e1f2770b0800f84112bf91ca0847a4d945910a27f8c1285b376c8d771f34f110

Analysis

max time kernel
91s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 03:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1f2770b0800f84112bf91ca0847a4d945910a27f8c1285b376c8d771f34f110.exe
Size

468KB
MD5

8ca73021fbf858462bf3e43519adfac6
SHA1

0edbdf8f2cb30cdc50bbc100d6b1f147c104a9a0
SHA256

e1f2770b0800f84112bf91ca0847a4d945910a27f8c1285b376c8d771f34f110
SHA512

324fa8251431dc5b06108dd23e3ebb6fd2a8b9ef3b0c5592138793bdb8400eb1b4bf04d4514061a65b490647f02719212eea05af9f364026ae0e7b97013e0293
SSDEEP

3072:MTKNoSCVIf5UtbY2Pztjcf8/SCMvhgpwVmHeIvsUPKi8yhyCQrls:MT0oQBUtlPJjcfNcQQPKTWyCQ

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2112	Unicorn-17965.exe
2052	Unicorn-4010.exe
572	Unicorn-40828.exe
2812	Unicorn-50523.exe
2736	Unicorn-54052.exe
2956	Unicorn-4851.exe
2660	Unicorn-31009.exe
2356	Unicorn-47389.exe
2344	Unicorn-60004.exe
1104	Unicorn-62957.exe
1584	Unicorn-30477.exe
1516	Unicorn-17155.exe
316	Unicorn-37021.exe
2128	Unicorn-36756.exe
624	Unicorn-64632.exe
2972	Unicorn-12677.exe
2456	Unicorn-57773.exe
2340	Unicorn-28438.exe
2500	Unicorn-17704.exe
3060	Unicorn-56123.exe
1620	Unicorn-3201.exe
1872	Unicorn-55355.exe
2796	Unicorn-32696.exe
1432	Unicorn-55547.exe
540	Unicorn-30088.exe
2496	Unicorn-39019.exe
2448	Unicorn-39019.exe
556	Unicorn-58655.exe
1504	Unicorn-54706.exe
696	Unicorn-9034.exe
1488	Unicorn-4929.exe
2212	Unicorn-14374.exe
1612	Unicorn-26989.exe
1580	Unicorn-46855.exe
2432	Unicorn-5455.exe
1968	Unicorn-59141.exe
2824	Unicorn-40536.exe
2832	Unicorn-42421.exe
1696	Unicorn-40152.exe
780	Unicorn-60018.exe
2936	Unicorn-25820.exe
2644	Unicorn-42229.exe
2484	Unicorn-22258.exe
2388	Unicorn-10407.exe
1420	Unicorn-56764.exe
2868	Unicorn-10023.exe
1976	Unicorn-9639.exe
1860	Unicorn-49710.exe
2168	Unicorn-19925.exe
1744	Unicorn-45192.exe
492	Unicorn-60879.exe
3020	Unicorn-61144.exe
2076	Unicorn-28088.exe
644	Unicorn-8222.exe
2960	Unicorn-28088.exe
2044	Unicorn-59691.exe
2140	Unicorn-20696.exe
2308	Unicorn-10718.exe
920	Unicorn-29515.exe
1388	Unicorn-16172.exe
2992	Unicorn-29131.exe
1028	Unicorn-62580.exe
1780	Unicorn-41513.exe
1368	Unicorn-54512.exe

Loads dropped DLL 64 IoCs

pid	Process
1992	e1f2770b0800f84112bf91ca0847a4d945910a27f8c1285b376c8d771f34f110.exe
1992	e1f2770b0800f84112bf91ca0847a4d945910a27f8c1285b376c8d771f34f110.exe
2112	Unicorn-17965.exe
2112	Unicorn-17965.exe
1992	e1f2770b0800f84112bf91ca0847a4d945910a27f8c1285b376c8d771f34f110.exe
1992	e1f2770b0800f84112bf91ca0847a4d945910a27f8c1285b376c8d771f34f110.exe
2112	Unicorn-17965.exe
2052	Unicorn-4010.exe
2112	Unicorn-17965.exe
2052	Unicorn-4010.exe
572	Unicorn-40828.exe
572	Unicorn-40828.exe
1992	e1f2770b0800f84112bf91ca0847a4d945910a27f8c1285b376c8d771f34f110.exe
1992	e1f2770b0800f84112bf91ca0847a4d945910a27f8c1285b376c8d771f34f110.exe
2736	Unicorn-54052.exe
2736	Unicorn-54052.exe
2052	Unicorn-4010.exe
2052	Unicorn-4010.exe
2660	Unicorn-31009.exe
2660	Unicorn-31009.exe
2956	Unicorn-4851.exe
2956	Unicorn-4851.exe
572	Unicorn-40828.exe
572	Unicorn-40828.exe
2812	Unicorn-50523.exe
1992	e1f2770b0800f84112bf91ca0847a4d945910a27f8c1285b376c8d771f34f110.exe
2812	Unicorn-50523.exe
1992	e1f2770b0800f84112bf91ca0847a4d945910a27f8c1285b376c8d771f34f110.exe
2112	Unicorn-17965.exe
2112	Unicorn-17965.exe
2356	Unicorn-47389.exe
2356	Unicorn-47389.exe
2736	Unicorn-54052.exe
2736	Unicorn-54052.exe
2344	Unicorn-60004.exe
2344	Unicorn-60004.exe
2052	Unicorn-4010.exe
2052	Unicorn-4010.exe
1104	Unicorn-62957.exe
1104	Unicorn-62957.exe
2660	Unicorn-31009.exe
2660	Unicorn-31009.exe
1516	Unicorn-17155.exe
1516	Unicorn-17155.exe
572	Unicorn-40828.exe
572	Unicorn-40828.exe
2128	Unicorn-36756.exe
2128	Unicorn-36756.exe
1992	e1f2770b0800f84112bf91ca0847a4d945910a27f8c1285b376c8d771f34f110.exe
1992	e1f2770b0800f84112bf91ca0847a4d945910a27f8c1285b376c8d771f34f110.exe
1584	Unicorn-30477.exe
624	Unicorn-64632.exe
624	Unicorn-64632.exe
1584	Unicorn-30477.exe
2112	Unicorn-17965.exe
2112	Unicorn-17965.exe
2956	Unicorn-4851.exe
2956	Unicorn-4851.exe
316	Unicorn-37021.exe
316	Unicorn-37021.exe
2812	Unicorn-50523.exe
2812	Unicorn-50523.exe
2972	Unicorn-12677.exe
2972	Unicorn-12677.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1684	2992	WerFault.exe	91
5028	3788	WerFault.exe	244

