4beb39381177c72c0b18ea640ee390e265a23e7e12729ec92da71652473b60cd

Analysis

max time kernel
120s
max time network
20s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
12-10-2024 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4beb39381177c72c0b18ea640ee390e265a23e7e12729ec92da71652473b60cdN.exe
Size

468KB
MD5

a14bbf022850278c07c7c9d6116d63d0
SHA1

7e95722b2785eb8211e3160cbbd0254d3338019f
SHA256

4beb39381177c72c0b18ea640ee390e265a23e7e12729ec92da71652473b60cd
SHA512

0b934877a6a519553e367dcd03af67f91d9520ebbf3480000c5b921770f3ccd0043f2dcfa956b7c380317dc36af40adf966fe226f18b1c6a448d7cda3a79fbab
SSDEEP

3072:0F9aogBYj28I2bYeKD3yqf8/oCbryIp8PmHxvTHdbpTZhmBNzTlI:0FUoXXI2BKTyqf10hBbpNcBNz

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2552	Unicorn-63473.exe
2868	Unicorn-64288.exe
2916	Unicorn-6597.exe
2740	Unicorn-44226.exe
2776	Unicorn-25512.exe
2536	Unicorn-59092.exe
1048	Unicorn-29042.exe
2416	Unicorn-34325.exe
2112	Unicorn-54916.exe
2224	Unicorn-17605.exe
3064	Unicorn-63276.exe
2952	Unicorn-57879.exe
1200	Unicorn-58144.exe
2016	Unicorn-58144.exe
1096	Unicorn-52014.exe
2260	Unicorn-5518.exe
368	Unicorn-2181.exe
848	Unicorn-51595.exe
2412	Unicorn-7033.exe
1244	Unicorn-31559.exe
388	Unicorn-50208.exe
2524	Unicorn-34579.exe
568	Unicorn-31258.exe
2688	Unicorn-43510.exe
2376	Unicorn-16074.exe
2680	Unicorn-61745.exe
1620	Unicorn-32877.exe
1608	Unicorn-33142.exe
2288	Unicorn-14951.exe
2852	Unicorn-1216.exe
2844	Unicorn-34878.exe
2928	Unicorn-48409.exe
2876	Unicorn-20589.exe
2440	Unicorn-57708.exe
900	Unicorn-12036.exe
2616	Unicorn-45456.exe
2808	Unicorn-936.exe
1292	Unicorn-41969.exe
3056	Unicorn-42222.exe
832	Unicorn-43706.exe
1744	Unicorn-21824.exe
2188	Unicorn-62363.exe
2080	Unicorn-3716.exe
1776	Unicorn-22845.exe
660	Unicorn-21990.exe
2580	Unicorn-6312.exe
2420	Unicorn-59862.exe
112	Unicorn-16975.exe
1372	Unicorn-55202.exe
2008	Unicorn-26349.exe
1656	Unicorn-26614.exe
1512	Unicorn-51865.exe
1596	Unicorn-30625.exe
3012	Unicorn-39058.exe
2804	Unicorn-39058.exe
2944	Unicorn-60225.exe
2880	Unicorn-35550.exe
2572	Unicorn-6275.exe
1680	Unicorn-11875.exe
1352	Unicorn-22810.exe
1136	Unicorn-31741.exe
1020	Unicorn-1106.exe
2004	Unicorn-48269.exe
2488	Unicorn-35441.exe

