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55457.exe
        7⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36149.exe
        7⤵
        
        PID:6852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15893.exe
        6⤵
        
        PID:1040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31632.exe
        6⤵
        
        PID:3788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13937.exe
        6⤵
        
        PID:4896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30256.exe
        6⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5978.exe
        6⤵
        
        PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24316.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39546.exe
        6⤵
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38850.exe
        6⤵
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1019.exe
        6⤵
        
        PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1368.exe
        5⤵
        
        PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31056.exe
        5⤵
        
        PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27286.exe
        5⤵
        
        PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58536.exe
        5⤵
        
        PID:5468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62879.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10741.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54730.exe
        6⤵
        
        PID:3688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15062.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49592.exe
        6⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34726.exe
        6⤵
        
        PID:6180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32557.exe
        5⤵
        
        PID:3448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14090.exe
        5⤵
        
        PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10158.exe
        5⤵
        
        PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43471.exe
        5⤵
        
        PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21030.exe
      4⤵
      PID:1520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26848.exe
        5⤵
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
        5⤵
        
        PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7288.exe
        5⤵
        
        PID:5444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52158.exe
      4⤵
      PID:3432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11290.exe
      4⤵
      PID:3936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50495.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44001.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47211.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47211.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17291.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21702.exe
        5⤵
        
        PID:2708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10002.exe
        5⤵
        
        PID:3592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28797.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36184.exe
        5⤵
        
        PID:5368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1836.exe
      4⤵
      PID:3008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50189.exe
      4⤵
      PID:3284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1493.exe
      4⤵
      PID:1704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26935.exe
      4⤵
      PID:5272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4581.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4581.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60518.exe
      4⤵
      PID:1112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41767.exe
        5⤵
        
        PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22130.exe
        5⤵
        
        PID:4764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57044.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20113.exe
      4⤵
      PID:3376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59207.exe
      4⤵
      PID:3720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22603.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57942.exe
      4⤵
      PID:6092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55288.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55288.exe
    3⤵
    PID:904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26848.exe
      4⤵
      PID:3488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22130.exe
      4⤵
      PID:2396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57044.exe
      4⤵
      PID:5256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26957.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26957.exe
    3⤵
    PID:3460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11820.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11820.exe
    3⤵
    PID:3880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4997.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4997.exe
    3⤵
    PID:4116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1183.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1183.exe
    3⤵
    PID:5684
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5684 -s 188
      4⤵
      Program crash
      PID:5464
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63962.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63962.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11374.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11374.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45173.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8930.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5282.exe
        6⤵
        
        PID:1956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52262.exe
        6⤵
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50676.exe
        6⤵
        
        PID:4632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55457.exe
        6⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5448.exe
        6⤵
        
        PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9537.exe
        5⤵
        
        PID:664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23737.exe
        5⤵
        
        PID:3624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22603.exe
        5⤵
        
        PID:4848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57942.exe
        5⤵
        
        PID:6116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21545.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50399.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52262.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50676.exe
        5⤵
        
        PID:4668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55457.exe
        5⤵
        
        PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22661.exe
        5⤵
        
        PID:6336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64497.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34756.exe
      4⤵
      PID:3112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25997.exe
      4⤵
      PID:5084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30256.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
      4⤵
      PID:6196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57788.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57788.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17291.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31047.exe
        5⤵
        
        PID:1976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23737.exe
        5⤵
        
        PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34663.exe
        5⤵
        
        PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27518.exe
        5⤵
        
        PID:5708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54545.exe
      4⤵
      PID:2936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23737.exe
      4⤵
      PID:3548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34663.exe
      4⤵
      PID:4204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55389.exe
      4⤵
      PID:5448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64253.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64253.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50399.exe
      4⤵
      PID:684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52262.exe
      4⤵
      PID:3224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50676.exe
      4⤵
      PID:4648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55457.exe
      4⤵
      PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35297.exe
      4⤵
      PID:5428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49942.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49942.exe
    3⤵
    PID:2600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46861.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46861.exe
    3⤵
    PID:3372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3938.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3938.exe
    3⤵
    PID:4912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60217.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60217.exe
    3⤵
    PID:5496
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51758.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51758.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50072.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13289.exe
        5⤵
        
        PID:2644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3471.exe
        6⤵
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26636.exe
        7⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19231.exe
        6⤵
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56541.exe
        6⤵
        