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8892.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17771.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20571.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26188.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13212.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64632.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6836.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61152.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19359.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17771.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26776.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59982.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36827.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42421.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20696.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6836.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11069.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30088.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57818.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6836.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24725.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28088.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55355.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46855.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6354.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39634.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9522.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54052.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4851.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27449.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53363.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20491.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4010.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40657.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53370.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20571.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26437.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10448.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11483.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23427.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41437.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27449.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14534.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60004.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26437.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36756.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29131.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27673.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1527.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54180.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39634.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48455.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31009.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2436.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59308.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1992	e1f2770b0800f84112bf91ca0847a4d945910a27f8c1285b376c8d771f34f110.exe
2112	Unicorn-17965.exe
2052	Unicorn-4010.exe
572	Unicorn-40828.exe
2736	Unicorn-54052.exe
2812	Unicorn-50523.exe
2956	Unicorn-4851.exe
2660	Unicorn-31009.exe
2356	Unicorn-47389.exe
2344	Unicorn-60004.exe
1104	Unicorn-62957.exe
1516	Unicorn-17155.exe
2128	Unicorn-36756.exe
1584	Unicorn-30477.exe
316	Unicorn-37021.exe
624	Unicorn-64632.exe
2972	Unicorn-12677.exe
2456	Unicorn-57773.exe
2340	Unicorn-28438.exe
3060	Unicorn-56123.exe
2500	Unicorn-17704.exe
1620	Unicorn-3201.exe
1872	Unicorn-55355.exe
1432	Unicorn-55547.exe
556	Unicorn-58655.exe
2796	Unicorn-32696.exe
2496	Unicorn-39019.exe
540	Unicorn-30088.exe
2448	Unicorn-39019.exe
696	Unicorn-9034.exe
1504	Unicorn-54706.exe
1488	Unicorn-4929.exe
2212	Unicorn-14374.exe
1612	Unicorn-26989.exe
1580	Unicorn-46855.exe
2432	Unicorn-5455.exe
1968	Unicorn-59141.exe
2832	Unicorn-42421.exe
2824	Unicorn-40536.exe
780	Unicorn-60018.exe
1696	Unicorn-40152.exe
2936	Unicorn-25820.exe
2644	Unicorn-42229.exe
2484	Unicorn-22258.exe
2388	Unicorn-10407.exe
1420	Unicorn-56764.exe
2868	Unicorn-10023.exe
1976	Unicorn-9639.exe
1860	Unicorn-49710.exe
2168	Unicorn-19925.exe
1744	Unicorn-45192.exe
3020	Unicorn-61144.exe
492	Unicorn-60879.exe
2044	Unicorn-59691.exe
2960	Unicorn-28088.exe
644	Unicorn-8222.exe
2076	Unicorn-28088.exe
2308	Unicorn-10718.exe
2140	Unicorn-20696.exe
920	Unicorn-29515.exe
1388	Unicorn-16172.exe
2992	Unicorn-29131.exe
1028	Unicorn-62580.exe
1368	Unicorn-54512.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2112	1992	e1f2770b0800f84112bf91ca0847a4d945910a27f8c1285b376c8d771f34f110.exe	30
PID 1992 wrote to memory of 2112	1992	e1f2770b0800f84112bf91ca0847a4d945910a27f8c1285b376c8d771f34f110.exe	30
PID 1992 wrote to memory of 2112	1992	e1f2770b0800f84112bf91ca0847a4d945910a27f8c1285b376c8d771f34f110.exe	30
PID 1992 wrote to memory of 2112	1992	e1f2770b0800f84112bf91ca0847a4d945910a27f8c1285b376c8d771f34f110.exe	30
PID 2112 wrote to memory of 2052	2112	Unicorn-17965.exe	32
PID 2112 wrote to memory of 2052	2112	Unicorn-17965.exe	32
PID 2112 wrote to memory of 2052	2112	Unicorn-17965.exe	32
PID 2112 wrote to memory of 2052	2112	Unicorn-17965.exe	32
PID 1992 wrote to memory of 572	1992	e1f2770b0800f84112bf91ca0847a4d945910a27f8c1285b376c8d771f34f110.exe	33
PID 1992 wrote to memory of 572	1992	e1f2770b0800f84112bf91ca0847a4d945910a27f8c1285b376c8d771f34f110.exe	33
PID 1992 wrote to memory of 572	1992	e1f2770b0800f84112bf91ca0847a4d945910a27f8c1285b376c8d771f34f110.exe	33
PID 1992 wrote to memory of 572	1992	e1f2770b0800f84112bf91ca0847a4d945910a27f8c1285b376c8d771f34f110.exe	33
PID 2112 wrote to memory of 2812	2112	Unicorn-17965.exe	34
PID 2112 wrote to memory of 2812	2112	Unicorn-17965.exe	34
PID 2112 wrote to memory of 2812	2112	Unicorn-17965.exe	34
PID 2112 wrote to memory of 2812	2112	Unicorn-17965.exe	34
PID 2052 wrote to memory of 2736	2052	Unicorn-4010.exe	35
PID 2052 wrote to memory of 2736	2052	Unicorn-4010.exe	35
PID 2052 wrote to memory of 2736	2052	Unicorn-4010.exe	35
PID 2052 wrote to memory of 2736	2052	Unicorn-4010.exe	35
PID 572 wrote to memory of 2956	572	Unicorn-40828.exe	36
PID 572 wrote to memory of 2956	572	Unicorn-40828.exe	36
PID 572 wrote to memory of 2956	572	Unicorn-40828.exe	36
PID 572 wrote to memory of 2956	572	Unicorn-40828.exe	36
PID 1992 wrote to memory of 2660	1992	e1f2770b0800f84112bf91ca0847a4d945910a27f8c1285b376c8d771f34f110.exe	37
PID 1992 wrote to memory of 2660	1992	e1f2770b0800f84112bf91ca0847a4d945910a27f8c1285b376c8d771f34f110.exe	37
PID 1992 wrote to memory of 2660	1992	e1f2770b0800f84112bf91ca0847a4d945910a27f8c1285b376c8d771f34f110.exe	37
PID 1992 wrote to memory of 2660	1992	e1f2770b0800f84112bf91ca0847a4d945910a27f8c1285b376c8d771f34f110.exe	37
PID 2736 wrote to memory of 2356	2736	Unicorn-54052.exe	38
PID 2736 wrote to memory of 2356	2736	Unicorn-54052.exe	38
PID 2736 wrote to memory of 2356	2736	Unicorn-54052.exe	38
PID 2736 wrote to memory of 2356	2736	Unicorn-54052.exe	38
PID 2052 wrote to memory of 2344	2052	Unicorn-4010.exe	39
PID 2052 wrote to memory of 2344	2052	Unicorn-4010.exe	39
PID 2052 wrote to memory of 2344	2052	Unicorn-4010.exe	39
PID 2052 wrote to memory of 2344	2052	Unicorn-4010.exe	39
PID 2660 wrote to memory of 1104	2660	Unicorn-31009.exe	40
PID 2660 wrote to memory of 1104	2660	Unicorn-31009.exe	40
PID 2660 wrote to memory of 1104	2660	Unicorn-31009.exe	40
PID 2660 wrote to memory of 1104	2660	Unicorn-31009.exe	40
PID 2956 wrote to memory of 1584	2956	Unicorn-4851.exe	41
PID 2956 wrote to memory of 1584	2956	Unicorn-4851.exe	41
PID 2956 wrote to memory of 1584	2956	Unicorn-4851.exe	41
PID 2956 wrote to memory of 1584	2956	Unicorn-4851.exe	41
PID 572 wrote to memory of 1516	572	Unicorn-40828.exe	42
PID 572 wrote to memory of 1516	572	Unicorn-40828.exe	42
PID 572 wrote to memory of 1516	572	Unicorn-40828.exe	42
PID 572 wrote to memory of 1516	572	Unicorn-40828.exe	42
PID 2812 wrote to memory of 316	2812	Unicorn-50523.exe	43
PID 2812 wrote to memory of 316	2812	Unicorn-50523.exe	43
PID 2812 wrote to memory of 316	2812	Unicorn-50523.exe	43
PID 2812 wrote to memory of 316	2812	Unicorn-50523.exe	43
PID 1992 wrote to memory of 2128	1992	e1f2770b0800f84112bf91ca0847a4d945910a27f8c1285b376c8d771f34f110.exe	44
PID 1992 wrote to memory of 2128	1992	e1f2770b0800f84112bf91ca0847a4d945910a27f8c1285b376c8d771f34f110.exe	44
PID 1992 wrote to memory of 2128	1992	e1f2770b0800f84112bf91ca0847a4d945910a27f8c1285b376c8d771f34f110.exe	44
PID 1992 wrote to memory of 2128	1992	e1f2770b0800f84112bf91ca0847a4d945910a27f8c1285b376c8d771f34f110.exe	44
PID 2112 wrote to memory of 624	2112	Unicorn-17965.exe	45
PID 2112 wrote to memory of 624	2112	Unicorn-17965.exe	45
PID 2112 wrote to memory of 624	2112	Unicorn-17965.exe	45
PID 2112 wrote to memory of 624	2112	Unicorn-17965.exe	45
PID 2356 wrote to memory of 2972	2356	Unicorn-47389.exe	46
PID 2356 wrote to memory of 2972	2356	Unicorn-47389.exe	46
PID 2356 wrote to memory of 2972	2356	Unicorn-47389.exe	46
PID 2356 wrote to memory of 2972	2356	Unicorn-47389.exe	46