Loads dropped DLL 64 IoCs

pid	Process
2792	4beb39381177c72c0b18ea640ee390e265a23e7e12729ec92da71652473b60cdN.exe
2792	4beb39381177c72c0b18ea640ee390e265a23e7e12729ec92da71652473b60cdN.exe
2552	Unicorn-63473.exe
2552	Unicorn-63473.exe
2792	4beb39381177c72c0b18ea640ee390e265a23e7e12729ec92da71652473b60cdN.exe
2792	4beb39381177c72c0b18ea640ee390e265a23e7e12729ec92da71652473b60cdN.exe
2868	Unicorn-64288.exe
2868	Unicorn-64288.exe
2552	Unicorn-63473.exe
2916	Unicorn-6597.exe
2552	Unicorn-63473.exe
2792	4beb39381177c72c0b18ea640ee390e265a23e7e12729ec92da71652473b60cdN.exe
2792	4beb39381177c72c0b18ea640ee390e265a23e7e12729ec92da71652473b60cdN.exe
2916	Unicorn-6597.exe
2740	Unicorn-44226.exe
2740	Unicorn-44226.exe
2868	Unicorn-64288.exe
2868	Unicorn-64288.exe
1048	Unicorn-29042.exe
1048	Unicorn-29042.exe
2916	Unicorn-6597.exe
2916	Unicorn-6597.exe
2792	4beb39381177c72c0b18ea640ee390e265a23e7e12729ec92da71652473b60cdN.exe
2792	4beb39381177c72c0b18ea640ee390e265a23e7e12729ec92da71652473b60cdN.exe
2776	Unicorn-25512.exe
2536	Unicorn-59092.exe
2776	Unicorn-25512.exe
2536	Unicorn-59092.exe
2552	Unicorn-63473.exe
2552	Unicorn-63473.exe
2416	Unicorn-34325.exe
2416	Unicorn-34325.exe
2740	Unicorn-44226.exe
2740	Unicorn-44226.exe
2224	Unicorn-17605.exe
2224	Unicorn-17605.exe
1048	Unicorn-29042.exe
1048	Unicorn-29042.exe
2112	Unicorn-54916.exe
2112	Unicorn-54916.exe
2868	Unicorn-64288.exe
2868	Unicorn-64288.exe
2792	4beb39381177c72c0b18ea640ee390e265a23e7e12729ec92da71652473b60cdN.exe
2792	4beb39381177c72c0b18ea640ee390e265a23e7e12729ec92da71652473b60cdN.exe
2952	Unicorn-57879.exe
2952	Unicorn-57879.exe
1200	Unicorn-58144.exe
1200	Unicorn-58144.exe
2536	Unicorn-59092.exe
2536	Unicorn-59092.exe
1096	Unicorn-52014.exe
1096	Unicorn-52014.exe
2268	WerFault.exe
2268	WerFault.exe
2268	WerFault.exe
2268	WerFault.exe
2268	WerFault.exe
2268	WerFault.exe
2552	Unicorn-63473.exe
2552	Unicorn-63473.exe
2016	Unicorn-58144.exe
2016	Unicorn-58144.exe
2916	Unicorn-6597.exe
2776	Unicorn-25512.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
2268	3064	WerFault.exe	39
2768	2844	WerFault.exe	60
3204	2804	WerFault.exe	84
4804	3012	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20785.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64081.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29511.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1904.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12586.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28292.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20190.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36942.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65288.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50171.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33846.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45456.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32252.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3376.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25678.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64288.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33846.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58006.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31525.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59423.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57467.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5477.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47224.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43704.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29968.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29968.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45505.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37088.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14883.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-98.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3376.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52864.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13622.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23255.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34493.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28841.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11039.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55915.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17130.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44828.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54333.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60713.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63790.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56473.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46404.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6455.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4563.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9753.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58605.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57321.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57153.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17312.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22810.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12586.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64181.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12258.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2792	4beb39381177c72c0b18ea640ee390e265a23e7e12729ec92da71652473b60cdN.exe
2552	Unicorn-63473.exe
2868	Unicorn-64288.exe
2916	Unicorn-6597.exe
2740	Unicorn-44226.exe
1048	Unicorn-29042.exe
2776	Unicorn-25512.exe
2536	Unicorn-59092.exe
2416	Unicorn-34325.exe
2224	Unicorn-17605.exe
2112	Unicorn-54916.exe
2952	Unicorn-57879.exe
2016	Unicorn-58144.exe
1200	Unicorn-58144.exe
3064	Unicorn-63276.exe
1096	Unicorn-52014.exe
2260	Unicorn-5518.exe
848	Unicorn-51595.exe
2412	Unicorn-7033.exe
368	Unicorn-2181.exe
1244	Unicorn-31559.exe
388	Unicorn-50208.exe
2524	Unicorn-34579.exe
2688	Unicorn-43510.exe
568	Unicorn-31258.exe
2680	Unicorn-61745.exe
2376	Unicorn-16074.exe
1620	Unicorn-32877.exe
1608	Unicorn-33142.exe
2288	Unicorn-14951.exe
2852	Unicorn-1216.exe
2844	Unicorn-34878.exe
2876	Unicorn-20589.exe
2928	Unicorn-48409.exe
2440	Unicorn-57708.exe
2808	Unicorn-936.exe
900	Unicorn-12036.exe
1292	Unicorn-41969.exe
2616	Unicorn-45456.exe
3056	Unicorn-42222.exe
832	Unicorn-43706.exe
1744	Unicorn-21824.exe
2188	Unicorn-62363.exe
2080	Unicorn-3716.exe
1776	Unicorn-22845.exe
660	Unicorn-21990.exe
2420	Unicorn-59862.exe
2580	Unicorn-6312.exe
1372	Unicorn-55202.exe
112	Unicorn-16975.exe
2008	Unicorn-26349.exe
2804	Unicorn-39058.exe
1512	Unicorn-51865.exe
1656	Unicorn-26614.exe
3012	Unicorn-39058.exe
1596	Unicorn-30625.exe
2944	Unicorn-60225.exe
2212	Unicorn-9850.exe
2880	Unicorn-35550.exe
1136	Unicorn-31741.exe
2004	Unicorn-48269.exe
1680	Unicorn-11875.exe
2096	Unicorn-36187.exe
952	Unicorn-7812.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2552	2792	4beb39381177c72c0b18ea640ee390e265a23e7e12729ec92da71652473b60cdN.exe	29
PID 2792 wrote to memory of 2552	2792	4beb39381177c72c0b18ea640ee390e265a23e7e12729ec92da71652473b60cdN.exe	29
PID 2792 wrote to memory of 2552	2792	4beb39381177c72c0b18ea640ee390e265a23e7e12729ec92da71652473b60cdN.exe	29
PID 2792 wrote to memory of 2552	2792	4beb39381177c72c0b18ea640ee390e265a23e7e12729ec92da71652473b60cdN.exe	29
PID 2552 wrote to memory of 2868	2552	Unicorn-63473.exe	30
PID 2552 wrote to memory of 2868	2552	Unicorn-63473.exe	30
PID 2552 wrote to memory of 2868	2552	Unicorn-63473.exe	30
PID 2552 wrote to memory of 2868	2552	Unicorn-63473.exe	30
PID 2792 wrote to memory of 2916	2792	4beb39381177c72c0b18ea640ee390e265a23e7e12729ec92da71652473b60cdN.exe	31
PID 2792 wrote to memory of 2916	2792	4beb39381177c72c0b18ea640ee390e265a23e7e12729ec92da71652473b60cdN.exe	31
PID 2792 wrote to memory of 2916	2792	4beb39381177c72c0b18ea640ee390e265a23e7e12729ec92da71652473b60cdN.exe	31
PID 2792 wrote to memory of 2916	2792	4beb39381177c72c0b18ea640ee390e265a23e7e12729ec92da71652473b60cdN.exe	31
PID 2868 wrote to memory of 2740	2868	Unicorn-64288.exe	32
PID 2868 wrote to memory of 2740	2868	Unicorn-64288.exe	32
PID 2868 wrote to memory of 2740	2868	Unicorn-64288.exe	32
PID 2868 wrote to memory of 2740	2868	Unicorn-64288.exe	32
PID 2552 wrote to memory of 2776	2552	Unicorn-63473.exe	33
PID 2552 wrote to memory of 2776	2552	Unicorn-63473.exe	33
PID 2552 wrote to memory of 2776	2552	Unicorn-63473.exe	33
PID 2552 wrote to memory of 2776	2552	Unicorn-63473.exe	33
PID 2792 wrote to memory of 2536	2792	4beb39381177c72c0b18ea640ee390e265a23e7e12729ec92da71652473b60cdN.exe	35
PID 2792 wrote to memory of 2536	2792	4beb39381177c72c0b18ea640ee390e265a23e7e12729ec92da71652473b60cdN.exe	35
PID 2792 wrote to memory of 2536	2792	4beb39381177c72c0b18ea640ee390e265a23e7e12729ec92da71652473b60cdN.exe	35
PID 2792 wrote to memory of 2536	2792	4beb39381177c72c0b18ea640ee390e265a23e7e12729ec92da71652473b60cdN.exe	35
PID 2916 wrote to memory of 1048	2916	Unicorn-6597.exe	34
PID 2916 wrote to memory of 1048	2916	Unicorn-6597.exe	34
PID 2916 wrote to memory of 1048	2916	Unicorn-6597.exe	34
PID 2916 wrote to memory of 1048	2916	Unicorn-6597.exe	34
PID 2740 wrote to memory of 2416	2740	Unicorn-44226.exe	36
PID 2740 wrote to memory of 2416	2740	Unicorn-44226.exe	36
PID 2740 wrote to memory of 2416	2740	Unicorn-44226.exe	36
PID 2740 wrote to memory of 2416	2740	Unicorn-44226.exe	36
PID 2868 wrote to memory of 2112	2868	Unicorn-64288.exe	37
PID 2868 wrote to memory of 2112	2868	Unicorn-64288.exe	37
PID 2868 wrote to memory of 2112	2868	Unicorn-64288.exe	37
PID 2868 wrote to memory of 2112	2868	Unicorn-64288.exe	37
PID 1048 wrote to memory of 2224	1048	Unicorn-29042.exe	38
PID 1048 wrote to memory of 2224	1048	Unicorn-29042.exe	38
PID 1048 wrote to memory of 2224	1048	Unicorn-29042.exe	38
PID 1048 wrote to memory of 2224	1048	Unicorn-29042.exe	38
PID 2916 wrote to memory of 3064	2916	Unicorn-6597.exe	39
PID 2916 wrote to memory of 3064	2916	Unicorn-6597.exe	39
PID 2916 wrote to memory of 3064	2916	Unicorn-6597.exe	39
PID 2916 wrote to memory of 3064	2916	Unicorn-6597.exe	39
PID 2792 wrote to memory of 2952	2792	4beb39381177c72c0b18ea640ee390e265a23e7e12729ec92da71652473b60cdN.exe	40
PID 2792 wrote to memory of 2952	2792	4beb39381177c72c0b18ea640ee390e265a23e7e12729ec92da71652473b60cdN.exe	40
PID 2792 wrote to memory of 2952	2792	4beb39381177c72c0b18ea640ee390e265a23e7e12729ec92da71652473b60cdN.exe	40
PID 2792 wrote to memory of 2952	2792	4beb39381177c72c0b18ea640ee390e265a23e7e12729ec92da71652473b60cdN.exe	40
PID 2776 wrote to memory of 2016	2776	Unicorn-25512.exe	41
PID 2776 wrote to memory of 2016	2776	Unicorn-25512.exe	41
PID 2776 wrote to memory of 2016	2776	Unicorn-25512.exe	41
PID 2776 wrote to memory of 2016	2776	Unicorn-25512.exe	41
PID 2536 wrote to memory of 1200	2536	Unicorn-59092.exe	42
PID 2536 wrote to memory of 1200	2536	Unicorn-59092.exe	42
PID 2536 wrote to memory of 1200	2536	Unicorn-59092.exe	42
PID 2536 wrote to memory of 1200	2536	Unicorn-59092.exe	42
PID 2552 wrote to memory of 1096	2552	Unicorn-63473.exe	43
PID 2552 wrote to memory of 1096	2552	Unicorn-63473.exe	43
PID 2552 wrote to memory of 1096	2552	Unicorn-63473.exe	43
PID 2552 wrote to memory of 1096	2552	Unicorn-63473.exe	43
PID 2416 wrote to memory of 2260	2416	Unicorn-34325.exe	44
PID 2416 wrote to memory of 2260	2416	Unicorn-34325.exe	44
PID 2416 wrote to memory of 2260	2416	Unicorn-34325.exe	44
PID 2416 wrote to memory of 2260	2416	Unicorn-34325.exe	44

