75da613cc2edb1a220258ff4ba8779184355f6b9013eb8ab186df10c32c76c43

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 02:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75da613cc2edb1a220258ff4ba8779184355f6b9013eb8ab186df10c32c76c43N.exe
Size

468KB
MD5

cf442635d23994295cef284714421260
SHA1

4d90427d757e1148cdad2afc73e8df3978e21acc
SHA256

75da613cc2edb1a220258ff4ba8779184355f6b9013eb8ab186df10c32c76c43
SHA512

4c52c6c20250350144082b240cee94793a0826aa2e322b8b14f752a90f791f610575b50a031bf232d7a87a3cb8c55a8f76438df3a41bda3aac0cdd8ac932f373
SSDEEP

3072:/rYCogKxjT880bYbPz3yqfL/EpTZsPpKPmHxqlOPJytufth1ePlV:/r9otg804PDyqfxBr5JywFh1e

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1268	Unicorn-32034.exe
2216	Unicorn-25392.exe
2164	Unicorn-43351.exe
2824	Unicorn-17756.exe
1616	Unicorn-17564.exe
2648	Unicorn-11433.exe
2656	Unicorn-14034.exe
1484	Unicorn-64341.exe
320	Unicorn-63116.exe
2920	Unicorn-33781.exe
2364	Unicorn-33817.exe
1492	Unicorn-34082.exe
776	Unicorn-27951.exe
1052	Unicorn-14216.exe
2128	Unicorn-25006.exe
2148	Unicorn-44933.exe
704	Unicorn-64414.exe
1056	Unicorn-41372.exe
1592	Unicorn-10034.exe
3028	Unicorn-53018.exe
2292	Unicorn-5353.exe
1756	Unicorn-18976.exe
2064	Unicorn-28976.exe
856	Unicorn-27907.exe
1008	Unicorn-61840.exe
2540	Unicorn-61072.exe
2680	Unicorn-54942.exe
2440	Unicorn-60807.exe
2340	Unicorn-41206.exe
2708	Unicorn-766.exe
2640	Unicorn-29717.exe
2832	Unicorn-19708.exe
2620	Unicorn-19708.exe
2672	Unicorn-13193.exe
2252	Unicorn-4056.exe
112	Unicorn-64995.exe
2660	Unicorn-9074.exe
2856	Unicorn-9339.exe
1328	Unicorn-55312.exe
2092	Unicorn-27897.exe
1796	Unicorn-58109.exe
1028	Unicorn-28774.exe
2400	Unicorn-22259.exe
2144	Unicorn-28198.exe
956	Unicorn-11020.exe
920	Unicorn-30886.exe
1692	Unicorn-47337.exe
896	Unicorn-13973.exe
1732	Unicorn-35825.exe
3036	Unicorn-55691.exe
1488	Unicorn-5457.exe
1244	Unicorn-10055.exe
888	Unicorn-35721.exe
1724	Unicorn-10055.exe
2792	Unicorn-16302.exe
2796	Unicorn-35638.exe
2808	Unicorn-41768.exe
2764	Unicorn-8638.exe
2664	Unicorn-47736.exe
2984	Unicorn-27294.exe
2916	Unicorn-34581.exe
2012	Unicorn-60931.exe
1324	Unicorn-49765.exe
2548	Unicorn-49417.exe