C:\Users\Admin\AppData\Local\Temp\e1f2770b0800f84112bf91ca0847a4d945910a27f8c1285b376c8d771f34f110.exe
"C:\Users\Admin\AppData\Local\Temp\e1f2770b0800f84112bf91ca0847a4d945910a27f8c1285b376c8d771f34f110.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17965.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17965.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4010.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4010.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54052.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47389.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12677.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14374.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41513.exe
        8⤵
        Executes dropped EXE
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43505.exe
        9⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16457.exe
        9⤵
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63280.exe
        9⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27354.exe
        8⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
        9⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2436.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
        8⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14534.exe
        8⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59932.exe
        8⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54512.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10942.exe
        8⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20322.exe
        8⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10434.exe
        8⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10141.exe
        8⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34526.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26437.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5869.exe
        7⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43396.exe
        7⤵
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26989.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28057.exe
        7⤵
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63748.exe
        8⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9522.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17818.exe
        8⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43883.exe
        7⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60237.exe
        8⤵
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43288.exe
        8⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
        7⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14534.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59932.exe
        7⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37687.exe
        6⤵
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40657.exe
        7⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10448.exe
        8⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25160.exe
        8⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
        7⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13212.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42427.exe
        8⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28699.exe
        8⤵
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8592.exe
        7⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10231.exe
        7⤵
        
