0736d22ffe2d9fe548a24cdb7fc2c5591ffc6bf137afbf1c5b47785c7c1bdf70

Analysis

max time kernel
147s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
13-10-2024 18:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0736d22ffe2d9fe548a24cdb7fc2c5591ffc6bf137afbf1c5b47785c7c1bdf70.exe
Size

468KB
MD5

c5c0ad46bdda84f72f1e17a16fbeab91
SHA1

b0e31816a0ff451531929a8e421b34e94bbaecac
SHA256

0736d22ffe2d9fe548a24cdb7fc2c5591ffc6bf137afbf1c5b47785c7c1bdf70
SHA512

9283a589379c89e661af08bf867db19f17f1e69c7b8c5a37ac9070a657db1a6c9a019d5497f1b8bf85b1e36bbf68672c12f0d7d2918c748f5b912fdac4087032
SSDEEP

3072:TSA1ogYnI05ptbYnPz4Cef8/ECxvPgpXcmHe6Vs/fYq/DMiuFpls:TSCom8ptkPECefWcmnfYIgiuF

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2824	Unicorn-56608.exe
3012	Unicorn-3370.exe
2848	Unicorn-53894.exe
2184	Unicorn-47200.exe
2764	Unicorn-30763.exe
1308	Unicorn-61398.exe
2788	Unicorn-41532.exe
1720	Unicorn-17434.exe
752	Unicorn-38107.exe
2948	Unicorn-31331.exe
2704	Unicorn-8772.exe
3052	Unicorn-43318.exe
2892	Unicorn-35969.exe
2092	Unicorn-31038.exe
2508	Unicorn-37169.exe
2472	Unicorn-3126.exe
2192	Unicorn-61818.exe
904	Unicorn-34429.exe
1584	Unicorn-36436.exe
2244	Unicorn-23438.exe
1620	Unicorn-63956.exe
976	Unicorn-39774.exe
1808	Unicorn-25384.exe
2672	Unicorn-55845.exe
1512	Unicorn-44526.exe
1516	Unicorn-50656.exe
1916	Unicorn-50656.exe
1364	Unicorn-2010.exe
1700	Unicorn-7577.exe
1040	Unicorn-4777.exe
2400	Unicorn-18176.exe
692	Unicorn-18730.exe
2044	Unicorn-38596.exe
1724	Unicorn-3685.exe
1564	Unicorn-26152.exe
1536	Unicorn-33660.exe
2868	Unicorn-43028.exe
1380	Unicorn-61402.exe
3020	Unicorn-23184.exe
2896	Unicorn-58549.exe
2828	Unicorn-61978.exe
2732	Unicorn-12685.exe
2836	Unicorn-49442.exe
2564	Unicorn-29576.exe
1576	Unicorn-58378.exe
2812	Unicorn-29333.exe
968	Unicorn-9732.exe
2784	Unicorn-55726.exe
1252	Unicorn-10054.exe
2960	Unicorn-15819.exe
2816	Unicorn-16085.exe
892	Unicorn-31142.exe
1088	Unicorn-24829.exe
1756	Unicorn-30859.exe
2596	Unicorn-61585.exe
2104	Unicorn-41719.exe
2328	Unicorn-30043.exe
2364	Unicorn-62716.exe
1036	Unicorn-37465.exe
944	Unicorn-11377.exe
2384	Unicorn-38041.exe
1784	Unicorn-52986.exe
1428	Unicorn-38041.exe
764	Unicorn-15382.exe