Loads dropped DLL 64 IoCs

pid	Process
2684	75da613cc2edb1a220258ff4ba8779184355f6b9013eb8ab186df10c32c76c43N.exe
2684	75da613cc2edb1a220258ff4ba8779184355f6b9013eb8ab186df10c32c76c43N.exe
2684	75da613cc2edb1a220258ff4ba8779184355f6b9013eb8ab186df10c32c76c43N.exe
1268	Unicorn-32034.exe
2684	75da613cc2edb1a220258ff4ba8779184355f6b9013eb8ab186df10c32c76c43N.exe
1268	Unicorn-32034.exe
2164	Unicorn-43351.exe
2164	Unicorn-43351.exe
2216	Unicorn-25392.exe
2216	Unicorn-25392.exe
2684	75da613cc2edb1a220258ff4ba8779184355f6b9013eb8ab186df10c32c76c43N.exe
1268	Unicorn-32034.exe
2684	75da613cc2edb1a220258ff4ba8779184355f6b9013eb8ab186df10c32c76c43N.exe
1268	Unicorn-32034.exe
1616	Unicorn-17564.exe
1616	Unicorn-17564.exe
2216	Unicorn-25392.exe
2216	Unicorn-25392.exe
2656	Unicorn-14034.exe
2656	Unicorn-14034.exe
1268	Unicorn-32034.exe
2684	75da613cc2edb1a220258ff4ba8779184355f6b9013eb8ab186df10c32c76c43N.exe
1268	Unicorn-32034.exe
2164	Unicorn-43351.exe
2684	75da613cc2edb1a220258ff4ba8779184355f6b9013eb8ab186df10c32c76c43N.exe
2164	Unicorn-43351.exe
2648	Unicorn-11433.exe
2648	Unicorn-11433.exe
1484	Unicorn-64341.exe
1484	Unicorn-64341.exe
1616	Unicorn-17564.exe
1616	Unicorn-17564.exe
320	Unicorn-63116.exe
320	Unicorn-63116.exe
2216	Unicorn-25392.exe
2216	Unicorn-25392.exe
2824	Unicorn-17756.exe
2920	Unicorn-33781.exe
2920	Unicorn-33781.exe
2824	Unicorn-17756.exe
2656	Unicorn-14034.exe
2656	Unicorn-14034.exe
2364	Unicorn-33817.exe
2364	Unicorn-33817.exe
1052	Unicorn-14216.exe
1052	Unicorn-14216.exe
2684	75da613cc2edb1a220258ff4ba8779184355f6b9013eb8ab186df10c32c76c43N.exe
2684	75da613cc2edb1a220258ff4ba8779184355f6b9013eb8ab186df10c32c76c43N.exe
1492	Unicorn-34082.exe
1492	Unicorn-34082.exe
776	Unicorn-27951.exe
776	Unicorn-27951.exe
2164	Unicorn-43351.exe
2164	Unicorn-43351.exe
1268	Unicorn-32034.exe
2648	Unicorn-11433.exe
1268	Unicorn-32034.exe
2648	Unicorn-11433.exe
704	Unicorn-64414.exe
704	Unicorn-64414.exe
320	Unicorn-63116.exe
320	Unicorn-63116.exe
2148	Unicorn-44933.exe
2128	Unicorn-25006.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2924	888	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58109.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44864.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26984.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25444.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64733.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61840.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39332.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51800.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4528.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9924.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62512.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-188.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51853.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27142.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43745.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-966.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9778.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9778.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38215.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61091.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9680.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10136.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4528.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9394.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62232.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10969.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22259.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29875.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16726.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60494.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2258.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34998.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63174.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60826.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3404.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9339.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43286.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24769.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45557.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10393.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5783.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19072.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48184.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58787.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16841.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29875.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10969.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10393.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9680.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57476.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56912.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60529.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58396.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47191.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27923.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19679.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43774.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29875.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2684	75da613cc2edb1a220258ff4ba8779184355f6b9013eb8ab186df10c32c76c43N.exe
1268	Unicorn-32034.exe
2216	Unicorn-25392.exe
2164	Unicorn-43351.exe
1616	Unicorn-17564.exe
2824	Unicorn-17756.exe
2656	Unicorn-14034.exe
2648	Unicorn-11433.exe
1484	Unicorn-64341.exe
320	Unicorn-63116.exe
2920	Unicorn-33781.exe
2364	Unicorn-33817.exe
1052	Unicorn-14216.exe
776	Unicorn-27951.exe
1492	Unicorn-34082.exe
704	Unicorn-64414.exe
2128	Unicorn-25006.exe
2148	Unicorn-44933.exe
3028	Unicorn-53018.exe
1592	Unicorn-10034.exe
1056	Unicorn-41372.exe
2292	Unicorn-5353.exe
2064	Unicorn-28976.exe
856	Unicorn-27907.exe
1756	Unicorn-18976.exe
1008	Unicorn-61840.exe
2440	Unicorn-60807.exe
2340	Unicorn-41206.exe
2680	Unicorn-54942.exe
2708	Unicorn-766.exe
2640	Unicorn-29717.exe
2620	Unicorn-19708.exe
2832	Unicorn-19708.exe
2672	Unicorn-13193.exe
2856	Unicorn-9339.exe
2252	Unicorn-4056.exe
112	Unicorn-64995.exe
2660	Unicorn-9074.exe
1328	Unicorn-55312.exe
2092	Unicorn-27897.exe
1028	Unicorn-28774.exe
1796	Unicorn-58109.exe
2400	Unicorn-22259.exe
2144	Unicorn-28198.exe
920	Unicorn-30886.exe
956	Unicorn-11020.exe
1700	Unicorn-63174.exe
1692	Unicorn-47337.exe
896	Unicorn-13973.exe
1732	Unicorn-35825.exe
3036	Unicorn-55691.exe
1488	Unicorn-5457.exe
1244	Unicorn-10055.exe
888	Unicorn-35721.exe
1724	Unicorn-10055.exe
2796	Unicorn-35638.exe
2792	Unicorn-16302.exe
2808	Unicorn-41768.exe
2764	Unicorn-8638.exe
2664	Unicorn-47736.exe
2012	Unicorn-60931.exe
2916	Unicorn-34581.exe
2984	Unicorn-27294.exe
1324	Unicorn-49765.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 1268	2684	75da613cc2edb1a220258ff4ba8779184355f6b9013eb8ab186df10c32c76c43N.exe	30
PID 2684 wrote to memory of 1268	2684	75da613cc2edb1a220258ff4ba8779184355f6b9013eb8ab186df10c32c76c43N.exe	30
PID 2684 wrote to memory of 1268	2684	75da613cc2edb1a220258ff4ba8779184355f6b9013eb8ab186df10c32c76c43N.exe	30
PID 2684 wrote to memory of 1268	2684	75da613cc2edb1a220258ff4ba8779184355f6b9013eb8ab186df10c32c76c43N.exe	30
PID 2684 wrote to memory of 2164	2684	75da613cc2edb1a220258ff4ba8779184355f6b9013eb8ab186df10c32c76c43N.exe	32
PID 2684 wrote to memory of 2164	2684	75da613cc2edb1a220258ff4ba8779184355f6b9013eb8ab186df10c32c76c43N.exe	32
PID 2684 wrote to memory of 2164	2684	75da613cc2edb1a220258ff4ba8779184355f6b9013eb8ab186df10c32c76c43N.exe	32
PID 2684 wrote to memory of 2164	2684	75da613cc2edb1a220258ff4ba8779184355f6b9013eb8ab186df10c32c76c43N.exe	32
PID 1268 wrote to memory of 2216	1268	Unicorn-32034.exe	31
PID 1268 wrote to memory of 2216	1268	Unicorn-32034.exe	31
PID 1268 wrote to memory of 2216	1268	Unicorn-32034.exe	31
PID 1268 wrote to memory of 2216	1268	Unicorn-32034.exe	31
PID 2164 wrote to memory of 2824	2164	Unicorn-43351.exe	33
PID 2164 wrote to memory of 2824	2164	Unicorn-43351.exe	33
PID 2164 wrote to memory of 2824	2164	Unicorn-43351.exe	33
PID 2164 wrote to memory of 2824	2164	Unicorn-43351.exe	33
PID 2216 wrote to memory of 1616	2216	Unicorn-25392.exe	34
PID 2216 wrote to memory of 1616	2216	Unicorn-25392.exe	34
PID 2216 wrote to memory of 1616	2216	Unicorn-25392.exe	34
PID 2216 wrote to memory of 1616	2216	Unicorn-25392.exe	34
PID 2684 wrote to memory of 2648	2684	75da613cc2edb1a220258ff4ba8779184355f6b9013eb8ab186df10c32c76c43N.exe	35
PID 2684 wrote to memory of 2648	2684	75da613cc2edb1a220258ff4ba8779184355f6b9013eb8ab186df10c32c76c43N.exe	35
PID 2684 wrote to memory of 2648	2684	75da613cc2edb1a220258ff4ba8779184355f6b9013eb8ab186df10c32c76c43N.exe	35
PID 2684 wrote to memory of 2648	2684	75da613cc2edb1a220258ff4ba8779184355f6b9013eb8ab186df10c32c76c43N.exe	35
PID 1268 wrote to memory of 2656	1268	Unicorn-32034.exe	36
PID 1268 wrote to memory of 2656	1268	Unicorn-32034.exe	36
PID 1268 wrote to memory of 2656	1268	Unicorn-32034.exe	36
PID 1268 wrote to memory of 2656	1268	Unicorn-32034.exe	36
PID 1616 wrote to memory of 1484	1616	Unicorn-17564.exe	38
PID 1616 wrote to memory of 1484	1616	Unicorn-17564.exe	38
PID 1616 wrote to memory of 1484	1616	Unicorn-17564.exe	38
PID 1616 wrote to memory of 1484	1616	Unicorn-17564.exe	38
PID 2216 wrote to memory of 320	2216	Unicorn-25392.exe	39
PID 2216 wrote to memory of 320	2216	Unicorn-25392.exe	39
PID 2216 wrote to memory of 320	2216	Unicorn-25392.exe	39
PID 2216 wrote to memory of 320	2216	Unicorn-25392.exe	39
PID 2656 wrote to memory of 2920	2656	Unicorn-14034.exe	40
PID 2656 wrote to memory of 2920	2656	Unicorn-14034.exe	40
PID 2656 wrote to memory of 2920	2656	Unicorn-14034.exe	40
PID 2656 wrote to memory of 2920	2656	Unicorn-14034.exe	40
PID 1268 wrote to memory of 776	1268	Unicorn-32034.exe	41
PID 1268 wrote to memory of 776	1268	Unicorn-32034.exe	41
PID 1268 wrote to memory of 776	1268	Unicorn-32034.exe	41
PID 1268 wrote to memory of 776	1268	Unicorn-32034.exe	41
PID 2684 wrote to memory of 2364	2684	75da613cc2edb1a220258ff4ba8779184355f6b9013eb8ab186df10c32c76c43N.exe	42
PID 2684 wrote to memory of 2364	2684	75da613cc2edb1a220258ff4ba8779184355f6b9013eb8ab186df10c32c76c43N.exe	42
PID 2684 wrote to memory of 2364	2684	75da613cc2edb1a220258ff4ba8779184355f6b9013eb8ab186df10c32c76c43N.exe	42
PID 2684 wrote to memory of 2364	2684	75da613cc2edb1a220258ff4ba8779184355f6b9013eb8ab186df10c32c76c43N.exe	42
PID 2164 wrote to memory of 1052	2164	Unicorn-43351.exe	43
PID 2164 wrote to memory of 1052	2164	Unicorn-43351.exe	43
PID 2164 wrote to memory of 1052	2164	Unicorn-43351.exe	43
PID 2164 wrote to memory of 1052	2164	Unicorn-43351.exe	43
PID 2648 wrote to memory of 1492	2648	Unicorn-11433.exe	44
PID 2648 wrote to memory of 1492	2648	Unicorn-11433.exe	44
PID 2648 wrote to memory of 1492	2648	Unicorn-11433.exe	44
PID 2648 wrote to memory of 1492	2648	Unicorn-11433.exe	44
PID 1484 wrote to memory of 2128	1484	Unicorn-64341.exe	45
PID 1484 wrote to memory of 2128	1484	Unicorn-64341.exe	45
PID 1484 wrote to memory of 2128	1484	Unicorn-64341.exe	45
PID 1484 wrote to memory of 2128	1484	Unicorn-64341.exe	45
PID 1616 wrote to memory of 2148	1616	Unicorn-17564.exe	46
PID 1616 wrote to memory of 2148	1616	Unicorn-17564.exe	46
PID 1616 wrote to memory of 2148	1616	Unicorn-17564.exe	46
PID 1616 wrote to memory of 2148	1616	Unicorn-17564.exe	46