        PID:4868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13469.exe
        6⤵
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17771.exe
        6⤵
        
        PID:3160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35505.exe
        6⤵
        
        PID:4104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57773.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46855.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33039.exe
        7⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40657.exe
        8⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26702.exe
        9⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8016.exe
        9⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60459.exe
        9⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
        8⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43288.exe
        8⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44331.exe
        7⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
        7⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59308.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61222.exe
        6⤵
        
        PID:636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
        7⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59982.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3060.exe
        7⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
        6⤵
        
        PID:3116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44560.exe
        6⤵
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1950.exe
        6⤵
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8816.exe
        6⤵
        
        PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5455.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33039.exe
        6⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45883.exe
        7⤵
        
        PID:832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39067.exe
        7⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4569.exe
        7⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29564.exe
        7⤵
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42517.exe
        6⤵
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64099.exe
        6⤵
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18951.exe
        6⤵
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41123.exe
        6⤵
        
        PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15669.exe
        5⤵
        
        PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17771.exe
        5⤵
        
        PID:3184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19359.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46836.exe
        5⤵
        
        PID:5372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60004.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28438.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59141.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27673.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45502.exe
        7⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
        8⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
        7⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10434.exe
        7⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20898.exe
        7⤵
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6354.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
        7⤵
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8669.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3060.exe
        7⤵
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59237.exe
        6⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26702.exe
        7⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25160.exe
        7⤵
        
        PID:4280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26437.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20491.exe
        6⤵
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60843.exe
        6⤵
        
        PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40536.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8508.exe
        6⤵
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
        7⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27449.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26952.exe
        7⤵
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60042.exe
        6⤵
        
        PID:4848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59922.exe
        6⤵
        
        PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50126.exe
        5⤵
        
        PID:1364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11069.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23687.exe
        6⤵
        
        PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26437.exe
        5⤵
        
        PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36827.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26430.exe
        5⤵
        
        PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17704.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60018.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44860.exe
        6⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10448.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22432.exe
        7⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63113.exe
        7⤵
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11869.exe
        6⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26702.exe
        7⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61346.exe
        7⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8669.exe
        7⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3060.exe
        7⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
        6⤵
        
        PID:2648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10434.exe
        6⤵
        
        PID:4332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18286.exe
        6⤵
        
        PID:4464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57091.exe
        5⤵
        
        PID:2836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40250.exe
        6⤵
        
        PID:4152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11483.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28699.exe
        6⤵
        
        PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
        5⤵
        
        PID:3376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47567.exe
        6⤵
        
        PID:3848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30130.exe
        6⤵
        
        PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40369.exe
        5⤵
        
        PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9153.exe
        5⤵
        
        PID:4200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25820.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10350.exe
        5⤵
        
        PID:2476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
        5⤵
        
        PID:3312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10537.exe
        5⤵
        
        PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26952.exe
        5⤵
        
        PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56781.exe
      4⤵
      PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48455.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
        6⤵
        
        PID:2792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38695.exe
        6⤵
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26952.exe
        6⤵
        
        PID:4632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25351.exe
        6⤵
        
        PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
        5⤵
        
        PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40620.exe
        5⤵
        
        PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1236.exe
      4⤵
      PID:3176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25180.exe
      4⤵
      PID:4672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25305.exe
      4⤵
      PID:5416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50523.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50523.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37021.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9034.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28088.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48851.exe
        7⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
        8⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40620.exe
        8⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
        7⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8669.exe
        7⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3060.exe
        7⤵
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20791.exe
        6⤵
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44541.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42427.exe
        7⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28699.exe
        7⤵
        
        PID:3592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
        6⤵
        
        PID:1296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14534.exe
        6⤵
        
        PID:4816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59932.exe
        6⤵
        
        PID:5660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35160.exe
        5⤵
        
        PID:1208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26437.exe
        5⤵
        
        PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35894.exe
        5⤵
        
        PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1751.exe
        5⤵
        
        PID:4556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4929.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59691.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26776.exe
        6⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26702.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50825.exe
        7⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
        6⤵
        
