3951fb0dfedb30d9b21748695c55d9c73a0d9be54a6357ec8d5e021c4e9d65f3

Analysis

max time kernel
118s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 11:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3951fb0dfedb30d9b21748695c55d9c73a0d9be54a6357ec8d5e021c4e9d65f3.exe
Size

468KB
MD5

ccb307bc133532102be37e7581d41d79
SHA1

5b4f691b74d65995fb1485b0773ccd8c46739bc8
SHA256

3951fb0dfedb30d9b21748695c55d9c73a0d9be54a6357ec8d5e021c4e9d65f3
SHA512

74e11bf7483e922f0e35d9380f5e506abcc4856ae8e3b33af2f71b21f01130eb59cfbcb963fe7bb20ac3fb8d2ded163ce393aca517d9320cba542a3978821599
SSDEEP

3072:jJGio38dI03YtbYvPzejNfT/rYh7TIpqD3HCxVbYVhXLMjKa+1lKI:jJro1OYtYPqjNfQ0PQVhbSKa+Z

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2832	Unicorn-32344.exe
2884	Unicorn-64269.exe
2864	Unicorn-60740.exe
2416	Unicorn-57419.exe
2632	Unicorn-41445.exe
2788	Unicorn-49251.exe
1380	Unicorn-54797.exe
3024	Unicorn-23232.exe
2304	Unicorn-626.exe
1708	Unicorn-3963.exe
2948	Unicorn-47034.exe
2796	Unicorn-65416.exe
2588	Unicorn-20108.exe
564	Unicorn-19842.exe
1632	Unicorn-45359.exe
1780	Unicorn-44285.exe
1796	Unicorn-49116.exe
2272	Unicorn-20658.exe
2560	Unicorn-50900.exe
2156	Unicorn-57990.exe
316	Unicorn-1176.exe
1576	Unicorn-16958.exe
1056	Unicorn-47445.exe
1332	Unicorn-1773.exe
2352	Unicorn-1773.exe
3068	Unicorn-34373.exe
2552	Unicorn-25515.exe
2132	Unicorn-34446.exe
2596	Unicorn-28315.exe
2592	Unicorn-42784.exe
1020	Unicorn-7562.exe
1724	Unicorn-19985.exe
2528	Unicorn-24859.exe
1288	Unicorn-10368.exe
1664	Unicorn-12414.exe
2896	Unicorn-8330.exe
2772	Unicorn-54002.exe
2380	Unicorn-57074.exe
2648	Unicorn-24283.exe
2784	Unicorn-53618.exe
1936	Unicorn-26373.exe
2668	Unicorn-42840.exe
1564	Unicorn-26674.exe
2600	Unicorn-43800.exe
3036	Unicorn-51776.exe
2300	Unicorn-45646.exe
1416	Unicorn-64583.exe
948	Unicorn-51392.exe
864	Unicorn-61651.exe
1956	Unicorn-48251.exe
2920	Unicorn-54381.exe
572	Unicorn-1096.exe
2944	Unicorn-64203.exe
2468	Unicorn-48951.exe
2128	Unicorn-51257.exe
768	Unicorn-30380.exe
1328	Unicorn-61079.exe
904	Unicorn-22093.exe
984	Unicorn-16146.exe
1952	Unicorn-44350.exe
1312	Unicorn-17432.exe
1932	Unicorn-8060.exe
3052	Unicorn-46597.exe
2584	Unicorn-925.exe