C:\Users\Admin\AppData\Local\Temp\75da613cc2edb1a220258ff4ba8779184355f6b9013eb8ab186df10c32c76c43N.exe
"C:\Users\Admin\AppData\Local\Temp\75da613cc2edb1a220258ff4ba8779184355f6b9013eb8ab186df10c32c76c43N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32034.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32034.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25392.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25392.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17564.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64341.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25006.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19708.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49765.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41305.exe
        9⤵
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48366.exe
        9⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1975.exe
        9⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-966.exe
        9⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58787.exe
        9⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43286.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58899.exe
        8⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38100.exe
        8⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2874.exe
        8⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58396.exe
        8⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49417.exe
        7⤵
        Executes dropped EXE
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12767.exe
        8⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18325.exe
        9⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60285.exe
        8⤵
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48155.exe
        8⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9920.exe
        8⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9394.exe
        8⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41230.exe
        7⤵
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49741.exe
        8⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30875.exe
        8⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5783.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18443.exe
        8⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41458.exe
        7⤵
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45355.exe
        7⤵
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43541.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9924.exe
        7⤵
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64995.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61091.exe
        7⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13041.exe
        8⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60285.exe
        7⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48155.exe
        7⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52406.exe
        7⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
        7⤵
        
        PID:6004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54961.exe
        6⤵
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56932.exe
        7⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30566.exe
        7⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-706.exe
        7⤵
        
        PID:6456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14348.exe
        6⤵
        
        PID:3080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45355.exe
        6⤵
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26437.exe
        6⤵
        
        PID:4680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9924.exe
        6⤵
        
        PID:6436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44933.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19708.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36418.exe
        7⤵
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12103.exe
        8⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32252.exe
        8⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45311.exe
        8⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6629.exe
        8⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59133.exe
        8⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24142.exe
        7⤵
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38505.exe
        7⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10393.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35079.exe
        7⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58780.exe
        7⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48649.exe
        6⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49741.exe
        7⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47212.exe
        7⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54600.exe
        7⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35548.exe
        7⤵
        
        PID:6684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49476.exe
        6⤵
        
        PID:3388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32703.exe
        6⤵
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18928.exe
        6⤵
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9924.exe
        6⤵
        
        PID:6444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13193.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63911.exe
        6⤵
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47008.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45164.exe
        7⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16775.exe
        7⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-966.exe
        7⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9394.exe
        7⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27142.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58899.exe
        6⤵
        
        PID:3128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21763.exe
        6⤵
        
        PID:4456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57838.exe
        6⤵
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58396.exe
        6⤵
        
        PID:6172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46926.exe
        5⤵
        
        PID:2336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1854.exe
        6⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9680.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
        7⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23183.exe
        7⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59133.exe
        7⤵
        
        PID:6820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21911.exe
        6⤵
        
        PID:1576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38505.exe
        6⤵
        
        PID:592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10393.exe
        6⤵
        
        PID:4264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2874.exe
        6⤵
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42251.exe
        6⤵
        
        PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57693.exe
        5⤵
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16841.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25654.exe
        5⤵
        
        PID:3992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46264.exe
        5⤵
        
        PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        5⤵
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53179.exe
        5⤵
        
        PID:5576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63116.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64414.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-766.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47736.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61070.exe
        8⤵
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11143.exe
        9⤵
        
        PID:1120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34981.exe
        10⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23267.exe
        10⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61587.exe
        10⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        9⤵
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
        9⤵
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11539.exe
        9⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9394.exe
        9⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30494.exe
        8⤵
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38505.exe
        8⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10393.exe
        8⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52075.exe
        8⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42251.exe
        8⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56965.exe
        7⤵
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33188.exe
        8⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63612.exe
        8⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8483.exe
        7⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54020.exe
        7⤵
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11260.exe
        7⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53113.exe
        7⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27294.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59792.exe
        7⤵
        
        PID:636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
        7⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44269.exe
        7⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19679.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40878.exe
        6⤵
        
        PID:1640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60706.exe
        6⤵
        
        PID:3680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1728.exe
        6⤵
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24006.exe
        6⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9924.exe
        6⤵
        
        PID:6308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29717.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34581.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9680.exe
        7⤵
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32252.exe
        7⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
        7⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60740.exe
        7⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58787.exe
        7⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9140.exe
        6⤵
        
        PID:560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38505.exe
        6⤵
        
        PID:3216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36645.exe
        6⤵
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46319.exe
        6⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52446.exe
        6⤵
        
        PID:6952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60931.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9680.exe
        6⤵
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        6⤵
        
        PID:3616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
        6⤵
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11539.exe
        6⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9394.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28741.exe
        5⤵
        
        PID:2508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35704.exe
        5⤵
        
        PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50730.exe
        5⤵
        
        PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3404.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17786.exe
        5⤵
        
        PID:6660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41372.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4056.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4547.exe
        6⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18989.exe
        7⤵
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45557.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60529.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1915.exe
        7⤵
        
        PID:5996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19026.exe
        6⤵
        
        PID:1744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51328.exe
        6⤵
        
        PID:3796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22256.exe
        6⤵
        
        PID:4720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2599.exe
        6⤵
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58396.exe
        6⤵
        
        PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19466.exe
        5⤵
        
        PID:2556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54202.exe
        6⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41248.exe
        6⤵
        
        PID:4812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34998.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32761.exe
        5⤵
        
        PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57193.exe
        5⤵
        
        PID:3800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13591.exe
        5⤵
        
        PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41302.exe
        5⤵
        
        PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9924.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9074.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2977.exe
        5⤵
        
        PID:2200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9680.exe
        6⤵
        
        PID:1108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        6⤵
        
        PID:3532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
        6⤵
        
        PID:4148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27601.exe
        6⤵
        
        PID:5184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9394.exe
        6⤵
        
        PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62232.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6155.exe
        5⤵
        
        PID:3212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13975.exe
        5⤵
        
        PID:4432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2400.exe
        5⤵
        
        PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9924.exe
        5⤵
        
        PID:6492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54981.exe
      4⤵
      PID:344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-540.exe
        5⤵
        
        PID:3640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38104.exe
        5⤵
        
        PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5783.exe
        5⤵
        
        PID:4388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34588.exe
        5⤵
        
        PID:5976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13426.exe
      4⤵
      PID:1728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49058.exe
      4⤵
      PID:3780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58127.exe
      4⤵
      PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31502.exe
      4⤵
      PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52795.exe
      4⤵
      PID:4748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14034.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14034.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33781.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10034.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9339.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63335.exe
        7⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-188.exe
        8⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64153.exe
        9⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64733.exe
        9⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29875.exe
        8⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19743.exe
        8⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60465.exe
        8⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6629.exe
        8⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59133.exe
        8⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20224.exe
        7⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28634.exe
        8⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47468.exe
        8⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43611.exe
        7⤵
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2304.exe
        7⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35539.exe
        7⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9924.exe
        7⤵
        
        PID:6420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17245.exe
        6⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-188.exe
        7⤵
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12712.exe
        8⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64878.exe
        8⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29875.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60947.exe
        7⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16726.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9394.exe
        7⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43067.exe
        6⤵
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18927.exe
        7⤵
        
        PID:6892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49476.exe
        6⤵
        
        PID:3404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41811.exe
        6⤵
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35264.exe
        6⤵
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10308.exe
        6⤵
        
        PID:5344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55312.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47191.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-188.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58434.exe
        8⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64733.exe
        8⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29875.exe
        7⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60947.exe
        7⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27985.exe
        7⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10136.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28501.exe
        6⤵
        
        PID:2644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43611.exe
        6⤵
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50476.exe
        6⤵
        
        PID:4280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51800.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58396.exe
        6⤵
        
        PID:6292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63954.exe
        5⤵
        
        PID:2756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33640.exe
        6⤵
        
        PID:1684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        6⤵
        
        PID:3676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
        6⤵
        
        PID:4116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25876.exe
        6⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59133.exe
        6⤵
        
        PID:6808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35788.exe
        5⤵
        
        PID:348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35704.exe
        5⤵
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50730.exe
        5⤵
        
        PID:4320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58368.exe
        5⤵
        
        PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37786.exe
        5⤵
        
        PID:2060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5353.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10055.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60494.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40746.exe
        7⤵
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41248.exe
        7⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61587.exe
        7⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43611.exe
        6⤵
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30648.exe
        6⤵
        
        PID:4700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2791.exe
        6⤵
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58396.exe
        6⤵
        
        PID:6268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41225.exe
        5⤵
        
        PID:2264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19079.exe
        6⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65392.exe
        6⤵
        
        PID:7068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8483.exe
        5⤵
        
        PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54020.exe
        5⤵
        
        PID:4004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1255.exe
        5⤵
        
        PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58396.exe
        5⤵
        
        PID:6252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35638.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11143.exe
        5⤵
        
        PID:1988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57650.exe
        6⤵
        
        PID:3736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2656.exe
        6⤵
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21735.exe
        6⤵
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18059.exe
        6⤵
        
        PID:6380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        5⤵
        
        PID:3636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18563.exe
        5⤵
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58787.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-894.exe
      4⤵
      PID:1816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35704.exe
      4⤵
      PID:3700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50730.exe
      4⤵
      PID:5068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35610.exe
      4⤵
      PID:5252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54314.exe
      4⤵
      PID:5364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27951.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27951.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61072.exe
      4⤵
      Executes dropped EXE
      PID:2540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63174.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43774.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47008.exe
        7⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45164.exe
        7⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32234.exe
        7⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11539.exe
        7⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9394.exe
        7⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27142.exe
        6⤵
        