        PID:3092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8669.exe
        6⤵
        
        PID:4996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3060.exe
        6⤵
        
        PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39634.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
        6⤵
        
        PID:3440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8669.exe
        6⤵
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3060.exe
        6⤵
        
        PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
        5⤵
        
        PID:3264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27617.exe
        5⤵
        
        PID:4180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57659.exe
        5⤵
        
        PID:5472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20696.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7657.exe
        5⤵
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47302.exe
        6⤵
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7651.exe
        6⤵
        
        PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
        5⤵
        
        PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62028.exe
        5⤵
        
        PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25899.exe
        5⤵
        
        PID:4812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8627.exe
      4⤵
      PID:2116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11076.exe
        5⤵
        
        PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6532.exe
        5⤵
        
        PID:4656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62732.exe
        5⤵
        
        PID:5728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17771.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50771.exe
      4⤵
      PID:4364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10671.exe
      4⤵
      PID:5980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64632.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64632.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39019.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29515.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43293.exe
        6⤵
        
        PID:1356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10448.exe
        7⤵
        
        PID:3636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28134.exe
        5⤵
        
        PID:2556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
        5⤵
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37026.exe
        5⤵
        
        PID:4468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39651.exe
        5⤵
        
        PID:5820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16172.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63748.exe
        5⤵
        
        PID:2504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
        6⤵
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8669.exe
        6⤵
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3060.exe
        6⤵
        
        PID:5828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
        5⤵
        
        PID:888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8669.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34389.exe
        5⤵
        
        PID:5608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57618.exe
      4⤵
      PID:2148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47567.exe
        5⤵
        
        PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58764.exe
        5⤵
        
        PID:4768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28699.exe
        5⤵
        
        PID:5084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29123.exe
      4⤵
      PID:3544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18087.exe
      4⤵
      PID:4224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58655.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58655.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9639.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48851.exe
        5⤵
        
        PID:812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8669.exe
        5⤵
        
        PID:4980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3060.exe
        5⤵
        
        PID:5864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24677.exe
      4⤵
      PID:2840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24725.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59712.exe
        5⤵
        
        PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44699.exe
        5⤵
        
        PID:5192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26188.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1769.exe
      4⤵
      PID:4384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1751.exe
      4⤵
      PID:600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19925.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19925.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40657.exe
      4⤵
      PID:2000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43288.exe
      4⤵
      PID:5080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52955.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52955.exe
    3⤵
    PID:1268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18301.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18301.exe
    3⤵
    PID:3168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46305.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46305.exe
    3⤵
    PID:4340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35424.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35424.exe
    3⤵
    PID:5696
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40828.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40828.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39019.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28088.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40657.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
        7⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43257.exe
        7⤵
        
        PID:4256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26074.exe
        6⤵
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
        7⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8669.exe
        7⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3060.exe
        7⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
        6⤵
        
        PID:1740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23326.exe
        6⤵
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe
        6⤵
        
        PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10718.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57818.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43980.exe
        7⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29829.exe
        7⤵
        
        PID:4160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
        6⤵
        
        PID:2296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4569.exe
        6⤵
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26952.exe
        6⤵
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25351.exe
        6⤵
        
        PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1527.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26437.exe
        5⤵
        
        PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18951.exe
        5⤵
        
        PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41123.exe
        5⤵
        
        PID:5324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29131.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2992
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 240
        6⤵
        Program crash
        
        PID:1684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
        5⤵
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33151.exe
        6⤵
        
        PID:4124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45949.exe
        6⤵
        
        PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22724.exe
        5⤵
        
        PID:4440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9364.exe
        5⤵
        
        PID:4584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62580.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26776.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59897.exe
        5⤵
        
        PID:3832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11069.exe
        6⤵
        
        PID:3872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11061.exe
        6⤵
        
        PID:928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1769.exe
        5⤵
        
        PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8728.exe
        5⤵
        
        PID:6092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59235.exe
      4⤵
      PID:3024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37304.exe
      4⤵
      PID:4040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54871.exe
      4⤵
      PID:5036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60462.exe
      4⤵
      PID:5736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17155.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17155.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55355.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10407.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8892.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
        6⤵
        
        PID:2532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27449.exe
        6⤵
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26952.exe
        6⤵
        
        PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54180.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
        5⤵
        
        PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10434.exe
        5⤵
        
        PID:4316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18286.exe
        5⤵
        
        PID:4432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56764.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48851.exe
        5⤵
        
        PID:2804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26702.exe
        6⤵
        
        PID:3524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25160.exe
        6⤵
        
        PID:4572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
        5⤵
        
        PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43288.exe
        5⤵
        
        PID:4752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34526.exe
      4⤵
      PID:1144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26437.exe
      4⤵
      PID:3344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24649.exe
      4⤵
      PID:4704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21167.exe
      4⤵
      PID:5332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32696.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32696.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45192.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43293.exe
        5⤵
        
        PID:1348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
        5⤵
        
        PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8669.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-787.exe
        5⤵
        
        PID:5452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55031.exe
      4⤵
      PID:1748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37026.exe
      4⤵
      PID:4488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9364.exe
      4⤵
      PID:4748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60879.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60879.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43293.exe
      4⤵
      PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10448.exe
        5⤵
        