Loads dropped DLL 64 IoCs

pid	Process
2448	3951fb0dfedb30d9b21748695c55d9c73a0d9be54a6357ec8d5e021c4e9d65f3.exe
2448	3951fb0dfedb30d9b21748695c55d9c73a0d9be54a6357ec8d5e021c4e9d65f3.exe
2832	Unicorn-32344.exe
2448	3951fb0dfedb30d9b21748695c55d9c73a0d9be54a6357ec8d5e021c4e9d65f3.exe
2832	Unicorn-32344.exe
2448	3951fb0dfedb30d9b21748695c55d9c73a0d9be54a6357ec8d5e021c4e9d65f3.exe
2864	Unicorn-60740.exe
2832	Unicorn-32344.exe
2864	Unicorn-60740.exe
2832	Unicorn-32344.exe
2884	Unicorn-64269.exe
2884	Unicorn-64269.exe
2448	3951fb0dfedb30d9b21748695c55d9c73a0d9be54a6357ec8d5e021c4e9d65f3.exe
2448	3951fb0dfedb30d9b21748695c55d9c73a0d9be54a6357ec8d5e021c4e9d65f3.exe
2416	Unicorn-57419.exe
2416	Unicorn-57419.exe
2864	Unicorn-60740.exe
2864	Unicorn-60740.exe
2632	Unicorn-41445.exe
2632	Unicorn-41445.exe
2832	Unicorn-32344.exe
2832	Unicorn-32344.exe
1380	Unicorn-54797.exe
1380	Unicorn-54797.exe
2788	Unicorn-49251.exe
2788	Unicorn-49251.exe
2448	3951fb0dfedb30d9b21748695c55d9c73a0d9be54a6357ec8d5e021c4e9d65f3.exe
2448	3951fb0dfedb30d9b21748695c55d9c73a0d9be54a6357ec8d5e021c4e9d65f3.exe
2884	Unicorn-64269.exe
2884	Unicorn-64269.exe
3024	Unicorn-23232.exe
2416	Unicorn-57419.exe
3024	Unicorn-23232.exe
2416	Unicorn-57419.exe
2304	Unicorn-626.exe
2304	Unicorn-626.exe
2864	Unicorn-60740.exe
2864	Unicorn-60740.exe
2796	Unicorn-65416.exe
2796	Unicorn-65416.exe
1380	Unicorn-54797.exe
1708	Unicorn-3963.exe
1380	Unicorn-54797.exe
1708	Unicorn-3963.exe
2632	Unicorn-41445.exe
2632	Unicorn-41445.exe
1632	Unicorn-45359.exe
564	Unicorn-19842.exe
564	Unicorn-19842.exe
1632	Unicorn-45359.exe
2832	Unicorn-32344.exe
2832	Unicorn-32344.exe
2884	Unicorn-64269.exe
2448	3951fb0dfedb30d9b21748695c55d9c73a0d9be54a6357ec8d5e021c4e9d65f3.exe
2588	Unicorn-20108.exe
2588	Unicorn-20108.exe
2448	3951fb0dfedb30d9b21748695c55d9c73a0d9be54a6357ec8d5e021c4e9d65f3.exe
2884	Unicorn-64269.exe
2788	Unicorn-49251.exe
2788	Unicorn-49251.exe
1780	Unicorn-44285.exe
1780	Unicorn-44285.exe
3024	Unicorn-23232.exe
3024	Unicorn-23232.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3012	2996	WerFault.exe	132