        PID:2416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54841.exe
        6⤵
        
        PID:3628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10393.exe
        6⤵
        
        PID:5104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57838.exe
        6⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58396.exe
        6⤵
        
        PID:6188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31961.exe
        5⤵
        
        PID:1272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49476.exe
        5⤵
        
        PID:3396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58147.exe
        5⤵
        
        PID:4472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2784.exe
        5⤵
        
        PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59317.exe
        5⤵
        
        PID:5932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35825.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9680.exe
        5⤵
        
        PID:468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        5⤵
        
        PID:3364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43745.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20255.exe
        5⤵
        
        PID:5124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3550.exe
      4⤵
      PID:2000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44370.exe
      4⤵
      PID:2176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1728.exe
      4⤵
      PID:5008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51601.exe
      4⤵
      PID:4492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9924.exe
      4⤵
      PID:6500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60807.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60807.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30886.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34709.exe
        5⤵
        
        PID:3060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        5⤵
        
        PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
        5⤵
        
        PID:4128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23183.exe
        5⤵
        
        PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59133.exe
        5⤵
        
        PID:6840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63468.exe
      4⤵
      PID:876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38505.exe
      4⤵
      PID:3236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10393.exe
      4⤵
      PID:4232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52075.exe
      4⤵
      PID:5384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42251.exe
      4⤵
      PID:5968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47337.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47337.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-188.exe
      4⤵
      PID:1504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1366.exe
        5⤵
        
        PID:5820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64733.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29875.exe
      4⤵
      PID:3524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60947.exe
      4⤵
      PID:4448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49451.exe
      4⤵
      PID:5220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9394.exe
      4⤵
      PID:6284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47488.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47488.exe
    3⤵
    PID:2848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27955.exe
      4⤵
      PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14422.exe
      4⤵
      PID:6124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34998.exe
      4⤵
      PID:6756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41341.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41341.exe
    3⤵
    PID:3464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20810.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20810.exe
    3⤵
    PID:4288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58520.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58520.exe
    3⤵
    PID:4684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52795.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52795.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6260
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43351.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43351.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17756.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17756.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53018.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28774.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39332.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17423.exe
        7⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52476.exe
        8⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27923.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10393.exe
        7⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41502.exe
        7⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58780.exe
        7⤵
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51584.exe
        6⤵
        
        PID:1668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43611.exe
        6⤵
        
        PID:3376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58473.exe
        6⤵
        
        PID:4524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2983.exe
        6⤵
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3720.exe
        6⤵
        
        PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3623.exe
        5⤵
        
        PID:2636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54285.exe
        6⤵
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32229.exe
        6⤵
        
        PID:4408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34998.exe
        6⤵
        
        PID:6740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1734.exe
        5⤵
        
        PID:2840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2730.exe
        5⤵
        
        PID:3976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48184.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51876.exe
        5⤵
        
        PID:5492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9924.exe
        5⤵
        
        PID:6484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22259.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50287.exe
        5⤵
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33888.exe
        6⤵
        
        PID:5212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29875.exe
        5⤵
        
        PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19743.exe
        5⤵
        
        PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60465.exe
        5⤵
        
        PID:4664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6629.exe
        5⤵
        
        PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59133.exe
        5⤵
        
        PID:6760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44864.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40811.exe
      4⤵
      PID:3472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25275.exe
      4⤵
      PID:4304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19849.exe
      4⤵
      PID:4596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53930.exe
      4⤵
      PID:6372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14216.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14216.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27907.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13973.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9680.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        6⤵
        
        PID:3656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
        6⤵
        
        PID:4100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-966.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58787.exe
        6⤵
        
        PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55352.exe
        5⤵
        
        PID:1036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38505.exe
        5⤵
        
        PID:3180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10393.exe
        5⤵
        
        PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57838.exe
        5⤵
        
        PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58396.exe
        5⤵
        
        PID:6236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5457.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52581.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        5⤵
        
        PID:3360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
        5⤵
        
        PID:4188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23183.exe
        5⤵
        
        PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59133.exe
        5⤵
        
        PID:6856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-239.exe
      4⤵
      PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44370.exe
      4⤵
      PID:3252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1728.exe
      4⤵
      PID:4204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23713.exe
      4⤵
      PID:5580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54667.exe
      4⤵
      PID:6792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54942.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54942.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41768.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52197.exe
        5⤵
        
        PID:2260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        5⤵
        
        PID:3188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
        5⤵
        
        PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51044.exe
        5⤵
        
        PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9394.exe
        5⤵
        
        PID:6164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2840.exe
      4⤵
      PID:2612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38505.exe
      4⤵
      PID:3240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10393.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2874.exe
      4⤵
      PID:5412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58396.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8638.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8638.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6104.exe
      4⤵
      PID:2972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29875.exe
      4⤵
      PID:3496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10969.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58715.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26984.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19094.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19094.exe
    3⤵
    PID:2224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24275.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24275.exe
    3⤵
    PID:3452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42341.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42341.exe
    3⤵
    PID:4244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30799.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30799.exe
    3⤵
    PID:5040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48979.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48979.exe
    3⤵
    PID:5612
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11433.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11433.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34082.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34082.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61840.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28198.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7417.exe
        6⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54719.exe
        7⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62512.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29875.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10969.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35079.exe
        6⤵
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58780.exe
        6⤵
        
        PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19072.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47008.exe
        6⤵
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48155.exe
        6⤵
        
        PID:3944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2629.exe
        6⤵
        
        PID:936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9778.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40878.exe
        5⤵
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1599.exe
        6⤵
        
        PID:7156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64764.exe
        5⤵
        
        PID:2800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29434.exe
        5⤵
        
        PID:4140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58900.exe
        5⤵
        
        PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9924.exe
        5⤵
        
        PID:6476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11020.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-188.exe
        5⤵
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63566.exe
        6⤵
        
        PID:7108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29875.exe
        5⤵
        
        PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44611.exe
        5⤵
        
        PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60465.exe
        5⤵
        
        PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9394.exe
        5⤵
        
        PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59595.exe
      4⤵
      PID:1384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63950.exe
        5⤵
        