Loads dropped DLL 64 IoCs

pid	Process
2172	0736d22ffe2d9fe548a24cdb7fc2c5591ffc6bf137afbf1c5b47785c7c1bdf70.exe
2172	0736d22ffe2d9fe548a24cdb7fc2c5591ffc6bf137afbf1c5b47785c7c1bdf70.exe
2824	Unicorn-56608.exe
2824	Unicorn-56608.exe
2172	0736d22ffe2d9fe548a24cdb7fc2c5591ffc6bf137afbf1c5b47785c7c1bdf70.exe
2172	0736d22ffe2d9fe548a24cdb7fc2c5591ffc6bf137afbf1c5b47785c7c1bdf70.exe
2848	Unicorn-53894.exe
2848	Unicorn-53894.exe
2172	0736d22ffe2d9fe548a24cdb7fc2c5591ffc6bf137afbf1c5b47785c7c1bdf70.exe
2172	0736d22ffe2d9fe548a24cdb7fc2c5591ffc6bf137afbf1c5b47785c7c1bdf70.exe
2824	Unicorn-56608.exe
3012	Unicorn-3370.exe
2824	Unicorn-56608.exe
3012	Unicorn-3370.exe
2184	Unicorn-47200.exe
2184	Unicorn-47200.exe
2848	Unicorn-53894.exe
2848	Unicorn-53894.exe
2764	Unicorn-30763.exe
2764	Unicorn-30763.exe
1308	Unicorn-61398.exe
2172	0736d22ffe2d9fe548a24cdb7fc2c5591ffc6bf137afbf1c5b47785c7c1bdf70.exe
1308	Unicorn-61398.exe
2172	0736d22ffe2d9fe548a24cdb7fc2c5591ffc6bf137afbf1c5b47785c7c1bdf70.exe
3012	Unicorn-3370.exe
3012	Unicorn-3370.exe
2788	Unicorn-41532.exe
2824	Unicorn-56608.exe
2824	Unicorn-56608.exe
2788	Unicorn-41532.exe
1720	Unicorn-17434.exe
1720	Unicorn-17434.exe
2184	Unicorn-47200.exe
2184	Unicorn-47200.exe
2948	Unicorn-31331.exe
2948	Unicorn-31331.exe
2764	Unicorn-30763.exe
2764	Unicorn-30763.exe
2508	Unicorn-37169.exe
2508	Unicorn-37169.exe
2788	Unicorn-41532.exe
2788	Unicorn-41532.exe
2092	Unicorn-31038.exe
2092	Unicorn-31038.exe
752	Unicorn-38107.exe
752	Unicorn-38107.exe
2824	Unicorn-56608.exe
2824	Unicorn-56608.exe
2848	Unicorn-53894.exe
2892	Unicorn-35969.exe
2704	Unicorn-8772.exe
2848	Unicorn-53894.exe
2892	Unicorn-35969.exe
2704	Unicorn-8772.exe
1308	Unicorn-61398.exe
1308	Unicorn-61398.exe
3012	Unicorn-3370.exe
2172	0736d22ffe2d9fe548a24cdb7fc2c5591ffc6bf137afbf1c5b47785c7c1bdf70.exe
2172	0736d22ffe2d9fe548a24cdb7fc2c5591ffc6bf137afbf1c5b47785c7c1bdf70.exe
3012	Unicorn-3370.exe
2472	Unicorn-3126.exe
2472	Unicorn-3126.exe
1720	Unicorn-17434.exe
1720	Unicorn-17434.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5400	1676	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42882.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18730.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20762.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40649.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28624.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0736d22ffe2d9fe548a24cdb7fc2c5591ffc6bf137afbf1c5b47785c7c1bdf70.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59984.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22934.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34429.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35174.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26760.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15993.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30859.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30043.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16908.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37169.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34497.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52996.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23438.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30860.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15360.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8894.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-943.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55796.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16421.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15360.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28624.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2087.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62716.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1899.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36460.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12685.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20762.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8641.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15360.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16906.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40649.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37124.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31142.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20783.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45549.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41479.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36460.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31995.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29333.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30898.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12978.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51671.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15785.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29095.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32813.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8730.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31995.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43028.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29039.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55402.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2172	0736d22ffe2d9fe548a24cdb7fc2c5591ffc6bf137afbf1c5b47785c7c1bdf70.exe
2824	Unicorn-56608.exe
2848	Unicorn-53894.exe
3012	Unicorn-3370.exe
2184	Unicorn-47200.exe
2764	Unicorn-30763.exe
1308	Unicorn-61398.exe
2788	Unicorn-41532.exe
1720	Unicorn-17434.exe
2948	Unicorn-31331.exe
2704	Unicorn-8772.exe
2508	Unicorn-37169.exe
2892	Unicorn-35969.exe
2092	Unicorn-31038.exe
752	Unicorn-38107.exe
3052	Unicorn-43318.exe
2472	Unicorn-3126.exe
2192	Unicorn-61818.exe
904	Unicorn-34429.exe
1584	Unicorn-36436.exe
2244	Unicorn-23438.exe
1620	Unicorn-63956.exe
976	Unicorn-39774.exe
1916	Unicorn-50656.exe
1808	Unicorn-25384.exe
1512	Unicorn-44526.exe
1516	Unicorn-50656.exe
1364	Unicorn-2010.exe
1700	Unicorn-7577.exe
2672	Unicorn-55845.exe
1040	Unicorn-4777.exe
2400	Unicorn-18176.exe
692	Unicorn-18730.exe
2044	Unicorn-38596.exe
1564	Unicorn-26152.exe
1724	Unicorn-3685.exe
1536	Unicorn-33660.exe
1380	Unicorn-61402.exe
2868	Unicorn-43028.exe
3020	Unicorn-23184.exe
2896	Unicorn-58549.exe
2828	Unicorn-61978.exe
2732	Unicorn-12685.exe
2564	Unicorn-29576.exe
2836	Unicorn-49442.exe
2960	Unicorn-15819.exe
1576	Unicorn-58378.exe
2812	Unicorn-29333.exe
2816	Unicorn-16085.exe
968	Unicorn-9732.exe
1252	Unicorn-10054.exe
2784	Unicorn-55726.exe
892	Unicorn-31142.exe
1088	Unicorn-24829.exe
2596	Unicorn-61585.exe
1756	Unicorn-30859.exe
2104	Unicorn-41719.exe
2328	Unicorn-30043.exe
2364	Unicorn-62716.exe
1784	Unicorn-52986.exe
1036	Unicorn-37465.exe
2384	Unicorn-38041.exe
1428	Unicorn-38041.exe
764	Unicorn-15382.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2824	2172	0736d22ffe2d9fe548a24cdb7fc2c5591ffc6bf137afbf1c5b47785c7c1bdf70.exe	29
PID 2172 wrote to memory of 2824	2172	0736d22ffe2d9fe548a24cdb7fc2c5591ffc6bf137afbf1c5b47785c7c1bdf70.exe	29
PID 2172 wrote to memory of 2824	2172	0736d22ffe2d9fe548a24cdb7fc2c5591ffc6bf137afbf1c5b47785c7c1bdf70.exe	29
PID 2172 wrote to memory of 2824	2172	0736d22ffe2d9fe548a24cdb7fc2c5591ffc6bf137afbf1c5b47785c7c1bdf70.exe	29
PID 2824 wrote to memory of 3012	2824	Unicorn-56608.exe	30
PID 2824 wrote to memory of 3012	2824	Unicorn-56608.exe	30
PID 2824 wrote to memory of 3012	2824	Unicorn-56608.exe	30
PID 2824 wrote to memory of 3012	2824	Unicorn-56608.exe	30
PID 2172 wrote to memory of 2848	2172	0736d22ffe2d9fe548a24cdb7fc2c5591ffc6bf137afbf1c5b47785c7c1bdf70.exe	31
PID 2172 wrote to memory of 2848	2172	0736d22ffe2d9fe548a24cdb7fc2c5591ffc6bf137afbf1c5b47785c7c1bdf70.exe	31
PID 2172 wrote to memory of 2848	2172	0736d22ffe2d9fe548a24cdb7fc2c5591ffc6bf137afbf1c5b47785c7c1bdf70.exe	31
PID 2172 wrote to memory of 2848	2172	0736d22ffe2d9fe548a24cdb7fc2c5591ffc6bf137afbf1c5b47785c7c1bdf70.exe	31
PID 2848 wrote to memory of 2184	2848	Unicorn-53894.exe	32
PID 2848 wrote to memory of 2184	2848	Unicorn-53894.exe	32
PID 2848 wrote to memory of 2184	2848	Unicorn-53894.exe	32
PID 2848 wrote to memory of 2184	2848	Unicorn-53894.exe	32
PID 2172 wrote to memory of 2764	2172	0736d22ffe2d9fe548a24cdb7fc2c5591ffc6bf137afbf1c5b47785c7c1bdf70.exe	33
PID 2172 wrote to memory of 2764	2172	0736d22ffe2d9fe548a24cdb7fc2c5591ffc6bf137afbf1c5b47785c7c1bdf70.exe	33
PID 2172 wrote to memory of 2764	2172	0736d22ffe2d9fe548a24cdb7fc2c5591ffc6bf137afbf1c5b47785c7c1bdf70.exe	33
PID 2172 wrote to memory of 2764	2172	0736d22ffe2d9fe548a24cdb7fc2c5591ffc6bf137afbf1c5b47785c7c1bdf70.exe	33
PID 2824 wrote to memory of 2788	2824	Unicorn-56608.exe	34
PID 2824 wrote to memory of 2788	2824	Unicorn-56608.exe	34
PID 2824 wrote to memory of 2788	2824	Unicorn-56608.exe	34
PID 2824 wrote to memory of 2788	2824	Unicorn-56608.exe	34
PID 3012 wrote to memory of 1308	3012	Unicorn-3370.exe	35
PID 3012 wrote to memory of 1308	3012	Unicorn-3370.exe	35
PID 3012 wrote to memory of 1308	3012	Unicorn-3370.exe	35
PID 3012 wrote to memory of 1308	3012	Unicorn-3370.exe	35
PID 2184 wrote to memory of 1720	2184	Unicorn-47200.exe	36
PID 2184 wrote to memory of 1720	2184	Unicorn-47200.exe	36
PID 2184 wrote to memory of 1720	2184	Unicorn-47200.exe	36
PID 2184 wrote to memory of 1720	2184	Unicorn-47200.exe	36
PID 2848 wrote to memory of 752	2848	Unicorn-53894.exe	37
PID 2848 wrote to memory of 752	2848	Unicorn-53894.exe	37
PID 2848 wrote to memory of 752	2848	Unicorn-53894.exe	37
PID 2848 wrote to memory of 752	2848	Unicorn-53894.exe	37
PID 2764 wrote to memory of 2948	2764	Unicorn-30763.exe	38
PID 2764 wrote to memory of 2948	2764	Unicorn-30763.exe	38
PID 2764 wrote to memory of 2948	2764	Unicorn-30763.exe	38
PID 2764 wrote to memory of 2948	2764	Unicorn-30763.exe	38
PID 1308 wrote to memory of 2704	1308	Unicorn-61398.exe	39
PID 1308 wrote to memory of 2704	1308	Unicorn-61398.exe	39
PID 1308 wrote to memory of 2704	1308	Unicorn-61398.exe	39
PID 1308 wrote to memory of 2704	1308	Unicorn-61398.exe	39
PID 2172 wrote to memory of 3052	2172	0736d22ffe2d9fe548a24cdb7fc2c5591ffc6bf137afbf1c5b47785c7c1bdf70.exe	40
PID 2172 wrote to memory of 3052	2172	0736d22ffe2d9fe548a24cdb7fc2c5591ffc6bf137afbf1c5b47785c7c1bdf70.exe	40
PID 2172 wrote to memory of 3052	2172	0736d22ffe2d9fe548a24cdb7fc2c5591ffc6bf137afbf1c5b47785c7c1bdf70.exe	40
PID 2172 wrote to memory of 3052	2172	0736d22ffe2d9fe548a24cdb7fc2c5591ffc6bf137afbf1c5b47785c7c1bdf70.exe	40
PID 3012 wrote to memory of 2892	3012	Unicorn-3370.exe	41
PID 3012 wrote to memory of 2892	3012	Unicorn-3370.exe	41
PID 3012 wrote to memory of 2892	3012	Unicorn-3370.exe	41
PID 3012 wrote to memory of 2892	3012	Unicorn-3370.exe	41
PID 2824 wrote to memory of 2092	2824	Unicorn-56608.exe	43
PID 2824 wrote to memory of 2092	2824	Unicorn-56608.exe	43
PID 2824 wrote to memory of 2092	2824	Unicorn-56608.exe	43
PID 2824 wrote to memory of 2092	2824	Unicorn-56608.exe	43
PID 2788 wrote to memory of 2508	2788	Unicorn-41532.exe	42
PID 2788 wrote to memory of 2508	2788	Unicorn-41532.exe	42
PID 2788 wrote to memory of 2508	2788	Unicorn-41532.exe	42
PID 2788 wrote to memory of 2508	2788	Unicorn-41532.exe	42
PID 1720 wrote to memory of 2472	1720	Unicorn-17434.exe	44
PID 1720 wrote to memory of 2472	1720	Unicorn-17434.exe	44
PID 1720 wrote to memory of 2472	1720	Unicorn-17434.exe	44
PID 1720 wrote to memory of 2472	1720	Unicorn-17434.exe	44