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3951fb0dfedb30d9b21748695c55d9c73a0d9be54a6357ec8d5e021c4e9d65f3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41995.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12534.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54749.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5048.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23156.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28080.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43781.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38453.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62417.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5048.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49251.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8060.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43114.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51293.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16958.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45646.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6109.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24643.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35520.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64203.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30380.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64131.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33098.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38213.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48309.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65012.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35882.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5949.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47445.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58887.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19520.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33314.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41120.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1773.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46406.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9325.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59259.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34953.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61871.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58427.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58216.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36892.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55279.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47317.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39414.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41445.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23592.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50142.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62604.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19332.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34002.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2448	3951fb0dfedb30d9b21748695c55d9c73a0d9be54a6357ec8d5e021c4e9d65f3.exe
2832	Unicorn-32344.exe
2884	Unicorn-64269.exe
2864	Unicorn-60740.exe
2416	Unicorn-57419.exe
2632	Unicorn-41445.exe
2788	Unicorn-49251.exe
1380	Unicorn-54797.exe
3024	Unicorn-23232.exe
2304	Unicorn-626.exe
2588	Unicorn-20108.exe
1632	Unicorn-45359.exe
564	Unicorn-19842.exe
1708	Unicorn-3963.exe
2796	Unicorn-65416.exe
2948	Unicorn-47034.exe
1780	Unicorn-44285.exe
1796	Unicorn-49116.exe
2272	Unicorn-20658.exe
2560	Unicorn-50900.exe
2156	Unicorn-57990.exe
316	Unicorn-1176.exe
1576	Unicorn-16958.exe
1056	Unicorn-47445.exe
2352	Unicorn-1773.exe
2132	Unicorn-34446.exe
2596	Unicorn-28315.exe
2552	Unicorn-25515.exe
1332	Unicorn-1773.exe
3068	Unicorn-34373.exe
2592	Unicorn-42784.exe
1020	Unicorn-7562.exe
1724	Unicorn-19985.exe
2528	Unicorn-24859.exe
1664	Unicorn-12414.exe
2772	Unicorn-54002.exe
2896	Unicorn-8330.exe
2648	Unicorn-24283.exe
2380	Unicorn-57074.exe
1936	Unicorn-26373.exe
2784	Unicorn-53618.exe
2668	Unicorn-42840.exe
1564	Unicorn-26674.exe
2300	Unicorn-45646.exe
2600	Unicorn-43800.exe
1416	Unicorn-64583.exe
3036	Unicorn-51776.exe
948	Unicorn-51392.exe
864	Unicorn-61651.exe
2920	Unicorn-54381.exe
1956	Unicorn-48251.exe
572	Unicorn-1096.exe
1944	Unicorn-45829.exe
2944	Unicorn-64203.exe
2468	Unicorn-48951.exe
2128	Unicorn-51257.exe
768	Unicorn-30380.exe
1328	Unicorn-61079.exe
984	Unicorn-16146.exe
904	Unicorn-22093.exe
1952	Unicorn-44350.exe
1312	Unicorn-17432.exe
1932	Unicorn-8060.exe
3052	Unicorn-46597.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2832	2448	3951fb0dfedb30d9b21748695c55d9c73a0d9be54a6357ec8d5e021c4e9d65f3.exe	30
PID 2448 wrote to memory of 2832	2448	3951fb0dfedb30d9b21748695c55d9c73a0d9be54a6357ec8d5e021c4e9d65f3.exe	30
PID 2448 wrote to memory of 2832	2448	3951fb0dfedb30d9b21748695c55d9c73a0d9be54a6357ec8d5e021c4e9d65f3.exe	30
PID 2448 wrote to memory of 2832	2448	3951fb0dfedb30d9b21748695c55d9c73a0d9be54a6357ec8d5e021c4e9d65f3.exe	30
PID 2832 wrote to memory of 2884	2832	Unicorn-32344.exe	31
PID 2832 wrote to memory of 2884	2832	Unicorn-32344.exe	31
PID 2832 wrote to memory of 2884	2832	Unicorn-32344.exe	31
PID 2832 wrote to memory of 2884	2832	Unicorn-32344.exe	31
PID 2448 wrote to memory of 2864	2448	3951fb0dfedb30d9b21748695c55d9c73a0d9be54a6357ec8d5e021c4e9d65f3.exe	32
PID 2448 wrote to memory of 2864	2448	3951fb0dfedb30d9b21748695c55d9c73a0d9be54a6357ec8d5e021c4e9d65f3.exe	32
PID 2448 wrote to memory of 2864	2448	3951fb0dfedb30d9b21748695c55d9c73a0d9be54a6357ec8d5e021c4e9d65f3.exe	32
PID 2448 wrote to memory of 2864	2448	3951fb0dfedb30d9b21748695c55d9c73a0d9be54a6357ec8d5e021c4e9d65f3.exe	32
PID 2864 wrote to memory of 2416	2864	Unicorn-60740.exe	33
PID 2864 wrote to memory of 2416	2864	Unicorn-60740.exe	33
PID 2864 wrote to memory of 2416	2864	Unicorn-60740.exe	33
PID 2864 wrote to memory of 2416	2864	Unicorn-60740.exe	33
PID 2832 wrote to memory of 2632	2832	Unicorn-32344.exe	34
PID 2832 wrote to memory of 2632	2832	Unicorn-32344.exe	34
PID 2832 wrote to memory of 2632	2832	Unicorn-32344.exe	34
PID 2832 wrote to memory of 2632	2832	Unicorn-32344.exe	34
PID 2884 wrote to memory of 2788	2884	Unicorn-64269.exe	35
PID 2884 wrote to memory of 2788	2884	Unicorn-64269.exe	35
PID 2884 wrote to memory of 2788	2884	Unicorn-64269.exe	35
PID 2884 wrote to memory of 2788	2884	Unicorn-64269.exe	35
PID 2448 wrote to memory of 1380	2448	3951fb0dfedb30d9b21748695c55d9c73a0d9be54a6357ec8d5e021c4e9d65f3.exe	36
PID 2448 wrote to memory of 1380	2448	3951fb0dfedb30d9b21748695c55d9c73a0d9be54a6357ec8d5e021c4e9d65f3.exe	36
PID 2448 wrote to memory of 1380	2448	3951fb0dfedb30d9b21748695c55d9c73a0d9be54a6357ec8d5e021c4e9d65f3.exe	36
PID 2448 wrote to memory of 1380	2448	3951fb0dfedb30d9b21748695c55d9c73a0d9be54a6357ec8d5e021c4e9d65f3.exe	36
PID 2416 wrote to memory of 3024	2416	Unicorn-57419.exe	37
PID 2416 wrote to memory of 3024	2416	Unicorn-57419.exe	37
PID 2416 wrote to memory of 3024	2416	Unicorn-57419.exe	37
PID 2416 wrote to memory of 3024	2416	Unicorn-57419.exe	37
PID 2864 wrote to memory of 2304	2864	Unicorn-60740.exe	38
PID 2864 wrote to memory of 2304	2864	Unicorn-60740.exe	38
PID 2864 wrote to memory of 2304	2864	Unicorn-60740.exe	38
PID 2864 wrote to memory of 2304	2864	Unicorn-60740.exe	38
PID 2632 wrote to memory of 1708	2632	Unicorn-41445.exe	39
PID 2632 wrote to memory of 1708	2632	Unicorn-41445.exe	39
PID 2632 wrote to memory of 1708	2632	Unicorn-41445.exe	39
PID 2632 wrote to memory of 1708	2632	Unicorn-41445.exe	39
PID 2832 wrote to memory of 2948	2832	Unicorn-32344.exe	40
PID 2832 wrote to memory of 2948	2832	Unicorn-32344.exe	40
PID 2832 wrote to memory of 2948	2832	Unicorn-32344.exe	40
PID 2832 wrote to memory of 2948	2832	Unicorn-32344.exe	40
PID 1380 wrote to memory of 2796	1380	Unicorn-54797.exe	41
PID 1380 wrote to memory of 2796	1380	Unicorn-54797.exe	41
PID 1380 wrote to memory of 2796	1380	Unicorn-54797.exe	41
PID 1380 wrote to memory of 2796	1380	Unicorn-54797.exe	41
PID 2788 wrote to memory of 2588	2788	Unicorn-49251.exe	42
PID 2788 wrote to memory of 2588	2788	Unicorn-49251.exe	42
PID 2788 wrote to memory of 2588	2788	Unicorn-49251.exe	42
PID 2788 wrote to memory of 2588	2788	Unicorn-49251.exe	42
PID 2448 wrote to memory of 564	2448	3951fb0dfedb30d9b21748695c55d9c73a0d9be54a6357ec8d5e021c4e9d65f3.exe	43
PID 2448 wrote to memory of 564	2448	3951fb0dfedb30d9b21748695c55d9c73a0d9be54a6357ec8d5e021c4e9d65f3.exe	43
PID 2448 wrote to memory of 564	2448	3951fb0dfedb30d9b21748695c55d9c73a0d9be54a6357ec8d5e021c4e9d65f3.exe	43
PID 2448 wrote to memory of 564	2448	3951fb0dfedb30d9b21748695c55d9c73a0d9be54a6357ec8d5e021c4e9d65f3.exe	43
PID 2884 wrote to memory of 1632	2884	Unicorn-64269.exe	44
PID 2884 wrote to memory of 1632	2884	Unicorn-64269.exe	44
PID 2884 wrote to memory of 1632	2884	Unicorn-64269.exe	44
PID 2884 wrote to memory of 1632	2884	Unicorn-64269.exe	44
PID 3024 wrote to memory of 1780	3024	Unicorn-23232.exe	45
PID 3024 wrote to memory of 1780	3024	Unicorn-23232.exe	45
PID 3024 wrote to memory of 1780	3024	Unicorn-23232.exe	45
PID 3024 wrote to memory of 1780	3024	Unicorn-23232.exe	45