        PID:7080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49476.exe
      4⤵
      PID:3412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32703.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2784.exe
      4⤵
      PID:4660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59317.exe
      4⤵
      PID:5880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41206.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41206.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55691.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38372.exe
        5⤵
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35133.exe
        6⤵
        
        PID:3704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45557.exe
        6⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45262.exe
        6⤵
        
        PID:6072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44122.exe
        6⤵
        
        PID:6668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53536.exe
        5⤵
        
        PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62402.exe
        5⤵
        
        PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56849.exe
        5⤵
        
        PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9341.exe
        5⤵
        
        PID:5920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10661.exe
        5⤵
        
        PID:6800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38215.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54285.exe
        5⤵
        
        PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15893.exe
        5⤵
        
        PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34998.exe
        5⤵
        
        PID:6748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41924.exe
      4⤵
      PID:3064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4266.exe
      4⤵
      PID:3884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49324.exe
      4⤵
      PID:4652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25242.exe
      4⤵
      PID:5360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8440.exe
      4⤵
      PID:6940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35721.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35721.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61091.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63585.exe
        5⤵
        
        PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57476.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61587.exe
        5⤵
        
        PID:4664
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 888 -s 236
      4⤵
      Program crash
      PID:2924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60826.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60826.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23339.exe
      4⤵
      PID:1508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39055.exe
      4⤵
      PID:3948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
      4⤵
      PID:4156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43745.exe
      4⤵
      PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41042.exe
      4⤵
      PID:6516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19509.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19509.exe
    3⤵
    PID:1152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26652.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26652.exe
    3⤵
    PID:3112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2258.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2258.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54434.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54434.exe
    3⤵
    PID:5464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48595.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48595.exe
    3⤵
    PID:6320
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33817.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33817.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28976.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28976.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27897.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58081.exe
        5⤵
        
        PID:1944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19799.exe
        6⤵
        
        PID:3860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36563.exe
        6⤵
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54875.exe
        6⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26332.exe
        6⤵
        
        PID:6728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28188.exe
        5⤵
        
        PID:2876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
        5⤵
        
        PID:3908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51082.exe
        5⤵
        
        PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41778.exe
        5⤵
        
        PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56912.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4967.exe
      4⤵
      PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40362.exe
        5⤵
        
        PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8384.exe
        5⤵
        
        PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12194.exe
        5⤵
        
        PID:6412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7990.exe
      4⤵
      PID:952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4266.exe
      4⤵
      PID:3856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42417.exe
      4⤵
      PID:4508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25242.exe
      4⤵
      PID:5380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8440.exe
      4⤵
      PID:6912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58109.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58109.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27142.exe
      4⤵
      PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58899.exe
      4⤵
      PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36645.exe
      4⤵
      PID:5064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55631.exe
      4⤵
      PID:5888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10661.exe
      4⤵
      PID:6784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32911.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32911.exe
    3⤵
    PID:2284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51853.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51853.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1728.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1728.exe
    3⤵
    PID:5016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35539.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35539.exe
    3⤵
    PID:5524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10308.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10308.exe
    3⤵
    PID:5844
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18976.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18976.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10055.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10055.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28025.exe
      4⤵
      PID:528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29875.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60947.exe
      4⤵
      PID:4340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27985.exe
      4⤵
      PID:4760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24770.exe
      4⤵
      PID:6548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21921.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21921.exe
    3⤵
    PID:2744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60212.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60212.exe
    3⤵
    PID:4036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10393.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10393.exe
    3⤵
    PID:4236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58715.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58715.exe
    3⤵
    PID:5704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58396.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58396.exe
    3⤵
    PID:6180
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16302.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16302.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52197.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52197.exe
    3⤵
    PID:2804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
    3⤵
    PID:3608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
    3⤵
    PID:4112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43745.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43745.exe
    3⤵
    PID:5236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9778.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9778.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5544
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1280.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1280.exe
  2⤵
  PID:316
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14704.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14704.exe
  2⤵
  PID:3192
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40929.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40929.exe
  2⤵
  PID:5084
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29939.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29939.exe
  2⤵
  PID:5312
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25444.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25444.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-17564.exe

Filesize
468KB

MD5
1ff19ae08552ef9a2a7828e2d5f64c43

SHA1
0ac55e94441ab71ebef155dd63315ccca583f9ac

SHA256
21dcf93a0ea73a064176cbd5a9844b0a14c7d5719c03e5e40d4dfedd47cb8ff2

SHA512
ecc97d74ea9ee0249f19a2404eb7eeb2e207aa3a0545d5440537496fbf3321d9807ef1fba30ea86ee0600b174d403d1fc1f8db0d84145a49d2483580d47aaf8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25006.exe

Filesize
468KB

MD5
4f6a805e74f21f4b4cb16aaa80fd83a0

SHA1
6b280f7b2c0820fcd1176163594cdd5193a91bf3

SHA256
f4984ca9295adb97c372e75dc02d80011329f77b1eb9f7715098208945876b87

SHA512
2aec3c0f9c6738b16572dc148451bc1c2651a78e6c2ace685057e470004c6a6ea595f74fdee957c6dcc3652dbc458e16ee57a6d8c20a2d6637c9e556e3f408c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33781.exe

Filesize
468KB

MD5
c538050d43a0e71ca0916832f9fc4097

SHA1
4f2b31198ee5e659f2dac58191a476f8afb09ece

SHA256
a9101f718c250ec11a9ba8bcd66f19815711b75472dcd6021f0dde96abcd892b

SHA512
2aad5eff42004749cd0d41ec159e408973e6a0af1c9b4074dc212688e7e63c4ccf6e4ce633302e30718ca1f3570b049744f3274e159dcc24c368582602f3706a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34082.exe

Filesize
468KB

MD5
060e9e0a5e4ce912116361a6e910afd9

SHA1
26ca6132714ee442b5f652325902394804e127d2

SHA256
b192d15d0289d1c8db300a6fc8608995aa2c5d331b4384406fe6a0bf16df0109

SHA512
91fa2cc372d4aae9b5304877edbf6e572b32444fc5c5dd4616d752fabfd96bdd9d2c5d1ec7f554d29573bfd41ae47719da96eec8917bd66327acc87dd66e2317