        PID:3628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
      4⤵
      PID:3360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21751.exe
      4⤵
      PID:4164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
      4⤵
      PID:3412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8669.exe
      4⤵
      PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3060.exe
      4⤵
      PID:5780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1236.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1236.exe
    3⤵
    PID:3232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47567.exe
      4⤵
      PID:3820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62253.exe
      4⤵
      PID:5140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32234.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32234.exe
    3⤵
    PID:3720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13591.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13591.exe
    3⤵
    PID:4408
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31009.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31009.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62957.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62957.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56123.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42421.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9499.exe
        6⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26776.exe
        7⤵
        
        PID:348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-171.exe
        8⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43803.exe
        8⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28699.exe
        8⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63323.exe
        7⤵
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11497.exe
        7⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2176.exe
        7⤵
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6910.exe
        6⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19456.exe
        7⤵
        
        PID:5796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10068.exe
        6⤵
        
        PID:3672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16402.exe
        6⤵
        
        PID:4688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20898.exe
        6⤵
        
        PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8658.exe
        5⤵
        
        PID:2064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25604.exe
        5⤵
        
        PID:2176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64099.exe
        5⤵
        
        PID:3700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1769.exe
        5⤵
        
        PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1751.exe
        5⤵
        
        PID:4552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40152.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44860.exe
        5⤵
        
        PID:2704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11869.exe
        5⤵
        
        PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58234.exe
        5⤵
        
        PID:3736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34622.exe
        5⤵
        
        PID:1708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5289.exe
      4⤵
      PID:3044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47567.exe
        5⤵
        
        PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30130.exe
        5⤵
        
        PID:5252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26437.exe
      4⤵
      PID:3336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20491.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38233.exe
      4⤵
      PID:5352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3201.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3201.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42229.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33039.exe
        5⤵
        
        PID:2628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40838.exe
        6⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
        7⤵
        
        PID:300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36168.exe
        7⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46368.exe
        7⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27617.exe
        6⤵
        
        PID:1916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57659.exe
        6⤵
        
        PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39634.exe
        5⤵
        
        PID:1092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27745.exe
        6⤵
        
        PID:3548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60471.exe
        6⤵
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62732.exe
        6⤵
        
        PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9269.exe
        5⤵
        
        PID:3668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14534.exe
        5⤵
        
        PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59932.exe
        5⤵
        
        PID:5708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61606.exe
      4⤵
      PID:2008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
        5⤵
        
        PID:3484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27449.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29564.exe
        5⤵
        
        PID:5648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
      4⤵
      PID:3368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53363.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9364.exe
      4⤵
      PID:4800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22258.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22258.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46547.exe
      4⤵
      PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
        5⤵
        
        PID:3404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8669.exe
        5⤵
        
        PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3060.exe
        5⤵
        
        PID:5848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
      4⤵
      PID:3240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62028.exe
      4⤵
      PID:4612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57659.exe
      4⤵
      PID:5480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48586.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48586.exe
    3⤵
    PID:2924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17771.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17771.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56739.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56739.exe
    3⤵
    PID:4604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46836.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46836.exe
    3⤵
    PID:5360
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36756.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36756.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55547.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55547.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61144.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48851.exe
        5⤵
        
        PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
        5⤵
        
        PID:1932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15086.exe
        6⤵
        
        PID:3660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62253.exe
        6⤵
        
        PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4569.exe
        5⤵
        
        PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63878.exe
        5⤵
        
        PID:5400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20791.exe
      4⤵
      PID:308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
        5⤵
        
        PID:3492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8669.exe
        5⤵
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3060.exe
        5⤵
        
        PID:5840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
      4⤵
      PID:2884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22360.exe
      4⤵
      PID:4188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8222.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8222.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26776.exe
      4⤵
      PID:2436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12093.exe
      4⤵
      PID:3788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13212.exe
        5⤵
        
        PID:3760
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3788 -s 236
        5⤵
        Program crash
        
        PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47233.exe
      4⤵
      PID:3780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43288.exe
      4⤵
      PID:4236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53370.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53370.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45970.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45970.exe
    3⤵
    PID:4032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7737.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7737.exe
    3⤵
    PID:4596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59143.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59143.exe
    3⤵
    PID:6076
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30088.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30088.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10023.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10023.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60013.exe
      4⤵
      PID:1800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26776.exe
        5⤵
        
        PID:1852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26593.exe
        6⤵
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56371.exe
        6⤵
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21086.exe
        6⤵
        
        PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12861.exe
        5⤵
        
        PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8669.exe
        5⤵
        
        PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3060.exe
        5⤵
        
        PID:5856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39634.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40105.exe
      4⤵
      PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61152.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56168.exe
        5⤵
        
        PID:4872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14457.exe
      4⤵
      PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1566.exe
      4⤵
      PID:5088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23427.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23427.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
    3⤵
    PID:3248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33315.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33315.exe
    3⤵
    PID:4696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56187.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56187.exe
    3⤵
    PID:5808
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49710.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49710.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26776.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26776.exe
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56748.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56748.exe
    3⤵
    PID:4084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13954.exe
      4⤵
      PID:3756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42427.exe
      4⤵
      PID:4668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28699.exe
      4⤵
      PID:4116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34017.exe
      4⤵
      PID:5672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41437.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41437.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17818.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17818.exe
    3⤵
    PID:2348
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51100.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51100.exe
  2⤵
  PID:2596
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16304.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16304.exe
  2⤵
  PID:4052
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58152.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58152.exe
  2⤵
  PID:4932
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35523.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35523.exe
  2⤵
  PID:5284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-16457.exe