C:\Users\Admin\AppData\Local\Temp\4beb39381177c72c0b18ea640ee390e265a23e7e12729ec92da71652473b60cdN.exe
"C:\Users\Admin\AppData\Local\Temp\4beb39381177c72c0b18ea640ee390e265a23e7e12729ec92da71652473b60cdN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63473.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63473.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64288.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64288.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44226.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34325.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5518.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20589.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26614.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44429.exe
        9⤵
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29968.exe
        9⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12173.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55937.exe
        9⤵
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60557.exe
        9⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12586.exe
        8⤵
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40728.exe
        8⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46759.exe
        8⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2442.exe
        8⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51865.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47169.exe
        8⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29968.exe
        8⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13839.exe
        8⤵
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5169.exe
        8⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49958.exe
        8⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50359.exe
        7⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1153.exe
        7⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe
        7⤵
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45358.exe
        7⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46445.exe
        7⤵
        
        PID:5300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57708.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29062.exe
        7⤵
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5285.exe
        8⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6455.exe
        8⤵
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40985.exe
        8⤵
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49995.exe
        8⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47371.exe
        8⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64884.exe
        7⤵
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51520.exe
        7⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42461.exe
        7⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57467.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63230.exe
        7⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44987.exe
        7⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1106.exe
        6⤵
        Executes dropped EXE
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16685.exe
        7⤵
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26502.exe
        7⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50171.exe
        7⤵
        
        PID:5072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15993.exe
        6⤵
        
        PID:1572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30125.exe
        6⤵
        
        PID:3792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20243.exe
        6⤵
        
        PID:3708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5477.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64448.exe
        6⤵
        
        PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2181.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-936.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7812.exe
        7⤵
        Suspicious use of SetWindowsHookEx
        
        PID:952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32452.exe
        8⤵
        
        PID:680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42542.exe
        8⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58594.exe
        8⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30157.exe
        8⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12586.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56170.exe
        7⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8465.exe
        7⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46164.exe
        7⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33846.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8559.exe
        6⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1998.exe
        7⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5698.exe
        7⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52864.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28577.exe
        7⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27616.exe
        6⤵
        
        PID:1464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63871.exe
        6⤵
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36202.exe
        6⤵
        
        PID:3364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34296.exe
        6⤵
        
        PID:2668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20441.exe
        6⤵
        
        PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43706.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35109.exe
        6⤵
        
        PID:1168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29968.exe
        6⤵
        
        PID:3104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11296.exe
        6⤵
        
        PID:3404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4748.exe
        6⤵
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27328.exe
        6⤵
        
        PID:5388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21465.exe
        5⤵
        
        PID:2220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17390.exe
        5⤵
        
        PID:2252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37985.exe
        5⤵
        
        PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8995.exe
        5⤵
        
        PID:4104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42083.exe
        5⤵
        
        PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59112.exe
        5⤵
        
        PID:5524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54916.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31559.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48269.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53311.exe
        8⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63067.exe
        8⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65500.exe
        8⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41981.exe
        8⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61930.exe
        7⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28841.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61204.exe
        7⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8647.exe
        7⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3376.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36187.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58186.exe
        7⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30130.exe
        8⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27825.exe
        8⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19433.exe
        8⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17312.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7659.exe
        8⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27690.exe
        7⤵
        
        PID:1472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34736.exe
        7⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17130.exe
        7⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5331.exe
        7⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3376.exe
        7⤵
        
        PID:5564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49124.exe
        6⤵
        
        PID:456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49569.exe
        6⤵
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11039.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45505.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58656.exe
        6⤵
        
        PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42222.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59862.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54356.exe
        7⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52600.exe
        8⤵
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20700.exe
        8⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54894.exe
        8⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51346.exe
        8⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6455.exe
        7⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57321.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17130.exe
        7⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46172.exe
        7⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3376.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20785.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33062.exe
        7⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19190.exe
        7⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59423.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51346.exe
        7⤵
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20190.exe
        6⤵
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63186.exe
        6⤵
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8465.exe
        6⤵
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46164.exe
        6⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33846.exe
        6⤵
        
        PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16975.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17235.exe
        6⤵
        
        PID:3368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32252.exe
        6⤵
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1904.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32187.exe
        5⤵
        
        PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53478.exe
        5⤵
        
        PID:3468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe
        5⤵
        
        PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63895.exe
        5⤵
        
        PID:3828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50208.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21990.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11647.exe
        6⤵
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35526.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55915.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53493.exe
        6⤵
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59278.exe
        6⤵
        
        PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12586.exe
        5⤵
        
        PID:2124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56170.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8465.exe
        5⤵
        
        PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10176.exe
        5⤵
        
        PID:4864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25678.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6312.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52035.exe
        5⤵
        
        PID:5036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53815.exe
        5⤵
        
        PID:1976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23521.exe
      4⤵
      PID:2920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48035.exe
      4⤵
      PID:3932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53001.exe
      4⤵
      PID:4124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44532.exe
      4⤵
      PID:4208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63313.exe
      4⤵
      PID:5540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25512.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25512.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58144.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33142.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46510.exe
        6⤵
        
        PID:1756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29968.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17130.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9415.exe
        6⤵
        
        PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46551.exe
        5⤵
        
        PID:2784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20190.exe
        5⤵
        
        PID:3036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46850.exe
        5⤵
        
        PID:3580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8465.exe
        5⤵
        
        PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20441.exe
        5⤵
        
        PID:5744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1216.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17024.exe
        5⤵
        
        PID:2176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6455.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57321.exe
        5⤵
        
        PID:3524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17130.exe
        5⤵
        
        PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26711.exe
        5⤵
        
        PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8612.exe
        5⤵
        
        PID:5988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27805.exe
      4⤵
      PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30556.exe
        5⤵
        
        PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32252.exe
        5⤵
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1904.exe
        5⤵
        
        PID:1492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26056.exe
      4⤵
      PID:2608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58605.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-98.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-98.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9177.exe
      4⤵
      PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64448.exe
      4⤵
      PID:5736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52014.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52014.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16074.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52737.exe
        5⤵
        
        PID:1016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30556.exe
        6⤵
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32252.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1904.exe
        6⤵
        
        PID:1732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50446.exe
        5⤵
        
        PID:1844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41094.exe
        5⤵
        
        PID:3760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45444.exe
        5⤵
        
        PID:3696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4947.exe
        5⤵
        
        PID:4384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3376.exe
        5⤵
        
        PID:5572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29062.exe
      4⤵
      PID:2976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64081.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29968.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12173.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55937.exe
        5⤵
        
        PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60557.exe
        5⤵
        
        PID:4148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12258.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49569.exe
      4⤵
      PID:3184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11039.exe
      4⤵
      PID:2392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45505.exe
      4⤵
      PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46404.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32877.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32877.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29062.exe
      4⤵
      PID:2708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14496.exe
        5⤵
        
        PID:2652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29968.exe
        5⤵
        
        PID:2720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19704.exe
        5⤵
        
        PID:4004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57957.exe
        5⤵
        
        PID:4840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41590.exe
        5⤵
        
        PID:4640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62803.exe
      4⤵
      PID:2476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49569.exe
      4⤵
      PID:2336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-98.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-98.exe
      4⤵
      PID:3904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5093.exe
      4⤵
      PID:4668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52195.exe
      4⤵
      PID:5664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22810.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22810.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15018.exe
      4⤵
      PID:3916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32692.exe
      4⤵
      PID:4980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23255.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64498.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64498.exe
    3⤵
    PID:1848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55736.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55736.exe
    3⤵
    PID:3996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15202.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15202.exe
    3⤵
    PID:2796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47848.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47848.exe
    3⤵
    PID:4708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3012.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3012.exe
    3⤵
    PID:5924
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6597.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6597.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29042.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29042.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17605.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51595.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12036.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30750.exe
        7⤵
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29968.exe
        7⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11296.exe
        7⤵
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8097.exe
        7⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37088.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45866.exe
        6⤵
        