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43351.exe

Filesize
468KB

MD5
e6a54e066f6ae19e6cf3999fb0428eae

SHA1
87d52ff5ba824f2a51d014df1df687c7fd89cf6f

SHA256
a33d59cd6b9fc4c15a459a653df886f853c9711cdd6f8ca89e32d7e364e53c68

SHA512
ee43400e76676f807a53f18f6be3123f153f3f87cde7913ee233f5b4513fecfec8771b9f6bf0b253f67b7ead881f3bc0444c2b21fa1636a04dfe1326d9ed4ca2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44933.exe

Filesize
468KB

MD5
5c47fc000cee7c8521c5130ab5cee2f7

SHA1
d8f023a183e764949e32d5e5ea2e5d7934f9e515

SHA256
116162afe8935ce23692707267176aebac4554c3a18a359a5d3240f743d813d9

SHA512
b87495855a2a9f3cd4900163eaa575de7ad5d52002781355c066e706046d804add139e36b091fe8526424bcd9163c88d7e15b5ea583fb5073bc610ecebefff1f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-11433.exe

Filesize
468KB

MD5
75f0dc6e776895197e6bd238f12106db

SHA1
ddfff93e06f9b2a53480690d2b815cf9eee76395

SHA256
689bbde462a267a78a71de43cb56550d2108e588d942a5350fd9b72fd4a18844

SHA512
62c35f11254051a08887658dce25c2be40cd4b1f135091db02178a9eb7943a3e1d34af3d1a34c6e80cbc7e7dd831fc7243108066768d01d7e276f00ca938c313

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14034.exe

Filesize
468KB

MD5
9d6c4c7300581df6a0dd9de14c2d75cc

SHA1
abb28219e22c388c7b0ee6206d0defe456c20cc8

SHA256
2200e0634f420fe561b1f99aeff59af895522081c777ff064aecfdf3e0c6beba

SHA512
40e10a92faf67373c4630b87e1bac828f1163e1b773f68644f9c7e4781f3cba19d5f60f74ab96712f6bfb3bee810fa4b228398f9d0ab077bbccbcbf0197826d0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14216.exe

Filesize
468KB

MD5
9c564e4560420ed0e051c1e6a2c6ee3c

SHA1
327ac4ea509c9ec55b2db48129bc523a58b0fea7

SHA256
88dc1d6b5f2901d36718a79bea67576e8cc9ff87de60f7ffb1e1a541376d005e

SHA512
519f3f930b6160a3ed460c64667d40b4332cab051323c72e1c117d2990b46a2a0c5121256a2f8089cb7a8734ecec56265a8bd3898534bc72d0e03ae7bedd73d9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17756.exe

Filesize
468KB

MD5
ff346f344a5a4ff6856fb25f21fc14ee

SHA1
99b6894078d2cec6d43f2b481781af26f5255cf5

SHA256
4255f2e2fdb5e7343c9be13201e20ff0b789e88a3a7b483617c8a841a71e6897

SHA512
b2330be6562543ee1f191bfca46c68057ad1018d58c84de2964102b8f96b9dbab713b4953c86396b3820de0fa6ff86c49be7356e09380a15468b90ff734401a9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25392.exe

Filesize
468KB

MD5
7fa37f547c72e7976d0b4497acffcd9e

SHA1
8927f76b36690791f60ac8bd6bb406f951d3becb

SHA256
cc022d1b0535b1ca6c11f99ad17bd3bbf057568cbc487cc4e00b064c2fcd648b

SHA512
0f381ec73d4848e8085f695dca12d37931d45897716c258e84e2f4a62cd52f78cb9bbde92c41a58c80ce28eba8d351d5dcb5ef0b14fefd0a5ed13e8bc366416c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27951.exe

Filesize
468KB

MD5
24def1b75f25612dce59ffd83c3c178c

SHA1
46f150d2c0869cd3df3a9d40734c7c3894ff4fce

SHA256
e0b4d6cc13fb054a78f42589f01d05d2e5ed8950c2a29ea1c93dfeb86eb9cdd4

SHA512
5b2d46abe6a0c85497c7dd7184c599ea758fa237a04d5bd5ef9a6a47f245a09e289b078a9393bf6916fa3ec530b779bfcfd4aacbc96ca6242e2ef7dc4f46b4f6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32034.exe

Filesize
468KB

MD5
1596d5acf5a3cbf1fff5300466b6b502

SHA1
2fdcd1d6b51da84e0c8bcd175a0f3308c93d775f

SHA256
176e8e053097c1aafefa7ce955d22132e12cd85cfd931ca45d4571663b20f0c1

SHA512
e415d81f679bb1353c5972d7fab714ea0aba83b43fd72ad044382c2ae7e8a540f302481d7aeb67f60baf765c4afe728a7164b33cddaced801974ca7a37b6e6f6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33817.exe

Filesize
468KB

MD5
29a537dfc81ca8e72792ea0f4a0d9150

SHA1
a4964e013c676bd791cf9ea4bf5ed57e71564a5d

SHA256
4e31628163137a02980bbda6f7d88fe8300b88b210ecbf6805ba0ccaddda8ed2

SHA512
1798b9aa77fa5405be89cde5d48e18652c43623bb0d91260e9f5f00ad869c7895c0d30e2bc43a10af0e7b74688505cde31244bf36ac47e0405f83503771e5c7f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-41372.exe

Filesize
468KB

MD5
d39533ec8aed13b061f3c62fda7fc9de

SHA1
53c43f591da2ab3a55a77c333fb94d5431d5396b

SHA256
0ca28939e7239f4d29fc8f3ac42eacdd4abe9e16321e87d09ec5a46190eeb97f

SHA512
b1e4e04ee89af5cf5f8a39a7a7ac906165698561b390118d0ed68f0cec1691c24a91921eb6a5dc73feebd7c79e7c557005eb3c9d3e8f753149727b6abdc0cd2a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63116.exe

Filesize
468KB

MD5
2bc503c220902c0eb05c2c8aac7fe5e0

SHA1
ea5ec904cab3fd27ec4e06b632c9aa4c1ff127fe

SHA256
e963e34ddea5a10f9f67ced6801562217d8728f234c3117a3a7152fabdb847bd

SHA512
49c25e66eea87e3f88bca451118605c9ba04cb195de79fedfcb0a82e4693700fd596bd7de3c625d93b87ca3ca64639de6dd404be3ac9e3ef9b8ccfab2e5fb688