C:\Users\Admin\AppData\Local\Temp\0736d22ffe2d9fe548a24cdb7fc2c5591ffc6bf137afbf1c5b47785c7c1bdf70.exe
"C:\Users\Admin\AppData\Local\Temp\0736d22ffe2d9fe548a24cdb7fc2c5591ffc6bf137afbf1c5b47785c7c1bdf70.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56608.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56608.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3370.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3370.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61398.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8772.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50656.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52986.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57073.exe
        8⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40649.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28815.exe
        9⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41194.exe
        9⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61164.exe
        9⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20783.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1431.exe
        8⤵
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56492.exe
        8⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15289.exe
        8⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36460.exe
        8⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27234.exe
        7⤵
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43452.exe
        7⤵
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64711.exe
        7⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4470.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31995.exe
        7⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9732.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53007.exe
        7⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1450.exe
        8⤵
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20762.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46060.exe
        8⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12284.exe
        8⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15993.exe
        8⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
        8⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33883.exe
        7⤵
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22629.exe
        7⤵
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59984.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58771.exe
        7⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15993.exe
        7⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
        7⤵
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50276.exe
        6⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40649.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22506.exe
        7⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50627.exe
        7⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15018.exe
        7⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52996.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48640.exe
        6⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49372.exe
        7⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11716.exe
        7⤵
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52103.exe
        7⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53985.exe
        7⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61694.exe
        7⤵
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17883.exe
        6⤵
        