        PID:2568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20190.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55210.exe
        6⤵
        
        PID:3716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8465.exe
        6⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46164.exe
        6⤵
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33846.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45456.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35441.exe
        6⤵
        Executes dropped EXE
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26321.exe
        7⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31525.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52298.exe
        7⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46752.exe
        7⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25147.exe
        7⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61930.exe
        6⤵
        
        PID:1056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58006.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44868.exe
        6⤵
        
        PID:3988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60858.exe
        6⤵
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9850.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40566.exe
        6⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63067.exe
        6⤵
        
        PID:4224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29511.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33813.exe
        6⤵
        
        PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33482.exe
        5⤵
        
        PID:2000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38294.exe
        5⤵
        
        PID:3736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe
        5⤵
        
        PID:4044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5477.exe
        5⤵
        
        PID:4120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64448.exe
        5⤵
        
        PID:5608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7033.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48409.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42343.exe
        6⤵
        
        PID:1728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6455.exe
        6⤵
        
        PID:1556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36025.exe
        6⤵
        
        PID:3944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41330.exe
        6⤵
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30835.exe
        6⤵
        
        PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37998.exe
        5⤵
        
        PID:2960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17813.exe
        6⤵
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29968.exe
        6⤵
        
        PID:3088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20747.exe
        6⤵
        
        PID:3664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62041.exe
        6⤵
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25254.exe
        6⤵
        
        PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41423.exe
        5⤵
        
        PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49569.exe
        5⤵
        
        PID:3192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11314.exe
        5⤵
        
        PID:3432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19888.exe
        5⤵
        
        PID:4200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34878.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39058.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59902.exe
        6⤵
        
        PID:4504
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 236
        6⤵
        Program crash
        
        PID:4804
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 236
        5⤵
        Program crash
        
        PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30625.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34917.exe
        5⤵
        
        PID:2052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29968.exe
        5⤵
        
        PID:2820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57290.exe
        5⤵
        
        PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26581.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60557.exe
        5⤵
        
        PID:4532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64087.exe
      4⤵
      PID:2284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24368.exe
      4⤵
      PID:972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46852.exe
      4⤵
      PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42223.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30137.exe
      4⤵
      PID:4972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63276.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63276.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3064
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 220
      4⤵
      Loads dropped DLL
      Program crash
      PID:2268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14951.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14951.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55202.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33062.exe
        5⤵
        
        PID:2564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37669.exe
        5⤵
        
        PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17130.exe
        5⤵
        
        PID:4180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62700.exe
        5⤵
        
        PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16780.exe
        5⤵
        
        PID:5968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12586.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
      4⤵
      PID:3480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65288.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4563.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56661.exe
      4⤵
      PID:5624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26349.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26349.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34493.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43534.exe
      4⤵
      PID:3856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8465.exe
      4⤵
      PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46548.exe
      4⤵
      PID:4940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20441.exe
      4⤵
      PID:5684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23521.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23521.exe
    3⤵
    PID:2644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36942.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36942.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57153.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57153.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53183.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53183.exe
    3⤵
    PID:4748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59112.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59112.exe
    3⤵
    PID:5548
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59092.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59092.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58144.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58144.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31258.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62363.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31741.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50594.exe
        7⤵
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29968.exe
        7⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61265.exe
        7⤵
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6352.exe
        7⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56473.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36156.exe
        6⤵
        
        PID:2144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43704.exe
        6⤵
        
        PID:2612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49834.exe
        6⤵
        
        PID:3632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17915.exe
        6⤵
        
        PID:4484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27685.exe
        6⤵
        
        PID:4956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11875.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
        6⤵
        
        PID:2636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3953.exe
        6⤵
        
        PID:3600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61780.exe
        6⤵
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44828.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10070.exe
        6⤵
        
        PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11682.exe
        5⤵
        
        PID:2716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49569.exe
        5⤵
        
        PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-98.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-98.exe
        5⤵
        
        PID:3804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46510.exe
        5⤵
        
        PID:4468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64448.exe
        5⤵
        
        PID:5712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22845.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27281.exe
        5⤵
        
        PID:556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36569.exe
        5⤵
        
        PID:3852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44130.exe
        5⤵
        
        PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56036.exe
        5⤵
        
        PID:4592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20426.exe
      4⤵
      PID:1296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49569.exe
      4⤵
      PID:3120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-98.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-98.exe
      4⤵
      PID:3444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46510.exe
      4⤵
      PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64448.exe
      4⤵
      PID:5720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61745.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61745.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21824.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39058.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12641.exe
        6⤵
        
        PID:964
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 216
        6⤵
        Program crash
        
        PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12586.exe
        5⤵
        
        PID:2380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40728.exe
        5⤵
        
        PID:3912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43266.exe
        5⤵
        
        PID:4776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2592.exe
        5⤵
        
        PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60225.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40483.exe
        5⤵
        
        PID:3340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30394.exe
        5⤵
        
        PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50171.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26321.exe
      4⤵
      PID:2276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62143.exe
      4⤵
      PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56623.exe
      4⤵
      PID:3872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57649.exe
      4⤵
      PID:4644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8189.exe
      4⤵
      PID:5640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3716.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3716.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60713.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9753.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29968.exe
        5⤵
        
        PID:3080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11296.exe
        5⤵
        
        PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6352.exe
        5⤵
        
        PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56473.exe
        5⤵
        
        PID:4964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19820.exe
      4⤵
      PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35522.exe
        5⤵
        
        PID:3428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63067.exe
        5⤵
        
        PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8131.exe
        5⤵
        
        PID:4364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28577.exe
        5⤵
        