        PID:4708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57942.exe
        6⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53215.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7726.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5581.exe
        6⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35856.exe
        6⤵
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25461.exe
        6⤵
        
        PID:6252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32966.exe
        5⤵
        
        PID:1684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50817.exe
        5⤵
        
        PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54986.exe
        5⤵
        
        PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40680.exe
        5⤵
        
        PID:6492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38540.exe
      4⤵
      PID:752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39097.exe
        5⤵
        
        PID:4060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31216.exe
        5⤵
        
        PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57786.exe
        5⤵
        
        PID:5104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40150.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31025.exe
      4⤵
      PID:3176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18747.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52410.exe
      4⤵
      PID:4836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16.exe
      4⤵
      PID:5552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46543.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46543.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15916.exe
      4⤵
      PID:112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55411.exe
        5⤵
        
        PID:5652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49661.exe
      4⤵
      PID:3508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56541.exe
      4⤵
      PID:4736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46792.exe
      4⤵
      PID:6052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53215.exe
      4⤵
      PID:6916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23080.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23080.exe
    3⤵
    PID:2548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38832.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38832.exe
    3⤵
    PID:3968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3938.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3938.exe
    3⤵
    PID:5012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33435.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33435.exe
    3⤵
    PID:5524
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23990.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23990.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1748
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24689.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24689.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33570.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33570.exe
    3⤵
    PID:1968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16613.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16613.exe
    3⤵
    PID:4080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33065.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33065.exe
    3⤵
    PID:320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37708.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37708.exe
    3⤵
    PID:5216
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13301.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13301.exe
  2⤵
  PID:2524
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65474.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65474.exe
  2⤵
  PID:3260
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65199.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65199.exe
  2⤵
  PID:5052
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24656.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24656.exe
  2⤵
  PID:5784
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21114.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21114.exe
  2⤵
  PID:6108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1160.exe

Filesize
468KB

MD5
b85483a6c3da5b4a79bcb8cafb477157

SHA1
bc57e7de0a378138e0ea1a1007832ee7d1c15b7d

SHA256
03209161558d0647364a7ff6494baffe9c2deb52e9b60d7dbd386ba019081617

SHA512
579bf6b66cabb275b4f1afb967f383916f9e79cf5266dbadb70313ab8ae494569e2064bdc9fac64b7c1d12c9433d4e9df05b0c11e0f92c61f317e5527b35ad7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21005.exe

Filesize
468KB

MD5
4f455e9b68ec445e88a40246b8eb10f9

SHA1
dcad6571c7c9a6d3829ff94d9355c783cba1cb04

SHA256
91b27e35d9183eb519622042fc030768442ac3cbb64896a7559edb8fd45a7a8d

SHA512
5ce37efea73fbc9c58ef8adbb6fc918e4d6e8b595fe6ce10c0468d3ada5477b66d93645f14cd404e5816569447b8661c35d2c8e0c8dc6c37fa369e1e6460fb52

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27685.exe

Filesize
468KB

MD5
eef09874ecec66a8d008bde44e87b180

SHA1
61daf70871e5975e60b4c1bea1a7bbe4b83efb54

SHA256
59a2863d7208ee1bdb436fd1e9f26c48e3d410381e9d5d4a4f0596ee75a6158f

SHA512
a2c4124739df1ef50294ebf5c4530642eb5b3d7923a36d6a101e123d28327698c42879ac6a5b561c843a1f6ee1f2abef0758932a5c2578c0c6ce9550e1844316

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2813.exe

Filesize
468KB

MD5
9c853b6b008a13967f7403cc561052f4

SHA1
c2efdbd0d0d6cce3398d6c96b41b2687286b6217

SHA256
aa904db60541da426b3dcff7a8bf0595d95c9daf315c96b8ef74fa6a8f124f84

SHA512
6439c84b8f6b5b44e240f45e5b095b91762e87f7506f795ec1b9a5a4e18ea769db18387bf619ff50a0b5ebdb3233ea5610c139e03f94132447dcd539a003b123

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51758.exe

Filesize
468KB

MD5
ebcf82a0cdfcb0d95298ff5f59c26f5a

SHA1
0ebaf6864beeddd3d09bce5224886f92490e719e

SHA256
98f7ee0e1112ab4ca10a0ae3f2e78289e37f0b2929b52cad83edbb532e0c38e8

SHA512
c8e1c78c84efbc6d50207b870ed58ff7f44f4660d718112a604e7b13b179a0284abc1edf9d115535cc344c3ed3434a1380d274a8ccd3c85cde2804aec5e78614