        PID:1796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5619.exe
        6⤵
        
        PID:4088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24490.exe
        6⤵
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48476.exe
        6⤵
        
        PID:4708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34828.exe
        6⤵
        
        PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2010.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14174.exe
        6⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42538.exe
        7⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47717.exe
        7⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55796.exe
        7⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42775.exe
        6⤵
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12262.exe
        6⤵
        
        PID:3900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38927.exe
        6⤵
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52942.exe
        6⤵
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
        6⤵
        
        PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15382.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65044.exe
        6⤵
        
        PID:3588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4665.exe
        6⤵
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
        6⤵
        
        PID:5080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61661.exe
        6⤵
        
        PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18568.exe
        5⤵
        
        PID:2440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57643.exe
        5⤵
        
        PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51050.exe
        5⤵
        
        PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11528.exe
        5⤵
        
        PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34828.exe
        5⤵
        
        PID:5148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35969.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50656.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37465.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15792.exe
        7⤵
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54903.exe
        7⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23955.exe
        7⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52996.exe
        7⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29039.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60176.exe
        6⤵
        
        PID:3536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58771.exe
        6⤵
        
        PID:4440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15993.exe
        6⤵
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
        6⤵
        
        PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11377.exe
        5⤵
        Executes dropped EXE
        
        PID:944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64925.exe
        6⤵
        
        PID:4556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16226.exe
        6⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18573.exe
        6⤵
        
        PID:5936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27234.exe
        5⤵
        
        PID:468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12609.exe
        5⤵
        
        PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22934.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45554.exe
        5⤵
        
        PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30860.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7577.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10054.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15360.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14373.exe
        6⤵
        
        PID:3744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24375.exe
        6⤵
        
        PID:3440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32528.exe
        6⤵
        
        PID:1340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36460.exe
        6⤵
        
        PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49260.exe
        5⤵
        
        PID:2204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34497.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51925.exe
        5⤵
        
        PID:3652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63540.exe
        5⤵
        
        PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52942.exe
        5⤵
        
        PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49182.exe
        5⤵
        
        PID:684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15819.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32177.exe
        5⤵
        
        PID:1848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20762.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7467.exe
        5⤵
        
        PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        5⤵
        
        PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5513.exe
        5⤵
        
        PID:5040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40163.exe
        5⤵
        
        PID:5128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1840.exe
      4⤵
      PID:272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3294.exe
      4⤵
      PID:2776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51849.exe
      4⤵
      PID:3780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37770.exe
      4⤵
      PID:4368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36919.exe
      4⤵
      PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30860.exe
      4⤵
      PID:5656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41532.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41532.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37169.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23438.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12685.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3780.exe
        7⤵
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20762.exe
        7⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-943.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41479.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3940.exe
        7⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36460.exe
        7⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4335.exe
        6⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26814.exe
        7⤵
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11219.exe
        7⤵
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26760.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48978.exe
        7⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52996.exe
        7⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34497.exe
        6⤵
        
        PID:2912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6808.exe
        6⤵
        
        PID:3872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32813.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5321.exe
        6⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31995.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29576.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53749.exe
        6⤵
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8894.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17965.exe
        6⤵
        
        PID:3584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58771.exe
        6⤵
        
        PID:4416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52942.exe
        6⤵
        
        PID:4812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
        6⤵
        
        PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51703.exe
        5⤵
        
        PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28495.exe
        5⤵
        
        PID:2132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51319.exe
        5⤵
        
        PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42235.exe
        5⤵
        
        PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4470.exe
        5⤵
        
        PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31995.exe
        5⤵
        
        PID:5764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63956.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23184.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38041.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9922.exe
        7⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60332.exe
        7⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54711.exe
        7⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23955.exe
        7⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30437.exe
        7⤵
        
        PID:5276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29039.exe
        6⤵
        
        PID:520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46441.exe
        6⤵
        
        PID:3460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7425.exe
        6⤵
        
        PID:4240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33059.exe
        6⤵
        