Filesize
468KB

MD5
73c8037e30caa9bac43b53b8ac32a38e

SHA1
ce2737e21e4fec0e7b2df8a3d8d676b7775e3046

SHA256
17fd5a5f5e4ddcb619ec5c64d9c8cf149d403d100c00f25110dcf569920d0fca

SHA512
24baf9dc1d9e56a487e59d9bb6ab6323d2c9588033670abcee18b5e11e53f3cc51ffe09b7d48f8860e425056b2eae09aa7e818710b59c46ee896ab5a2edd4c4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36756.exe

Filesize
468KB

MD5
ea8a85385731b11536e76697408d78d4

SHA1
aac8ed67c1352553b2da0bacc1efb155187ac8db

SHA256
e2687fb4b0bec4072bd6ebef00276d097901b0b2b1af233a26b0e2047e4dc029

SHA512
79018b1a36ba6edd482bc346be4a82c33b71e2a64f707c492ec1c69c5cb294488ef879658f1d2a7ee57390307cbe07dc545a1b48e0c5445a9b012a24df3632bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40152.exe

Filesize
468KB

MD5
d8671fc7e5630a34f32fecb58f305f07

SHA1
543262e88dbcdb012846d894b4755217892685d5

SHA256
aa71c5bfc8d0d5302570bb08c6e45da2fb3506452c47bf63386262d58facbfa6

SHA512
359cb977466de232e47eb850670f42c71b560eb61700133479a1fcfbd73d1ff7afde8a61670217c60fc3062319b219bf25e0746bb03f59221f42c240f55f4bdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64632.exe

Filesize
468KB

MD5
ea718d3b0d54ffe32c838f39b2243640

SHA1
467ff8972331be101c3a6cc74ba96143bd27771d

SHA256
25db454fb02b18cc65deffb04f132d817d3e6cb3ea508e98f917df9ce54829ef

SHA512
c23decb230c50e5f807830630e32d0eb097380dd172087fa0b5260612e9de13119f17cfd530a6c5accf243188a3721f5a35e8656375422f9a26650d7a747b8d5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12677.exe

Filesize
468KB

MD5
0f4194b18a5b06a07ad43d188c8cc82a

SHA1
472bfd36e010ff306997a441e09ca67372caa173

SHA256
6ce44884c5fc8d0264e98d469da4b9384e35a01abd43f502ded456210994192d

SHA512
8d4894ca48b2662b95f5e9afacabd6a6c56b88e5e479939e26bf5072f6066ff84d8d9a816112585f47b6d00d95284eacf0289ebd3ee661a5ce0854db523ccff4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17155.exe

Filesize
468KB

MD5
dc5e802af2c0925ce0b29921639c2875

SHA1
9b87ddc8a5430c8c30a9e0bf39c0bd5802ed39f0

SHA256
7494891fbdded9b396514a140a58df737761733d11348f19d17bd28e59785552

SHA512
d30ab74caab48136c64638c6ce20de5a44b4d044925e2edcd6df8717a2e439b65740347cb973528ea39465662b8ead245b67e9ced4cc2d8e837d2d6ec6585f30

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17704.exe

Filesize
468KB

MD5
0686574a6f0f853d94b3296f6abe77ce

SHA1
dffa291f5678e2ec4be9cc8b589479816609953e

SHA256
be31fc4165b9140aac82bdd3f6eacc4e2acbe6a811a43a50f7d9af4f8eb8ac8f

SHA512
6017233f719ba2f27e241d124326cafe3c3678c14628f0c45f4677880819e85d0a02eea28de2bb2d67badee7dc6b0a5b50e32670dce9ced5b93e1f4ea9e0c82e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17965.exe

Filesize
468KB

MD5
1243c19a7893457acb95bb9a40605e55

SHA1
77488575783afe64160c99713c0ef16887c94195

SHA256
ae146d243e3806f1a07c6092223e80a8b12ffe3cfd92bb3181a7f5898d595204

SHA512
d5e4dfdf05f4a051538beafe9a15704a19687d92e0ab2cc8e54e8de0b0ef6eba8a4b1f97af6b388bbf6bc52a82c0a7d4e260ddca0d3868d710a2d2bb45513025

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28438.exe

Filesize
468KB

MD5
bd301f3d1ae14e8ad4f80866b843546e

SHA1
f47ccfe0aba60821c5c567239f4369caa03d607f

SHA256
9e0f6f07761b15b774e7407085ebdbe218bed086b9df1fd9890a32cdd334340c

SHA512
6ffc9fe92f0eab6f0dfde5aea9c66ae51d36fcc6a6c79049057ffaac568c7b023548a3af8fd4feec633060899955cc0fb9de449c6bfe8b7a5c18633eac20242d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe

Filesize
468KB

MD5
d8ddb68a3b558106c7947dcafe59686b

SHA1
28555cdbf16b4d1d999e4e9a29ad8d3abbd297f3

SHA256
87a7c1dc10af997d22ecf1f8836e909f07005846216c627ec8edf569481034e5

SHA512
a006cdac35c5f7872228cb0355a7b77b01fc0fbaab7252b12f8c6ae17f232b87d7b06593d3e148f13bb2ceb3a5a1649b013a38b93624949dcb0f98381c39a1c4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31009.exe

Filesize
468KB

MD5
d599081ad984cd1b8fea9b167b902225

SHA1
de30c7c11d4a13d375f24a47060b188b36ca6dcc

SHA256
67931a16a9e561695e640808fe26c5e8cc0c5425df45ebe771f79ef60b42f35d

SHA512
de7e8398cce536790e95e524f604357ad3295b799b9aae812e875a4ab2f7c42417b106a44bfd2289b6588c5332c79cfec4d5a49091d52b478534dd9910e7552d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37021.exe