        PID:5632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43704.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49834.exe
      4⤵
      PID:3640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17915.exe
      4⤵
      PID:4424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44021.exe
      4⤵
      PID:4648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31943.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31943.exe
    3⤵
    PID:2948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50976.exe
      4⤵
      PID:3324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32252.exe
      4⤵
      PID:4340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1904.exe
      4⤵
      PID:4732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61381.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61381.exe
    3⤵
    PID:3060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21758.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21758.exe
    3⤵
    PID:3776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53645.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53645.exe
    3⤵
    PID:3984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23827.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23827.exe
    3⤵
    PID:5060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11562.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11562.exe
    3⤵
    PID:5248
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57879.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57879.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43510.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43510.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58954.exe
      4⤵
      PID:884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29968.exe
      4⤵
      PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11296.exe
      4⤵
      PID:3816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59637.exe
      4⤵
      PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44221.exe
      4⤵
      PID:5112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29747.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29747.exe
    3⤵
    PID:2468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14883.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21001.exe
      4⤵
      PID:4092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11265.exe
      4⤵
      PID:4132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13996.exe
      4⤵
      PID:4156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19911.exe
      4⤵
      PID:5532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64181.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64181.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46959.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46959.exe
    3⤵
    PID:3752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53115.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53115.exe
    3⤵
    PID:3960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28292.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28292.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38428.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38428.exe
    3⤵
    PID:5256
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34579.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34579.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35550.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35550.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47224.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21074.exe
      4⤵
      PID:3728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11447.exe
      4⤵
      PID:4656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16324.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28730.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28730.exe
    3⤵
    PID:2104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49262.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49262.exe
    3⤵
    PID:3644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20224.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20224.exe
    3⤵
    PID:4584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13622.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13622.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4672
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6275.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6275.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31796.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31796.exe
    3⤵
    PID:2372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12449.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12449.exe
    3⤵
    PID:3388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38558.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38558.exe
    3⤵
    PID:4992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63790.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63790.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4204
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11942.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11942.exe
  2⤵
  PID:1716
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17293.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17293.exe
  2⤵
  PID:3744
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26779.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26779.exe
  2⤵
  PID:4012
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48348.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48348.exe
  2⤵
  PID:3508
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35577.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35577.exe
  2⤵
  PID:5648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11682.exe

Filesize
468KB

MD5
3e6a26bc44805e5213d17a5a694204a9

SHA1
dfff8707d437fda491c5852b208b0e01153992e7

SHA256
b46c713a829a5771df3f99e57b4e228851525f1e2c4a5af20a5d9eec57b5a525

SHA512
6eb020fc783927b044b35b318c7e7d995706d288007c26c6ee04a0adb9652cc5f17915dfca13659778000dec46de64880737a7ff8a3687a6d4c4566064d9a1cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17605.exe

Filesize
468KB

MD5
f930457a3523aa96f13ba4c04103b1bb

SHA1
c10c54bf1c40b93b8cc3310bdbf96c16fc37d2d6

SHA256
961896c0837cf4bc24ff204bb4ec606b569b36b1296f9a8a0938c9b0338a198e

SHA512
9c2cc4b8a452ea74939e5998dd1b787b1f512bf560184393631c2c44639542dcfdaa06db75da81280f47e926bb7792de4100005208fd4c8b7a5edcfa3bf17bb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21824.exe

Filesize
468KB

MD5
690c95bfae601f5a2b8d01e026c39301

SHA1
d5066a6148e8feea7aec6e4f09a53fdc5a19849b

SHA256
54041c626a440b8862686d70bdae8376cb365d60f96addfd34efad4e5aa10660

SHA512
3b791d950ea8d4a0366398d3e7891b11e441025e175d4a39337026e7c717730014e52480e02c3828e647a99b7097d02b0b69db6fd5c7129d3fcda353465977de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25512.exe

Filesize
468KB

MD5
d5586790afa69819db15cd5ba1ff6000

SHA1
6739ebbd1da7c8aa3a1f64532e16434c224220e2

SHA256
01647b3b081682f1a3ff600a48afb793d5bb2c09f0ac33894b10c743dfbf5b39

SHA512
3188f0f3951cd311d6cd87b5ac478758bdf4813fa0d3a1358e04e54c7f58a72391f23b9397d62b9885192b3950927ae0a70db0847fcf28c0bd65ca8ff13488a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45444.exe

Filesize
468KB

MD5
e8689d67a0e37e497e65232ae08d9fbb

SHA1
2c65700328370c9d3d8796617aedd77df879a39a

SHA256
5bdcd60ce3696118c92048ad03cfa3fbbd0ba0b02540cfc889cfabc7ab1d6c68

SHA512
38a010ffac52c9c7444576b169134770aa489139560bcf1224aa3387bf6c9db40607489429b989bde76c672c0442723d05384b258cbdf97f5b867569df36ef30

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58144.exe

Filesize
468KB

MD5
4e769c56632934ae5efdc8bcbdb454d9

SHA1
8b463a48664030832b7e2e9e2fe3988c2254b1d5

SHA256
b5ce65040b151ff3c1561943519854a2fe6d4076637c83e22d31ac9d8f866932

SHA512
90e8927591c0c734cb52b08fee288ca0b09125ebb913a18bead54ef40dfae9023fd6d07a50c23d6cb1275b7be71f7e958877c73a8b6560dda2ae8427f65887b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59092.exe

Filesize
468KB

MD5
be640d402639348f0787e922632695bb

SHA1
dc25527215867a1616eb4b03616f464bf447a164

SHA256
654485f99bb881f1b17361f40203807d67e3ac40bb159598812d275e121c9896

SHA512
8f55596ab17379f76a303ee773dabce06fa7afe5dec681503fa1d2aee84ffad2fc214967c823ee07b6f40e461e94557f601ab8434da1f31149b2c2b6172de6c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64288.exe