        PID:4128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9437.exe
        6⤵
        
        PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16421.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16700.exe
        6⤵
        
        PID:996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28624.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26760.exe
        6⤵
        
        PID:4228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41194.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52996.exe
        6⤵
        
        PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42775.exe
        5⤵
        
        PID:2436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12843.exe
        5⤵
        
        PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12725.exe
        5⤵
        
        PID:3392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8730.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42254.exe
        5⤵
        
        PID:4768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26660.exe
        5⤵
        
        PID:5956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61978.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17704.exe
        5⤵
        
        PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65002.exe
        5⤵
        
        PID:1792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60642.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24375.exe
        5⤵
        
        PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32528.exe
        5⤵
        
        PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13902.exe
        5⤵
        
        PID:5336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16068.exe
      4⤵
      PID:2600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38989.exe
      4⤵
      PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39168.exe
      4⤵
      PID:3428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46966.exe
      4⤵
      PID:3660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42254.exe
      4⤵
      PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26660.exe
      4⤵
      PID:5972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31038.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31038.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39774.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58378.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15360.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18265.exe
        6⤵
        
        PID:3812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8200.exe
        6⤵
        
        PID:4672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15993.exe
        6⤵
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
        6⤵
        
        PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13271.exe
        5⤵
        
        PID:2804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43154.exe
        5⤵
        
        PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10368.exe
        5⤵
        
        PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3940.exe
        5⤵
        
        PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36460.exe
        5⤵
        
        PID:5672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55726.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25252.exe
        5⤵
        
        PID:1332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25993.exe
        5⤵
        
        PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60768.exe
        5⤵
        
        PID:3696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10437.exe
        5⤵
        
        PID:5028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36460.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29095.exe
      4⤵
      PID:1704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20923.exe
      4⤵
      PID:3484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19025.exe
      4⤵
      PID:3792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52942.exe
      4⤵
      PID:4548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55280.exe
      4⤵
      PID:5460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55845.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55845.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35192.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20762.exe
      4⤵
      PID:2700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-943.exe
      4⤵
      PID:3924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10752.exe
      4⤵
      PID:3616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3940.exe
      4⤵
      PID:4880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36460.exe
      4⤵
      PID:5740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28207.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28207.exe
    3⤵
    PID:2944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60301.exe
      4⤵
      PID:4604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42013.exe
      4⤵
      PID:2476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55796.exe
      4⤵
      PID:5792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15162.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15162.exe
    3⤵
    PID:2436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43790.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43790.exe
    3⤵
    PID:3644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42539.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42539.exe
    3⤵
    PID:3828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43141.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43141.exe
    3⤵
    PID:4784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8302.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8302.exe
    3⤵
    PID:5136
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53894.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53894.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47200.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47200.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17434.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3126.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18176.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24829.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        8⤵
        
        PID:1032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34083.exe
        8⤵
        
        PID:1008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41976.exe
        8⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8200.exe
        8⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15993.exe
        8⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53266.exe
        8⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39254.exe
        7⤵
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51671.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-581.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35329.exe
        8⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61661.exe
        8⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40384.exe
        7⤵
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64168.exe
        7⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31291.exe
        7⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15819.exe
        7⤵
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31995.exe
        7⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41719.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56757.exe
        7⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-78.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-78.exe
        7⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55796.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21887.exe
        6⤵
        
        PID:2480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51511.exe
        6⤵
        
        PID:3576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42235.exe
        6⤵
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4470.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31995.exe
        6⤵
        
        PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18730.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16085.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24201.exe
        7⤵
        
        PID:316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20762.exe
        7⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46060.exe
        7⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6668.exe
        7⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32528.exe
        7⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36460.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10365.exe
        6⤵
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34497.exe
        6⤵
        
        PID:1188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37535.exe
        6⤵
        
        PID:3832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-373.exe
        6⤵
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4470.exe
        6⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31995.exe
        6⤵
        
        PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31142.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14989.exe
        6⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37138.exe
        7⤵
        
        PID:836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20762.exe
        7⤵
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27585.exe
        7⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16908.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52942.exe
        7⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
        7⤵
        
        PID:6072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41776.exe
        6⤵
        
        PID:1980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34497.exe
        6⤵
        
        PID:2652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64339.exe
        6⤵
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52633.exe
        6⤵
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49519.exe
        6⤵
        
        PID:4136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26660.exe
        6⤵
        
        PID:5980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21330.exe
        5⤵
        
        PID:2872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39975.exe
        5⤵
        
        PID:2252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52599.exe
        5⤵
        
        PID:3876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42882.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11528.exe
        5⤵
        
        PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26660.exe
        5⤵
        
        PID:5916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61818.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38596.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61585.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39450.exe
        7⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53233.exe
        7⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54711.exe
        7⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13648.exe
        7⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52996.exe
        7⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55215.exe
        6⤵
        
        PID:1392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6397.exe
        6⤵
        
        PID:3932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38774.exe
        6⤵
        
        PID:4656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15819.exe
        6⤵
        
        PID:4472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31995.exe
        6⤵
        
        PID:5856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30043.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3780.exe
        6⤵
        
        PID:2060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34518.exe
        6⤵
        
        PID:3284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11380.exe
        6⤵
        
        PID:3368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47827.exe
        6⤵
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64291.exe
        6⤵
        
        PID:4156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
        6⤵
        
        PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63187.exe
        5⤵
        
        PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40363.exe
        5⤵
        
        PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20701.exe
        5⤵
        
        PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47004.exe
        5⤵
        
        PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4470.exe
        5⤵
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40163.exe
        5⤵
        
        PID:6092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3685.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17621.exe
        5⤵
        