C:\Users\Admin\AppData\Local\Temp\3951fb0dfedb30d9b21748695c55d9c73a0d9be54a6357ec8d5e021c4e9d65f3.exe
"C:\Users\Admin\AppData\Local\Temp\3951fb0dfedb30d9b21748695c55d9c73a0d9be54a6357ec8d5e021c4e9d65f3.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32344.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32344.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64269.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64269.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49251.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20108.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34446.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16146.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56296.exe
        8⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34002.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59077.exe
        8⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33823.exe
        8⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55347.exe
        8⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4635.exe
        7⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47738.exe
        7⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61871.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48309.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15573.exe
        6⤵
        
        PID:2780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34833.exe
        6⤵
        
        PID:2960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1532.exe
        6⤵
        
        PID:3632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24023.exe
        6⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43781.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42784.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54381.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44729.exe
        7⤵
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34002.exe
        7⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22320.exe
        7⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53846.exe
        7⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35520.exe
        7⤵
        
        PID:4100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4251.exe
        6⤵
        
        PID:568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47738.exe
        6⤵
        
        PID:2080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24102.exe
        6⤵
        
        PID:3884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54749.exe
        6⤵
        
        PID:3492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20087.exe
        6⤵
        
        PID:4164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64203.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63160.exe
        6⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41120.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1973.exe
        5⤵
        
        PID:2640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14351.exe
        5⤵
        
        PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43114.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55279.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15622.exe
        5⤵
        