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52023.exe

Filesize
468KB

MD5
413f0655ca535fba454ce2ec7f52e36b

SHA1
8b7f1098800c506a035aa06365d4aa12483c7ac0

SHA256
2ca71f63e5cd2140fd3c1ee68c44da851ad7b4c6684c89d69b1d6e9027223f22

SHA512
7022bb6e0c7813cc7dffb0b7a689115a80030692d865af55ff538a933c380e0d41234189faf68dd4cd1b7576f3e4dc082dc63aa9897f173848d7b6b9a39aa87d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61924.exe

Filesize
468KB

MD5
5ef4f0ad5d6e42702bf20dca9e14d97a

SHA1
f05c0370fc4807ffd209765ad5663efdf914eb67

SHA256
8ff1f747ac84e75f550e512c52625745bce54a3f1598962f5c3f5d4bd702beec

SHA512
e8c51e6240ffc3121516a684490d2062925524f22eddf54681d2efdb9c31f9d25e489e1c4a0a57e4cf97927dea33865cba52c94b482f3f76a2afdb2e82fcdd9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63962.exe

Filesize
468KB

MD5
eabe18650f334b2c5489ad014f6eb8ab

SHA1
9922e64fdcd89bbf1ed971a8629f0b1aa07087da

SHA256
09140c1ed7df438a6613165634fbc091c18d4e3505e524371b5b850140add0b2

SHA512
7c7e4fef0f268c372ccc409aec4d668691b576a416fa78c950eef6cbf1b0f6c84db6ab68b9c1dac888d3b00a5fe332de2c8b5de8986632833badf717ecbc9bbd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-11374.exe

Filesize
468KB

MD5
738627d2a50289394bc7c1de87d9b459

SHA1
2866a5a65e0f42c7663526b30239740e6f157212

SHA256
e0d280865311ffd1585b4c27f7b876fa0ea658a1ed20fd780cf683140532eed2

SHA512
ad62617cb2e8fc3c7cd03385bea1372c721caac0cd5fa275d1160780b4d0ade961a29d463459be1ce8dfe680f54e25279070677de546e63db7298aa06afaf3b9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13002.exe

Filesize
468KB

MD5
5d288ff3effdab67838f9dc225e25b94

SHA1
9a5094a8a1e7730ef4565b2616f16cfdcd556488

SHA256
7ae7e405e584ba768ce4545b3ffb9d667f96bb1c297071c8ba0ec8de960bc453

SHA512
fd08d8df716b78a19433814bc3cf637e595f6e9b27456327cd7700d32cbaf6b013ac0de12b486f499212ce44b4596c4707d80afb267fd6439a71893b1cee23f2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15765.exe

Filesize
468KB

MD5
d257e40a4f5c6079bbbb47ebd8d8ab4f

SHA1
5a646b4ffb78617ce6b002df42149d741f9afe9e

SHA256
8d1887fe06bfbef198ef1f78c4c69b0c1ce59832e08619b167f86176b2ce23db

SHA512
7803124912cfa91d6bb825362edfc9fc27ba1a9fec6f9a4399d556243ab8c3464580a5fb54f268dc0ee56b235bd8b523c9d8540c1090043973642465c888805d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16013.exe

Filesize
468KB

MD5
9564a2de2e8b344585bf7328ebfee549

SHA1
92dc22d7bcf6f0ace5d3f8dce9cd6d554420d912

SHA256
017a690cee3bfeeeeecda5fdf5e2ea54321ddf87c7e9d36b57613b6dec67e9a8

SHA512
636bc303d7fdc27e69f5b481d68f27c7de21bf8ec2b5892d371473f1f3789ba831f4257684608e9bdcf7c9ca715a4a018ee7a875a852ab866fc1a21230eb7d06

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25360.exe

Filesize
468KB

MD5
2cf0b466958483eac4db5e43ca8664cf

SHA1
db828d2df0ca68226b15284e27cd099e9f7b7e7a

SHA256
bccfc89a08a58604d23af5e6ef08e0c99c39a9c9901f6aa4a3131782e3f053c5

SHA512
3e653dfdcb6a59cb5dd2266da7303d362ef31a092d148d9acdffdba2b5c2851df75c9fe4d1840c48282a2824951aadbe35c40e1d1bc657fa8cd639c1159a867e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32157.exe