        PID:2468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35174.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28624.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26760.exe
        6⤵
        
        PID:4200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16497.exe
        6⤵
        
        PID:4288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53982.exe
        6⤵
        
        PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29039.exe
        5⤵
        
        PID:864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60176.exe
        5⤵
        
        PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58771.exe
        5⤵
        
        PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52942.exe
        5⤵
        
        PID:4664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
        5⤵
        
        PID:6024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9763.exe
      4⤵
      PID:1588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30898.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50114.exe
        5⤵
        
        PID:3380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60768.exe
        5⤵
        
        PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4983.exe
        5⤵
        
        PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36460.exe
        5⤵
        
        PID:5624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39975.exe
      4⤵
      PID:2380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52599.exe
      4⤵
      PID:3884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22010.exe
      4⤵
      PID:4728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36919.exe
      4⤵
      PID:4928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30860.exe
      4⤵
      PID:5616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38107.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38107.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25384.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30859.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55402.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30269.exe
        6⤵
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26760.exe
        6⤵
        
        PID:4220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41194.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52996.exe
        6⤵
        
        PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48609.exe
        5⤵
        
        PID:1788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64297.exe
        6⤵
        
        PID:4124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51988.exe
        6⤵
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12708.exe
        6⤵
        
        PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37124.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59185.exe
        5⤵
        
        PID:2372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32528.exe
        5⤵
        
        PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44628.exe
        5⤵
        
        PID:5244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62716.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56570.exe
        5⤵
        
        PID:1500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7675.exe
        5⤵
        
        PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        5⤵
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61661.exe
        5⤵
        
        PID:5632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27234.exe
      4⤵
      PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8641.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8730.exe
      4⤵
      PID:4644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48476.exe
      4⤵
      PID:4692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4102.exe
      4⤵
      PID:5328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44526.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44526.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49442.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15360.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17004.exe
        5⤵
        
        PID:3492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27691.exe
        5⤵
        
        PID:2120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22222.exe
        5⤵
        
        PID:4296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45479.exe
        5⤵
        
        PID:5428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29095.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14125.exe
      4⤵
      PID:3500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15785.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4470.exe
      4⤵
      PID:4736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43847.exe
      4⤵
      PID:5536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29333.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29333.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46300.exe
      4⤵
      PID:2548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58199.exe
      4⤵
      PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53320.exe
      4⤵
      PID:4036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12605.exe
      4⤵
      PID:4916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52996.exe
      4⤵
      PID:5756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26295.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26295.exe
    3⤵
    PID:1692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61260.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61260.exe
    3⤵
    PID:3520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19555.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19555.exe
    3⤵
    PID:3720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48476.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48476.exe
    3⤵
    PID:4700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26660.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26660.exe
    3⤵
    PID:5964
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30763.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30763.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31331.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31331.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34429.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26152.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38041.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39450.exe
        7⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56636.exe
        7⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12605.exe
        7⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49563.exe
        7⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29039.exe
        6⤵
        
        PID:2260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60176.exe
        6⤵
        
        PID:3480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58771.exe
        6⤵
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15993.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30968.exe
        6⤵
        
        PID:5252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63292.exe
        5⤵
        
        PID:1676
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 240
        6⤵
        Program crash
        
        PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31718.exe
        5⤵
        
        PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16906.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48357.exe
        5⤵
        
        PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50889.exe
        5⤵
        
        PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26660.exe
        5⤵
        
        PID:5988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33660.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30231.exe
        5⤵
        
        PID:1600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20762.exe
        5⤵
        
        PID:2740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30218.exe
        5⤵
        
        PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58771.exe
        5⤵
        
        PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52942.exe
        5⤵
        
        PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
        5⤵
        
        PID:6064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26046.exe
      4⤵
      PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40363.exe
      4⤵
      PID:2136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63680.exe
      4⤵
      PID:3860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16278.exe
      4⤵
      PID:264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63785.exe
      4⤵
      PID:4800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31995.exe
      4⤵
      PID:5692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36436.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36436.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43028.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9919.exe
        5⤵
        
        PID:972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47810.exe
        6⤵
        
        PID:2692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25993.exe
        6⤵
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61571.exe
        6⤵
        
        PID:4356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12605.exe
        6⤵
        
        PID:4924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52996.exe
        6⤵
        
        PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12262.exe
        5⤵
        
        PID:3908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50520.exe
        5⤵
        
        PID:3400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15993.exe
        5⤵
        
        PID:5000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
        5⤵
        
        PID:6112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-936.exe
      4⤵
      PID:2416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34497.exe
      4⤵
      PID:1532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2724.exe
      4⤵
      PID:3772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2087.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15993.exe
      4⤵
      PID:4148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
      4⤵
      PID:6140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61402.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61402.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6201.exe
      4⤵
      PID:1084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40383.exe
      4⤵
      PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61571.exe
      4⤵
      PID:4348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12605.exe
      4⤵
      PID:4912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52996.exe
      4⤵
      PID:5772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14397.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14397.exe
    3⤵
    PID:3004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34131.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34131.exe
    3⤵
    PID:3676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27954.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27954.exe
    3⤵
    PID:3448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63785.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63785.exe
    3⤵
    PID:4748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43847.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43847.exe
    3⤵
    PID:5524
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43318.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43318.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58549.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58549.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53749.exe
      4⤵
      PID:2856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12978.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54119.exe
      4⤵
      PID:3864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1899.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3940.exe
      4⤵
      PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36460.exe
      4⤵
      PID:5684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29095.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29095.exe
    3⤵
    PID:2924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41506.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41506.exe
    3⤵
    PID:4040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33984.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33984.exe
    3⤵
    PID:3656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4470.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4470.exe
    3⤵
    PID:4828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31995.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31995.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5700
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4777.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4777.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55228.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55228.exe
    3⤵
    PID:2576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28053.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28053.exe
    3⤵
    PID:1956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58504.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58504.exe
    3⤵
    PID:3420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8200.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8200.exe
    3⤵
    PID:4720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52942.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52942.exe
    3⤵
    PID:4492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6104
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50183.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50183.exe
  2⤵
  PID:2536
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45549.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45549.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1012
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65238.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65238.exe
  2⤵
  PID:3808
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6478.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6478.exe
  2⤵
  PID:3516
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18177.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18177.exe
  2⤵
  PID:4400
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3124.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3124.exe
  2⤵
  PID:5716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-31331.exe