        PID:4180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45359.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1773.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55087.exe
        6⤵
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33298.exe
        7⤵
        
        PID:1344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
        7⤵
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54856.exe
        7⤵
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59259.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27540.exe
        6⤵
        
        PID:3140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28627.exe
        6⤵
        
        PID:3372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54749.exe
        6⤵
        
        PID:3380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35463.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61070.exe
        5⤵
        
        PID:1192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43193.exe
        5⤵
        
        PID:916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30298.exe
        5⤵
        
        PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24643.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43250.exe
        5⤵
        
        PID:5040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28315.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22093.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53669.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54982.exe
        6⤵
        
        PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47910.exe
        5⤵
        
        PID:2068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38964.exe
        5⤵
        
        PID:3448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11680.exe
        5⤵
        
        PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64781.exe
        5⤵
        
        PID:5052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8060.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17992.exe
      4⤵
      PID:2092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62604.exe
      4⤵
      PID:3608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52725.exe
      4⤵
      PID:3340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8348.exe
      4⤵
      PID:4748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41445.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41445.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3963.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42840.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35814.exe
        7⤵
        
        PID:556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36799.exe
        7⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6535.exe
        7⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28080.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35520.exe
        7⤵
        
        PID:4112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23156.exe
        6⤵
        
        PID:2504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47738.exe
        6⤵
        
        PID:2800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19961.exe
        6⤵
        
        PID:1120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29358.exe
        6⤵
        
        PID:4552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
        6⤵
        
        PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26674.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14111.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62954.exe
        6⤵
        
        PID:1676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33098.exe
        6⤵
        
        PID:3432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49844.exe
        6⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2092.exe
        6⤵
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63933.exe
        6⤵
        
        PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9325.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53603.exe
        5⤵
        
        PID:2688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45335.exe
        5⤵
        
        PID:3644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28761.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25720.exe
        5⤵
        
        PID:5004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47445.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43800.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22865.exe
        6⤵
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53316.exe
        6⤵
        
        PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9835.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47738.exe
        5⤵
        
        PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29457.exe
        5⤵
        
        PID:3080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22124.exe
        5⤵
        
        PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49856.exe
        5⤵
        
        PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45646.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44350.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33629.exe
        6⤵
        
        PID:2192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34002.exe
        6⤵
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59077.exe
        6⤵
        
        PID:3716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53846.exe
        6⤵
        
        PID:3600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35520.exe
        6⤵
        
        PID:4160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5949.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23156.exe
        5⤵
        
        PID:1768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47738.exe
        5⤵
        
        PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39343.exe
        5⤵
        
        PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54749.exe
        5⤵
        
        PID:3472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34560.exe
        5⤵
        
        PID:4620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-660.exe
      4⤵
      PID:2536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4657.exe
      4⤵
      PID:2244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8205.exe
      4⤵
      PID:3148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20491.exe
      4⤵
      PID:3592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33748.exe
      4⤵
      PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10287.exe
      4⤵
      PID:4216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47034.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47034.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26373.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20033.exe
        5⤵
        
        PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34002.exe
        5⤵
        
        PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22320.exe
        5⤵
        
        PID:3824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33823.exe
        5⤵
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25415.exe
        5⤵
        
        PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36892.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53603.exe
      4⤵
      PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39941.exe
      4⤵
      PID:3688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38213.exe
      4⤵
      PID:3120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16540.exe
      4⤵
      PID:4364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34373.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34373.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28227.exe
      4⤵
      PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39414.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23592.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33098.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49844.exe
      4⤵
      PID:4084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47209.exe
      4⤵
      PID:4916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7441.exe
      4⤵
      PID:4900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8689.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8689.exe
    3⤵
    PID:2868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54749.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54749.exe
    3⤵
    PID:1784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62604.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62604.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28413.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28413.exe
    3⤵
    PID:4080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59412.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59412.exe
    3⤵
    PID:4316
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60740.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60740.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57419.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57419.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23232.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44285.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7562.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51392.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34953.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17991.exe
        8⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62261.exe
        8⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31765.exe
        8⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15948.exe
        7⤵
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47738.exe
        7⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19961.exe
        7⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50292.exe
        7⤵
        
        PID:3272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61651.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41995.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43343.exe
        7⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29728.exe
        7⤵
        
        PID:3740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47317.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56108.exe
        6⤵
        
        PID:2076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44148.exe
        6⤵
        
        PID:1700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23469.exe
        6⤵
        
        PID:2040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48117.exe
        6⤵
        
        PID:4708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5048.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19985.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17432.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25657.exe
        7⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13949.exe
        7⤵
        