Filesize
468KB

MD5
9d4ab4a5ed4c8d7647f818e9e83d7dc7

SHA1
49960ef9523e05066f013946df685f87742f5a21

SHA256
a1e5f4757ded438329ac604be00dc33d27e26987636f6b8c663464c8b53ae8a9

SHA512
83679e859416b3486005c8c15cd3789a00c390c5ccb5fd842091d5c9d403965081828a44fc7b4842427734d253953f7ab2dd0582c3cfee2a41e0d91aa837e450

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6597.exe

Filesize
468KB

MD5
f7dda2a652cac6bb29f3e893a9fde83b

SHA1
458817cf01b33633f7f7081a7fa1839ebe1196c2

SHA256
81074114a3c248c541299cb9cf228e2d482c3c75073659abf408f548b1ce26aa

SHA512
0e2cd5b84e30037dadaf1b6973a6c4414290997057ad60a470dda93a52300f6901278d0e103781206df9e8da478eb150730b7f1df8191b7cbead852901863fe5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-2181.exe

Filesize
468KB

MD5
4977faf181d2b270e0e6af465a0823e3

SHA1
96b7a344460b3e568f07f55cc4ca1757db2b63a2

SHA256
e5f1600a340e36e14cf4ca44dab46022c67282d94addccc7e4f86232d708d31d

SHA512
431a7ce669704aaa0a22011ae014bcf0f3994a7791b799d680cdfed7e6676851bd539f1f9563ce7b07a9785a8e98e85e6af3154acb9780c95110c4091f3a6772

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29042.exe

Filesize
468KB

MD5
af38236935c6a14b02854ec5930486ff

SHA1
10071ba994270496719057a58f9359c2a897e656

SHA256
93857ce395494a20319e8466bc5aab3510a532e855a6ea6b5ab9c667b60a0f14

SHA512
a837a625cb549f569d7f019871b69a5b0c460d0f50713af6fee0b00d9565ec65a5b01bad95493d1344d32100730e4f8e220fd8d04d0c93f5470145d2988fa2fa

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34325.exe

Filesize
468KB

MD5
de0534ab49afb8aa3847a56511b05f3d

SHA1
93672ff3534fb755573108d8c76f039b33df1159

SHA256
79c1456aed5c5cbf50f43bbc1e28a74f7280a2350bd914608cc6bd54e3fe2c3d

SHA512
bc40adf7c3db1567c8f9fbb545e5ca887176e32c419930a7178b5610fe1d6f405c773c6c839d4a2db722f9f4467676f0fbb362639e6ac7ef12a9af65d0344d84

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-44226.exe

Filesize
468KB

MD5
8161b846d608c1573ddd770263f6694b

SHA1
8f05b57270f4978d723212ab359100f3c6ab3884

SHA256
abef7c6006167d88827e86b63e119199a72d35002a7edb6b5f43144cebadbd47

SHA512
1959583af58d8f271a2d1ca6acc9166fe6a10996c3c638e57dd40311ca2922ed26b1e54c9e8746e09ea279a8e7ac085796d4de99d595bbab2fc75c53adf45b51

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51595.exe

Filesize
468KB

MD5
3fcd4326f0f5923a991da5143f4f115c

SHA1
e7654291181a9e6aea4c68a5498bf6e431714f8b

SHA256
87a29c8f0f400bb6b6b70880ee074fa639eb3adf6ee1d099e069922709dcd2c5

SHA512
dd38b1390b97c99fc9f339fb4f696b7cf687e69c4c087019b8d9e264a9d1df930cbc0aa086f2959f091ada207bf7dcb946a9cc0a5a019b8984025811e5bb051b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52014.exe

Filesize
468KB

MD5
41635218c40a156192f19ca62c7d1380

SHA1
e0cfc3004c174c21a2a7e93a89b215446010aaa4

SHA256
33a08b2d4cedaa39b5482856bce350aee7bf3e1e4a958fa29f5042394f832086

SHA512
a7fe309ef4fa1e8b43da98571930ee351a7483956d4d70c65a7e907a57cc0ecf0bf0e4317b57631cf7064ac2c2d211a5b9af15182ccc2f6f321c407d2508eb38

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54916.exe

Filesize
468KB

MD5
3cba6bbd711a097fe05679950fca92ca

SHA1
0e6f59ec8e344fa41088dd4ad4fe30d9846ecf11

SHA256
52cd7d586a61ec161f46e780551b4e5af3be0fc7080b942d9a2f631a4c7ff5cd

SHA512
d75f010e83751b42e651665cc5c366404d79247895b763c0e917bcfa1403126e030613b608eb3835ada99109d20ccb7c9c5d1413dfdee021701ff6df2bd52c81

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-5518.exe

Filesize
468KB

MD5
bcf24fd571fad1f76a4ee8b2e8c12956

SHA1
b48e5d23a1aced367f40e48339d584e252e3666c

SHA256
125bc84f6304ff0a4efd6aeabad95def912446e29ba7cc811a1e65c356d6f3eb

SHA512
f3d6b8c9f1f9a5c508babbc4b450b2cbd1408758e0e09fd32b5994c365003b97a93adf207c3c69b25d0c7d5756c95d329836b72a3d40efef9a0f5994e22612ed

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57879.exe

Filesize
468KB

MD5
98e8e5a1fcbaffd84ec13e3b9fa00008

SHA1
e300da25c3a382db744de16cb610554a058b88f6

SHA256
b7c984dda749c9af10dabb4177bd37fbf6fac230adbd5d42a077ab49906cc86e

SHA512
1ea6d34e219ad5bbd38f2d82855f31267dd7fbf48daa41440b33038ac11ea4e44628a63283cdf406c504d258ee7691ce7c3b41949d4c11a753462ea15b1b64a8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63276.exe

Filesize
468KB

MD5
d9cbfd058e7395df03dc35c3bfa86370

SHA1
b4370a5bb9fb293488bd9cc8f92fa1e4af9bd1c9

SHA256
cea43b839a9c650bb3098810df3f776a0e1f0347e1db7372ade8608c50c59506

SHA512
c807a71f2a3996e856fcbdf2af541f2f08ba43d1116bf5f008c781df7312c056960a2c9e071b2c72bff27a9a908abeb60dac216c93ba8a1492f4e7d44e1db2de