Filesize
468KB

MD5
fa2cfbad92399193c8b88855b1ea92e2

SHA1
b8941f51b212e3f17bff268386fc68280c3a4477

SHA256
a0bd80082f4babfcb5a976b078b02fa37db769d500047ce62774fbfec31fe1bf

SHA512
b57daf82eefe044cf13683608aa5fa4851f5fd4132214c538f0dbb787a7a7cabd72c384fc583f918dea83431c3630a6b630fbd16f4824e8aa0fb7d1ae9dc5117

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38107.exe

Filesize
468KB

MD5
c7c54294908375d086caa7b240c4e9c4

SHA1
9c80c19c4b09d9a24539f98b683c761b9516cefe

SHA256
e7663bef766249b72a5472bc299fc3544b871990021b44025e88e7f26b3923b4

SHA512
e24b9dcfbb40e68353d53e967d0c731aefde8adcf47371fc210a53da0c95689d78bc02e4e2ee46845879d02fc847bdefb50bfb2235aed0842d607b1483b330da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42013.exe

Filesize
468KB

MD5
52adf72bd53f076854494167dc3dda02

SHA1
e7a94bbfb8a9660ca3d69f8779311269f86b6d65

SHA256
3d6d592e46b447f129e1eb49bedd19a9310f7797337e174a6321cc94c5dbebfb

SHA512
94591cefee5caf0f9093b676513a58363c2d1706c36d1074d410e21401a93c2bd5f54697df58dcdb47fe6f58c6baf4196596c46c2f8a921978be2fe29fde2a7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47200.exe

Filesize
468KB

MD5
27650edf53d61070316aa904ed00090d

SHA1
6899c3429bfb638953a5166e5e82f5a659148190

SHA256
de4caeff72255c5b948c4580397671b211df7bd416e1091cfb51b93eef9666c5

SHA512
ae982135f0ebfdf991139dde62b51b948ae18bcaefcd4d51ba85db1cb4b62a6789ba564126a0a8c618e06aa962b79472ee7ffb6fcc1331c95a284e6e35e1e35f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17434.exe

Filesize
468KB

MD5
2545fb44dde60b531cf6f98c7bdbc629

SHA1
44725d79d35ce880fe9d3403ec5e37906c00ccc1

SHA256
2dda3493c6c7fe9aa021d4988baaa5f589eeb6e988702fe931e060f27d19de54

SHA512
74dc53db1a9fdca4a61af0fa45642468a8dc98537b768ece5e9f3316117529b6b022af89e1efc53ef69ffc1550ff579ffde7cbb54f9de9826624537955a246c2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-30763.exe

Filesize
468KB

MD5
b8eb1bc13d216a43f98f61bf341bbf81

SHA1
0290974b80b2341b9af8fb0e5443761b6a6df0db

SHA256
3246ae60f5efe61f9e00fa1837fb1aaa283ec4c790488950ec1c4c46f395acfb

SHA512
a563750a0bc5331145bd29583a6642404785de385d6f12a09755f09f09a53f892ae7845f187bd7e5d3692a749dcc3afe9ec979603455152d96a1e631f6a8139a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31038.exe

Filesize
468KB

MD5
620b95e7263d31726879165c691b154b

SHA1
703bec1b2fdf7c37fe7f6b377e8dcb06543abfcd

SHA256
77211b948914d8148d2df29b615f250ce8fbcce80e68bd59eeba1ab947edde34

SHA512
13de1a43c791d1033dda17bbff1942eac742eba67002ca06c8cc09ee22ca761e1c5a6b6b3d41bb847158a6a02175a5f5b442d3cd7190be959bef8bc48b531610

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3126.exe

Filesize
468KB

MD5
e974bb6954779b0fd1dec835236977c4

SHA1
cf44175e0caf580701f3e44e9fd19258000ad4b9

SHA256
dd61ad392892323cf264df11f34f2fbb6708f22685d1badbfad94aa0a318f813

SHA512
df0f61ea02453119c00ceac272fd84dab64ad25ca92efa46d343af70ee4a14558fff8c1f80686e28a501bb5cbc737c18063ed5024f71857e2e4cf456a95d3dc8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3370.exe

Filesize
468KB

MD5
45663574a0c414d7cfd576cecde52a0d

SHA1
5c6366e8c5f849b89424425600eef1b73353f49c

SHA256
877edcfa3c16127ff30b46e4456b2eccd2e70b230bd75279e40bc803312746b2

SHA512
efdf1eb97a5a5e93dcb3f6d4ba1103feaa4160d981650a91051fc65eef13f7d88355486c56a9cfde6de60445e5befe9d692546752c732c26622288c068807165