        PID:4724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7457.exe
        6⤵
        
        PID:1088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33406.exe
        6⤵
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19961.exe
        6⤵
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38213.exe
        6⤵
        
        PID:3208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41237.exe
        6⤵
        
        PID:3736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48251.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13982.exe
        6⤵
        
        PID:3260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47620.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58427.exe
        6⤵
        
        PID:3168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52056.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50982.exe
        5⤵
        
        PID:516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14351.exe
        5⤵
        
        PID:2840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2100.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19332.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25720.exe
        5⤵
        
        PID:2520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49116.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24859.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-925.exe
        6⤵
        Executes dropped EXE
        
        PID:2584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37328.exe
        6⤵
        
        PID:2704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38964.exe
        6⤵
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41179.exe
        6⤵
        
        PID:3860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51094.exe
        6⤵
        
        PID:4828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35882.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46597.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7457.exe
        5⤵
        
        PID:2012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33406.exe
        5⤵
        
        PID:3172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60733.exe
        5⤵
        
        PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40863.exe
        5⤵
        
        PID:3252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44620.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10368.exe
      4⤵
      Executes dropped EXE
      PID:1288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45829.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54247.exe
        6⤵
        
        PID:3304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43343.exe
        6⤵
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26295.exe
        6⤵
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52056.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47910.exe
        5⤵
        
        PID:2740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17151.exe
        5⤵
        
        PID:2276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2778.exe
        5⤵
        
        PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54749.exe
        5⤵
        
        PID:3516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20087.exe
        5⤵
        
        PID:4172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41932.exe
        5⤵
        
        PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53333.exe
        5⤵
        
        PID:1104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33098.exe
        5⤵
        
        PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49844.exe
        5⤵
        
        PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58885.exe
        5⤵
        
        PID:4980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46406.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13404.exe
        5⤵
        
        PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8219.exe
        5⤵
        
        PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60177.exe
      4⤵
      PID:2608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30829.exe
      4⤵
      PID:3400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-819.exe
      4⤵
      PID:3640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19529.exe
      4⤵
      PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5048.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-626.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-626.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20658.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12414.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43022.exe
        6⤵
        
        PID:1500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34002.exe
        6⤵
        
        PID:2728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28627.exe
        6⤵
        
        PID:3564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54749.exe
        6⤵
        
        PID:3520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3367.exe
        6⤵
        
        PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4251.exe
        5⤵
        
        PID:664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47738.exe
        5⤵
        
        PID:756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36036.exe
        5⤵
        
        PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64983.exe
        5⤵
        
        PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31055.exe
        5⤵
        
        PID:5112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20033.exe
        5⤵
        
        PID:580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34002.exe
        5⤵
        
        PID:2532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22320.exe
        5⤵
        
        PID:3832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63414.exe
        5⤵
        
        PID:3076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16010.exe
        5⤵
        
        PID:4384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27498.exe
      4⤵
      PID:2428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53603.exe
      4⤵
      PID:3008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19520.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54376.exe
      4⤵
      PID:3276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44620.exe
      4⤵
      PID:4272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50900.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50900.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8330.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47360.exe
        5⤵
        
        PID:932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2980.exe
        5⤵
        
        PID:2672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33098.exe
        5⤵
        
        PID:3416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33508.exe
        5⤵
        
        PID:3792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51293.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10648.exe
        5⤵
        
        PID:4492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10774.exe
      4⤵
      PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1531.exe
      4⤵
      PID:924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38964.exe
      4⤵
      PID:3440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41179.exe
      4⤵
      PID:3896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64781.exe
      4⤵
      PID:5060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57074.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57074.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62415.exe
      4⤵
      PID:3316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11023.exe
      4⤵
      PID:3572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58427.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2480.exe
      4⤵
      PID:4276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34091.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34091.exe
    3⤵
    PID:1384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28402.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28402.exe
    3⤵
    PID:1316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
    3⤵
    PID:3744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23426.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23426.exe
    3⤵
    PID:3788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29920.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29920.exe
    3⤵
    PID:4604
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54797.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54797.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65416.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65416.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57990.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24283.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50142.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12534.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57549.exe
        6⤵
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24676.exe
        6⤵
        
        PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23156.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47738.exe
        5⤵
        
        PID:1396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19961.exe
        5⤵
        
        PID:1592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50292.exe
        5⤵
        
        PID:4128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58216.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53618.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2280.exe
        5⤵
        
        PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17991.exe
        5⤵
        
        PID:3772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44773.exe
        5⤵
        
        PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14084.exe
        5⤵
        
        PID:4200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36892.exe
      4⤵
      PID:2452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53603.exe
      4⤵
      PID:2932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15436.exe
      4⤵
      PID:3868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60754.exe
      4⤵
      PID:4612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62417.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1176.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1176.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51257.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35814.exe
        5⤵
        