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64341.exe

Filesize
468KB

MD5
d1cbfaa21aad285ba4755e617c30ffff

SHA1
86940e64a6c00d45a75c909a8e3322c70ffeee8d

SHA256
5f074b32563bf3cb6a97f1ec5bc49394f7cd309b44d018814f54dbf1c559ab4d

SHA512
c827298c80be27cc513998eafe3359454a709703e5b675e33dd5f829d55a22c65fc8e4fe386c16b15f9dd2725c0ddae91527779213e392eee975271c5168126f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64414.exe

Filesize
468KB

MD5
9aa6786de802f0c0afc5feda866cabaa

SHA1
feff92c7dfc423e8e735af48d3433dc9ef21537e

SHA256
7c78afb6d3dc645bbb9e9f822bcafb250efe1ad352f148957b9828892f139429

SHA512
79cc3ab5b0e44aeec1146a5738e372fc406739f8441aae45c3fe6cfbc7e4e6e978a34493e421c950b7d7dce48a6cd37df5711cbcfe416fe584249f481bed1577

Download Submit
memory/112-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/320-356-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/320-213-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/320-355-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/320-109-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/320-214-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/704-215-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/704-347-0x0000000002360000-0x00000000023D5000-memory.dmp

Filesize
468KB

Download
memory/704-345-0x0000000002360000-0x00000000023D5000-memory.dmp

Filesize
468KB

Download
memory/776-307-0x00000000028D0000-0x0000000002945000-memory.dmp

Filesize
468KB

Download
memory/776-302-0x00000000028D0000-0x0000000002945000-memory.dmp

Filesize
468KB

Download
memory/776-167-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/856-285-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1008-292-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1052-282-0x00000000028F0000-0x0000000002965000-memory.dmp

Filesize
468KB

Download
memory/1052-168-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1052-279-0x00000000028F0000-0x0000000002965000-memory.dmp

Filesize
468KB

Download
memory/1056-384-0x0000000001D40000-0x0000000001DB5000-memory.dmp

Filesize
468KB

Download
memory/1056-389-0x0000000001D40000-0x0000000001DB5000-memory.dmp

Filesize
468KB

Download
memory/1056-227-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1268-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1268-34-0x0000000001FC0000-0x0000000002035000-memory.dmp

Filesize
468KB

Download
memory/1268-151-0x0000000001DC0000-0x0000000001E35000-memory.dmp

Filesize
468KB

Download
memory/1268-325-0x0000000001DC0000-0x0000000001E35000-memory.dmp

Filesize
468KB

Download
memory/1268-318-0x0000000001DC0000-0x0000000001E35000-memory.dmp

Filesize
468KB

Download
memory/1484-390-0x00000000028E0000-0x0000000002955000-memory.dmp

Filesize
468KB

Download
memory/1484-391-0x00000000028E0000-0x0000000002955000-memory.dmp

Filesize
468KB

Download
memory/1484-188-0x0000000003410000-0x0000000003485000-memory.dmp

Filesize
468KB

Download
memory/1484-189-0x00000000028E0000-0x0000000002955000-memory.dmp

Filesize
468KB

Download
memory/1484-98-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1492-287-0x0000000002840000-0x00000000028B5000-memory.dmp

Filesize
468KB

Download
memory/1492-291-0x0000000002840000-0x00000000028B5000-memory.dmp

Filesize
468KB

Download
memory/1492-166-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1592-406-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1592-405-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1592-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1616-376-0x0000000001D80000-0x0000000001DF5000-memory.dmp

Filesize
468KB

Download
memory/1616-97-0x0000000001D80000-0x0000000001DF5000-memory.dmp

Filesize
468KB

Download
memory/1616-382-0x0000000001D80000-0x0000000001DF5000-memory.dmp

Filesize
468KB

Download
memory/1616-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1616-199-0x0000000001D80000-0x0000000001DF5000-memory.dmp

Filesize
468KB

Download
memory/1616-200-0x0000000001D80000-0x0000000001DF5000-memory.dmp

Filesize
468KB

Download
memory/1756-281-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2064-284-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2128-190-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2128-362-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2148-365-0x0000000001D90000-0x0000000001E05000-memory.dmp

Filesize
468KB

Download
memory/2148-363-0x0000000001D90000-0x0000000001E05000-memory.dmp

Filesize
468KB

Download
memory/2148-201-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2164-316-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2164-160-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2164-152-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2164-317-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2164-40-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2216-228-0x00000000026D0000-0x0000000002745000-memory.dmp

Filesize
468KB

Download
memory/2216-407-0x00000000026D0000-0x0000000002745000-memory.dmp

Filesize
468KB

Download
memory/2216-404-0x00000000026D0000-0x0000000002745000-memory.dmp

Filesize
468KB

Download
memory/2216-39-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2216-61-0x00000000026D0000-0x0000000002745000-memory.dmp

Filesize
468KB

Download
memory/2216-226-0x00000000026D0000-0x0000000002745000-memory.dmp

Filesize
468KB

Download
memory/2252-392-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2292-259-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2340-332-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2364-269-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/2364-159-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2364-278-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/2440-326-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2540-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2640-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2648-319-0x0000000002210000-0x0000000002285000-memory.dmp

Filesize
468KB

Download
memory/2648-80-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2648-330-0x0000000002210000-0x0000000002285000-memory.dmp

Filesize
468KB

Download
memory/2648-161-0x0000000002210000-0x0000000002285000-memory.dmp

Filesize
468KB

Download
memory/2648-162-0x0000000002210000-0x0000000002285000-memory.dmp

Filesize
468KB

Download
memory/2656-254-0x00000000033E0000-0x0000000003455000-memory.dmp

Filesize
468KB

Download
memory/2656-258-0x00000000028B0000-0x0000000002925000-memory.dmp

Filesize
468KB

Download
memory/2656-120-0x00000000028B0000-0x0000000002925000-memory.dmp

Filesize
468KB

Download
memory/2656-82-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2660-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2672-383-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2680-320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2684-2-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2684-33-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/2684-150-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/2684-12-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/2684-6-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/2684-283-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/2684-280-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/2708-349-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2824-50-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2824-245-0x0000000002760000-0x00000000027D5000-memory.dmp

Filesize
468KB

Download
memory/2824-237-0x0000000002760000-0x00000000027D5000-memory.dmp

Filesize
468KB

Download
memory/2832-364-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2920-122-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2920-238-0x00000000023A0000-0x0000000002415000-memory.dmp

Filesize
468KB

Download
memory/2920-244-0x00000000023A0000-0x0000000002415000-memory.dmp

Filesize
468KB

Download