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34429.exe

Filesize
468KB

MD5
9fb9769cff46c4887dc32d452b4a0df7

SHA1
48f7dfafa875a1274385e1cc69c7ac8f9510a884

SHA256
15174bec904b8dd8a821b22d9845109dfc9d4bbf599c7af3e46eadb70b1ab8d2

SHA512
a4c1ab1477699a57f1cf3365137b9f25f9831ff45aaad1a600b3d96a71158cfe3fb0848989abec7f6ff6cd88cf65d3b6800252d1aa6d48285cb1ec2acc495cba

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-35969.exe

Filesize
468KB

MD5
3f253cb1e4b36dc1f5d36af4243e2c77

SHA1
8bebb819d592b1444df8c17ff1d36a7e824e5937

SHA256
1b4e6980d92598e718ac18f12a2aa109ed81fb0401e705a93f7038611396f247

SHA512
36b44d33993882f7305c2a31506956c2a0c221f7f7725a02034a94cf26894834ee2a9cc932f6b47df1aa5a4c1b166f013702b98a67d1f7dbb3ffcf473be2b1f4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36436.exe

Filesize
468KB

MD5
c9847107c41ded8e0a9d253739f77adc

SHA1
225d8ed518e57138305f3169bc5f7d164d92efc8

SHA256
6c28dadec7fe0f0fdfeee9ce0985cea6ad0e8b64b65d6727cc9b0ff099411dde

SHA512
b9e915422f992048fda823bd9a3157636f52a285f1fa8bdcc59655fedca8e6522754726d921f5805ed14b2dc0122de6591d595df307e2af1f5f1cbd033add092

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37169.exe

Filesize
468KB

MD5
4b706a8658d99e28f7aea2d052db09f0

SHA1
e7caafa3b9c94ef120cf4ee5dc7c9e5b4c553759

SHA256
1c0af728d368a87537cfad13789b98994f46db8b5cdf84fb853c97f8861c8217

SHA512
7bf5e98dc9a678b7b464f69ffe75abc68dfd9bad42b84111aea3efe498887825f69f9093630e27900ec684418f0fd9e5e6719a5ee68b05d75ffc6cbdc1ba4f41

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-41532.exe

Filesize
468KB

MD5
29970b482cbe5c3865022686bef7db15

SHA1
b884344b4e2d4e00729e012c62b8505ae04808dd

SHA256
52b9698eb8fa5b427c0d759037fad5a65e58a9f92be54a55913c3394846b2b22

SHA512
4c41efbbcd94f1b3049dd0bed8460a5f0c6fcfb4fafd0f349335c6f1baf7ea12006e16f8ff0d0ddf742cfd46e0ba6a9b9a32e406620471f7fa311b19d94d432c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43318.exe

Filesize
468KB

MD5
6ac39a0860939d4dc5ee3b262d56717f

SHA1
07475e5035d3afc5febfbf9a7b3f398205512de1

SHA256
a4fc1111a45be432cbabd79a17daac86b66e3fb3ddcc290f8a8c43c6211266ae

SHA512
f6e7b7d886963be2d09eb2492673c0df4cdd1c50f5355b5f68792e0ec8ce5df67ebf3b5dce002c6f637095354c02d736f880a6136b5d00b3428fd422c3886d21

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53894.exe

Filesize
468KB

MD5
7c9f11c8ba0f91946d5810d57e955f27

SHA1
ad72b10d0bb241f34b2191a4a6beb8f8063768ec

SHA256
61983ac58780ec3835a7b6d2313e5f8d2c90a08765bedb4d4bf992b57d0cc4e3

SHA512
18d1df0d9e70b8392dd5c9565882b56bfe6cf4ac3c357799735ef791b2b03f03bfbfec7c68168542d1145c6b3d2e54779b5f8082d7f743bea28c343842a503ed

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56608.exe

Filesize
468KB

MD5
dabe7ee0e5feed632e7e972fb3129480

SHA1
5fac022fc3fc8444b416ac403d4744325b5a57f9

SHA256
6d4748588158344e0a487a0c5875d61d7772907f7ee067108b1e913bc3e82ee8

SHA512
34c82c17ba9527fe296f9911c4f912d68791a96905ea6583591770556c3722085c778e0926b73e784669e8605a26dc75c919f8371c37ff011cdfb40b97310f0f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61398.exe

Filesize
468KB

MD5
a5d65adbf203a95d07c8ee15359e2ebf

SHA1
7429cb3e19b856e35776b6d5d3878e33c2ee8685

SHA256
f20a83b6c166de8698e4fd779fc0a364673433ffbe33173b16d1a08b4f03a73d

SHA512
22ecbbe2a97981e7abc27b926daa12bc4593ab7d8a6b45e5ab348fdc7e0eeb8f43877891b0c84f61a1dc15d561541ebb03185f753a21fa8f6035d9db8db741ed

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61818.exe

Filesize
468KB

MD5
9e46ef80b8953589d711396a335c0463

SHA1
07812255cd33717323d9832e95b7a1deb4a367b6

SHA256
80fd207490948c056ad458476de0a3421e6972f1a15c880127a1db977d0aee69

SHA512
8f0d1ad7f642d0a70ce96b18e4e17f72a1353f2ae18adb680eef8ffbb19ee4fd6e8ca4b90da172d90e21f7f03da29295c0be073f9ff3e995a0f8602d0b960c14

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8772.exe

Filesize
468KB

MD5
df53d925bf956ec9cd1455b86733000a

SHA1
d1abc653b67551144b10ae0df3293d5706d5140f

SHA256
78b54bd2e961662995848dea4a840dd6ac78fd4532ed1cf5eea867420b295663

SHA512
27f49dadbae7d0945541f8edf6b84574d7f8f84e529f1a82a48a0b27356ad87edff2433d2c628a88b146c045dba7049eafdbcb5f4ff8aeb654c3ab34c80696c2

Download Submit