        PID:1476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63333.exe
        5⤵
        
        PID:796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26269.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49762.exe
        5⤵
        
        PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35520.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54625.exe
      4⤵
      PID:2996
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 188
        5⤵
        Program crash
        
        PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52180.exe
      4⤵
      PID:2328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32135.exe
      4⤵
      PID:3228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54749.exe
      4⤵
      PID:3504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65012.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61079.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61079.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54247.exe
      4⤵
      PID:3296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43343.exe
      4⤵
      PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29728.exe
      4⤵
      PID:3728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47317.exe
      4⤵
      PID:4804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1973.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1973.exe
    3⤵
    PID:2324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14351.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14351.exe
    3⤵
    PID:2260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2100.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2100.exe
    3⤵
    PID:3256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19332.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19332.exe
    3⤵
    PID:3192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48820.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48820.exe
    3⤵
    PID:4188
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19842.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19842.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1773.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51776.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15585.exe
        5⤵
        
        PID:1464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38283.exe
        5⤵
        
        PID:2096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24643.exe
        5⤵
        
        PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2622.exe
        5⤵
        
        PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39047.exe
        5⤵
        
        PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23156.exe
      4⤵
      PID:976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47738.exe
      4⤵
      PID:2268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28186.exe
      4⤵
      PID:3804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54749.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55884.exe
      4⤵
      PID:1456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64583.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64583.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31957.exe
      4⤵
      PID:2916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64131.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32135.exe
      4⤵
      PID:3220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54749.exe
      4⤵
      PID:3496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60946.exe
      4⤵
      PID:4836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36892.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36892.exe
    3⤵
    PID:2396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53603.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53603.exe
    3⤵
    PID:2792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15436.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15436.exe
    3⤵
    PID:3876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38213.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38213.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49597.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49597.exe
    3⤵
    PID:4204
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25515.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25515.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35814.exe
      4⤵
      PID:2540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11012.exe
      4⤵
      PID:3108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28627.exe
      4⤵
      PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54749.exe
      4⤵
      PID:3356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7469.exe
      4⤵
      PID:4264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6109.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6109.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58703.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58703.exe
    3⤵
    PID:1736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63407.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63407.exe
    3⤵
    PID:1980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11545.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11545.exe
    3⤵
    PID:3856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52586.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52586.exe
    3⤵
    PID:4996
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48951.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48951.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49585.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49585.exe
    3⤵
    PID:4452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38453.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38453.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4588
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59375.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59375.exe
  2⤵
  PID:2660
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58887.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58887.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1148
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33314.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33314.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3336
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32613.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32613.exe
  2⤵
  PID:3840
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52288.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52288.exe
  2⤵
  PID:4232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-20108.exe

Filesize
468KB

MD5
cf55944ecaf0c07f18fe3ac7931f89b3

SHA1
29d537cbb2ee6acfdffc1e610a810c6065240b35

SHA256
5a5418b5f9b66fe724d3ca28523b246d694b1f0e01b5c414d3b1806950549d93

SHA512
3b5ddf4cc41dc92aaf095f076f7f827d652ab67b048e3b61e429f9fd750fd1c7e232002fd2c5af440166cf340c5de21dc356fc02f0c95365568f422db7709c1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49251.exe

Filesize
468KB

MD5
577adb0fb18cdfc4c7905f493c423b90

SHA1
96b9d4fdb6f14fa4580fe73c988a566c83d6122b

SHA256
adaf51e006f21297f4d4ed1a820c20993f3079b0796c6743eab7c2b5f9f36fa4

SHA512
9464d9e49443330e1e1bd830da57b9cc87e4f8c04e0f3f949adac7e1398afae9f9b8f7079647fb5ede9d30fa27605e5e37f0d37ef9b5d0f1b8d04ca6da1a5f6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54797.exe

Filesize
468KB

MD5
1d3aa801043099dfc9e0affa19dc5cd6

SHA1
1325acc93a4d7c1b669f07be14357d0a612241ac

SHA256
30ea4d1912391bc01efce9179e9d8bd47ce3524fb13a340beee6f6625dc4a4eb

SHA512
6d08c429e57104147d9d2d33d801552b64ee5ca9da83577e44a23d016e74bced920c9844f7d110a68e17126c7a19350a6d772dae57a573cae1832de8cd5af7f5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19842.exe