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63473.exe

Filesize
468KB

MD5
c34590f6f8deaaca83a870d87f963ca9

SHA1
33bb8258e4016fb727f2e41d4e137a05754de486

SHA256
015c1038edff3b6001f984b74f3371439a1ffe400653bc927c1f61502cb6392f

SHA512
2ec7f01145b099cd5e88a2f3f9fa5482070e5f8e3c7ac74009dd204899c7577d72bf9ae9bb684cdd0a88fd12d9157bf42e3a31217101ec01e25135ead2703cc2

Download Submit
memory/368-387-0x0000000002560000-0x00000000025D5000-memory.dmp

Filesize
468KB

Download
memory/368-383-0x0000000002560000-0x00000000025D5000-memory.dmp

Filesize
468KB

Download
memory/368-200-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/388-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/568-275-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/848-213-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/848-370-0x0000000002910000-0x0000000002985000-memory.dmp

Filesize
468KB

Download
memory/900-372-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1048-219-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/1048-79-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1048-343-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/1048-341-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/1048-218-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/1096-167-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1096-289-0x0000000002830000-0x00000000028A5000-memory.dmp

Filesize
468KB

Download
memory/1096-288-0x0000000002830000-0x00000000028A5000-memory.dmp

Filesize
468KB

Download
memory/1200-158-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1200-270-0x0000000002870000-0x00000000028E5000-memory.dmp

Filesize
468KB

Download
memory/1200-269-0x0000000002870000-0x00000000028E5000-memory.dmp

Filesize
468KB

Download
memory/1244-236-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1292-394-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1608-314-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1620-306-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2016-313-0x00000000028A0000-0x0000000002915000-memory.dmp

Filesize
468KB

Download
memory/2016-307-0x00000000028A0000-0x0000000002915000-memory.dmp

Filesize
468KB

Download
memory/2112-235-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2112-418-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2112-110-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2112-231-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2224-212-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/2224-205-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/2224-118-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2260-189-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2260-349-0x0000000002900000-0x0000000002975000-memory.dmp

Filesize
468KB

Download
memory/2260-353-0x0000000002900000-0x0000000002975000-memory.dmp

Filesize
468KB

Download
memory/2288-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2376-290-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2412-344-0x0000000002460000-0x00000000024D5000-memory.dmp

Filesize
468KB

Download
memory/2412-220-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2416-188-0x0000000002460000-0x00000000024D5000-memory.dmp

Filesize
468KB

Download
memory/2416-96-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2416-361-0x0000000002460000-0x00000000024D5000-memory.dmp

Filesize
468KB

Download
memory/2416-369-0x0000000002460000-0x00000000024D5000-memory.dmp

Filesize
468KB

Download
memory/2416-186-0x0000000002460000-0x00000000024D5000-memory.dmp

Filesize
468KB

Download
memory/2440-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2524-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2536-287-0x0000000002450000-0x00000000024C5000-memory.dmp

Filesize
468KB

Download
memory/2536-157-0x0000000002450000-0x00000000024C5000-memory.dmp

Filesize
468KB

Download
memory/2536-286-0x0000000002450000-0x00000000024C5000-memory.dmp

Filesize
468KB

Download
memory/2536-73-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2552-163-0x00000000024A0000-0x0000000002515000-memory.dmp

Filesize
468KB

Download
memory/2552-58-0x00000000024A0000-0x0000000002515000-memory.dmp

Filesize
468KB

Download
memory/2552-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2552-27-0x00000000024A0000-0x0000000002515000-memory.dmp

Filesize
468KB

Download
memory/2552-165-0x00000000024A0000-0x0000000002515000-memory.dmp

Filesize
468KB

Download
memory/2552-12-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2552-303-0x00000000024A0000-0x0000000002515000-memory.dmp

Filesize
468KB

Download
memory/2552-305-0x00000000024A0000-0x0000000002515000-memory.dmp

Filesize
468KB

Download
memory/2616-379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2680-291-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2688-271-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2740-419-0x0000000002560000-0x00000000025D5000-memory.dmp

Filesize
468KB

Download
memory/2740-94-0x0000000002560000-0x00000000025D5000-memory.dmp

Filesize
468KB

Download
memory/2740-198-0x0000000002560000-0x00000000025D5000-memory.dmp

Filesize
468KB

Download
memory/2740-199-0x0000000002560000-0x00000000025D5000-memory.dmp

Filesize
468KB

Download
memory/2776-156-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/2776-321-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/2776-327-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/2792-250-0x0000000000530000-0x00000000005A5000-memory.dmp

Filesize
468KB

Download
memory/2792-261-0x0000000000530000-0x00000000005A5000-memory.dmp

Filesize
468KB

Download
memory/2792-164-0x0000000000530000-0x00000000005A5000-memory.dmp

Filesize
468KB

Download
memory/2792-154-0x0000000000530000-0x00000000005A5000-memory.dmp

Filesize
468KB

Download
memory/2792-10-0x0000000000530000-0x00000000005A5000-memory.dmp

Filesize
468KB

Download
memory/2792-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2792-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2808-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2844-345-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2852-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2868-245-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/2868-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2868-244-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/2868-43-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/2868-28-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2876-354-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2916-316-0x0000000001DA0000-0x0000000001E15000-memory.dmp

Filesize
468KB

Download
memory/2916-36-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2916-128-0x0000000001DA0000-0x0000000001E15000-memory.dmp

Filesize
468KB

Download
memory/2916-129-0x0000000001DA0000-0x0000000001E15000-memory.dmp

Filesize
468KB

Download
memory/2916-63-0x0000000001DA0000-0x0000000001E15000-memory.dmp

Filesize
468KB

Download
memory/2916-322-0x0000000001DA0000-0x0000000001E15000-memory.dmp

Filesize
468KB

Download
memory/2928-342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2952-267-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2952-155-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2952-268-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3056-420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3064-130-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download