Filesize
468KB

MD5
e8881d50060f823a25b5a8d30ed2b0be

SHA1
92776662bc27fc7f3b047a9ce6b94c220ceb9a54

SHA256
74f276f9159c023bb5af13642db9b04a92e0e4110f15bb5ef827769eec6c1720

SHA512
9a0a1597a8413944dfa00d6e82673928aa650cf444595c85a8a30e6f77b040a69a037b63e0e6d4d86c14a835e281edb2dec75996412557bdd52bac7a66253f3a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3538.exe

Filesize
468KB

MD5
9b5d1cf224b5e154fbccb72f5bd0c126

SHA1
ba5b6e0ec886203ed481865acba7567a95b9cdc0

SHA256
b3e55db078fb4f8ce6705752be408d7f04698b92ff73909a577361d7b6c651c8

SHA512
3983f5f8ea0aad1de1b5220da64ec7476b8ea35331fda6769f14c2eb2fa211fd671d2a22290a4eb893d151c1bd7a49703bc42c5d19e40e1f54ed645f41c50d10

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-35447.exe

Filesize
468KB

MD5
425ee32443c99e088195c0f1446105fc

SHA1
033b6bb7e3ba139aece06645b4e2af78d8cce0c7

SHA256
aa4b2ac4f3445d65458507e62d6a81b723e5dba18b6ae96f1fd9a0516861ec70

SHA512
513f1b21f2f4230da935388c6c845dac1750b148030da22c23b810673b99795bbb8ea99c539423e03c4c8b0017b9bb613c5632fbff080b3bc1b9ae4a0aa7eca5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38619.exe

Filesize
468KB

MD5
b59108a18dfd511475fcb288a0cd0c75

SHA1
04d8bf186c219876d0c1a202cf2c9a27db5612c7

SHA256
a786b31cd43580fc14460fdaa25a572096bc1a8b565a0fea486a09ce0368565b

SHA512
99b5a6bda8b207f773fa339ba1324de5fd5f21898fa63a2141daeac450a8b1231854db4bde2316a9e2927c17514701c83dd4ee4258150e9a1bcefd71cee64e56

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4067.exe

Filesize
468KB

MD5
597e114b5bff304329de9fecd130acdd

SHA1
94a2d7bd7e63dd95b1317481587d3b0e09463fb8

SHA256
70a94ced497cbf3a746c30ff900bef0d5caf508fd70659b760694e439cf2651d

SHA512
fd733d54f5df80d6c02dd2947fe8c94bbcf84af4257343a29bab5d3c66b4175b531a5099b83301a2cc669793749bec646d443818352052d77308daba39a6569b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42058.exe

Filesize
468KB

MD5
a800d3c0f75ea779929ada0ff10ffc3f

SHA1
071e4ec2c083b4ce2bcc808e21fa5d7a9a09b856

SHA256
ee3d966b5b9efafbb7cdc2e9699beb877b475f61f582050b12d446b403abbb43

SHA512
2e48a3e465705ec3315affe52940005edd3842c704b63d3022ae73c62f39f1c7c1f18c13a1eed101314ff0b040d53378e1fc7cf7d52fc9a892fb755374f5ca94

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60466.exe

Filesize
468KB

MD5
1a85758df4daf9b7bee6608a957daee3

SHA1
9228f3eacba4fd25f72a637b4743c11bd63ac511

SHA256
908edc90494fdad4ab4e1cdd29301226ddfb88a4a5c766fb40a1962d03108eb9

SHA512
283d50ccddf8a881db78ece47d2998c595e122eb68aee71d1c7b4faed79839d0a0aa50db751f37c41542ff77f4d12db4dfde19988471159eb043b83007ce2a5e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60575.exe

Filesize
468KB

MD5
e6f9add63831cda6d0eea896eced523a

SHA1
db5dee53bfaa14d233698fe0bef2bc5995d0f73e

SHA256
5ecd66a60a60380bc6631c5b3a68742abca01b465122ac73414d120f09596eda

SHA512
ef7dbfac994698c694b48cb4173e2b094ef5991b5457fddd57922e202e86d7cadca77e099f0f3a8020cbd0c9457c0fd4db9a48e85bcd97fa18a0360d9a58c1bf

Download Submit