Filesize
468KB

MD5
0268cc3c7a64dafc316bebb39c2407e9

SHA1
5826771cc41828c004c774f3fa6eee47b5af9288

SHA256
4d943bbe146b45692c9eb35ff77353d3e032e26b6f74f7b446f9930402133db9

SHA512
9b0228a68fe51ee7eb56108c9ac199047569a4ed6d8cab428c0e812b29d3a68c639a45c463f51276cdef69e1af4d8412d1656d64ea866ba5233ffd3ac12d0bc4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4010.exe

Filesize
468KB

MD5
7e7c745fac952a55e88b7ae9b1438599

SHA1
354b04c47f1ff93de1aab4adcac8077853139485

SHA256
6428fb10dd3ef8ac0ecee8f9b4b98257d3b76c4569c4ba2842cdb447340a11c1

SHA512
dbec051456932f1f51f5bc4d2bf9b5547115752a761aba5699632496c9588fab69a514253435ab5daca164e63b23902320e7c26c70709ab64920d26d20cbae40

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40828.exe

Filesize
468KB

MD5
4af54a8d9c6d25e5fde89cbcfe2d21dd

SHA1
4b215c5233d2ae90e1f93ce54ea398a44e02094c

SHA256
d880c5bd8e6e69b79030192da065170669077feae9759790a2602fa0c85caa01

SHA512
884ff1f33da21564e7488befe1b3e6070de0732ce80d46a411f485964ce657a7fc809871f83efd3526af9340582e94fac2c6be70f28ab2448a5a0d047e553e63

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47389.exe

Filesize
468KB

MD5
3686c23de43019cc7c109de956114392

SHA1
9118c7ed73ccc95f5b40132cd7b30f30a7836b27

SHA256
23872ad427ca0bf7c1f3dcf903fc81a2e04900aafae4d01b93ddd9f238910c79

SHA512
ccfaba0d614a4cfcedd3049db057613782e40f3452c0bbf4ae143248df64033866b08c4e81638e18e1367d82241c5c557ad32800379d658d8d3af1a4c2558779

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe

Filesize
468KB

MD5
ac5dceeda40f642464063ef32e7f37cf

SHA1
a28973b98ec3974b90ac9b773e55b66ae1bd1e89

SHA256
a570458342f3bc16b5c917f50e6fb5f0ce24277d0c7559fcf157242c51d444d1

SHA512
0188af94a8597e648940641a975cccb0e4de6c51f221744fe40f503b4ee1ab160c64d126529df804f9324f9d25b7c2595d8f9af3e1322e1f9ba0a029176362ba

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-50523.exe

Filesize
468KB

MD5
b47ca8fb7928715835c98af9fdacc859

SHA1
b3522da80bc9bf8d74af370a7dfd30924080cc3e

SHA256
39bf013e86589dc30469d4e503c0c2604b4b929d33199390511e144eb73e5b81

SHA512
892a83c8cd4253e090564de9e24b2ae1717e1dfb8385d8bf206c71a41427e39c345e8a7eacd5247226a4f4155c26ddcd4128774395f71a0e8cd83370d6f2c56a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54052.exe

Filesize
468KB

MD5
2e34b62894311cae34cbf5900fb2ef96

SHA1
3fef36432329ba36f7302f518af34f10da888348

SHA256
65a2577e54d37dc2ef9bf929e7a2c62743d0760a85e5c26a7e93d2f989a7a51d

SHA512
da5a411704af37eee35800767304324e9d639e55a72d731f8711449673e68f66f1b68d80b5773468f01fd9ff62839082fa1e712ecfecaf0565fb64832d75d70b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57773.exe

Filesize
468KB

MD5
c2da86bb720af106a5c927b9ea9ddfc5

SHA1
aa0aaebe9f9b8aa4b0a81ac7d4220e86526c85bb

SHA256
709ed4c2b8ce5497da4137d8006671183826b9b7c8cce50dd0139713abeef454

SHA512
e969396d9c9ad08a9a8400e6ec246946b2ae592ebfd61e0455cad7e9b2dbbe2c06bcbcc05848d12f091bbc41442095ceaa1475f3593c3e5cec2a875dcd8a944c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60004.exe

Filesize
468KB

MD5
b7b73486e25d3ef311f46b6350dc5707

SHA1
c9f7cff917468596d0bb01adefa074d4b2a9c284

SHA256
df7b48ec97f4980683fb13b372414376facfe4337fbc732f9014d72f81839b5c

SHA512
41b44c2f801cd59b996e3a5a10ce967057349370e7f0e638cf44608d264e3c0e9ea4044d9c505d4ae16d421074dd514fe8651e2ad098ec5c16d5c89da1694c4f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62957.exe

Filesize
468KB

MD5
648f85be7eb7a789b417c84625f5c3f1

SHA1
bb615c194fb70e435b3f3340ce7c89d101055b8b

SHA256
001f8a9b955b73fadba7967dc68fde225fac2d10cfb04cbcc14221a4b284e300

SHA512
c5b22cb3b72e9b783c242f3adfdc0096d19f3798abd370d29b40aa77b83286fa1aa82296201ffd3ec1fe3163370f9498b03137415caf6d89dcd688bb7235b1b7

Download Submit