Filesize
468KB

MD5
e9a0ffc4d7340581002d99d29ecaa59a

SHA1
578bbe2a6315030e42d417f60c76f3fab38f6d8e

SHA256
3775dc57d6b673be5e79a15ca1070763599a68ece4204ed06ebf93c347cb071d

SHA512
857f262c9c234b83cb5d2be1380aea8cf394c92d7b9c4d5d39f60733959f73add255f320c2f4522bb54c3950bc0ca4019588f96bca800845d4cf0e6e997708b4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20658.exe

Filesize
468KB

MD5
70e4d847f3ad9b9f802a03eac9bdcc48

SHA1
0076151ded2109afbf6ddbcaecb4b61ebcf41555

SHA256
b614d09fdca65d0497c593ecc9cf58e69d1defc2fc2b683c0d3d54b91beb382f

SHA512
e52db7e6834cfeebbb497c50d622fece3f7aea497cfa0bb78eef8e1d0c13fe047147e615fc59933f58e97dcfbc9daa044a00ec4f920b47641e5ceda85f983d82

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23232.exe

Filesize
468KB

MD5
6349f1c43a83c9475dc9d5329e29233b

SHA1
62d41263150fd99559419d04391b7ae962037fe8

SHA256
091eca4f46714f321c4bad44f1c6808994dc155a6641576e497065d7e691e15b

SHA512
36ef64f3fbc5f54edef17df2b3b9fa9ccc787db0ea9225d07771d7406cfbe033d01173f7764241c155f503725ab3e576b441b85eb05c420fcc0a50c29f81011a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32344.exe

Filesize
468KB

MD5
6eccf638378f63c69674235b75537528

SHA1
9a7c9ea66b36477c3379e1e67119b67f7a068da2

SHA256
75b8763a71ddc3b6489ecbfff90427a55b73662d610c9bfab35763377d35d88a

SHA512
c528947f466d0e1bd5b9c6beb03c0efc4406505575e90b75a973600c223d3eb1f631752b820e5e3b06e23b4cb109af3cbe88aa31dc4e5f6b22b684e926109630

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3963.exe

Filesize
468KB

MD5
416cf545f4130644e0852f1dcf2d35cb

SHA1
57cb06645180ac4f5c311b6fab3b3b2c71cd79a6

SHA256
24c53582daed06a49d2e30e3422e5678349e7c0f2a43710ef2560182938ffb93

SHA512
8909f4a0f2e69aad21cd10af3ae1eb3ffb9dbded6627669a78cb9f6010ee1c4d1326eb52bd52599728e57a3cf203389bc687b21fd62a53b41ef8836e4be08ccb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-41445.exe

Filesize
468KB

MD5
a73f611795dbf4e003371937af03b95b

SHA1
825e5e01915cedccbd85b4130808f25cf41020fb

SHA256
939c7c436eef8e791e33559e320e53543067b55b05f9fb6b3cf8109054b759c4

SHA512
6d613513231b400faf449f1520d526e41af5e9c51f213e751f45a0496038e6fee604e6ba6c7f0fa346d63bcdadeb2822bb90d2294943d0fc0c4b05af420f47b8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-44285.exe

Filesize
468KB

MD5
534827d77737c9e370cda2b8b9ece774

SHA1
4fcb730d9d32b965616c341143732d10ca5b10ce

SHA256
cf8a6167a3c8f96019a984213892c46e457f24bcd76f7f96c9cdd44e0753eed8

SHA512
4c4d34393c2406f114e4f98714d50ff93b74e16db54a11308bb30e679f1788a96a2d2cbc7e03139eedcdfc86f5594411021a417b6791ee55d3f0bca2b27ebde3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45359.exe

Filesize
468KB

MD5
3546bb2513df1ff9567e2903ec3609d7

SHA1
6622571881645c46adff92530d7f12223e3f814e

SHA256
493e46a6df075ee49b6d22e7d29c17ce1a2a5edbe6ccf5fab9ab4f7c66373a28

SHA512
253c8b9e2f97de3f49b9ff4a68a5262d581961b7a8a1749a8c821c10a887d4dd3af161fb53f1656258ddb29aa4b389ca788631830270c53a3879d33691eb0aef

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47034.exe

Filesize
468KB

MD5
9d56e882013c697894efdacdd14693cb

SHA1
ea059787f992fe97a721404f03d48f6fc535cb7f

SHA256
c3383a9474b9e12f7fe65e95b46df516306734f2c5ec13b0cf1d7e5eb3c3f406

SHA512
7762f6a3f9900c82a4c6aab0048381f7ebe7bff131f553ef08b428d1e8484a3486d3f66fb20c35715ecf1c902cea0f5177c6330c7574f4257804b04d3a9832ba

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49116.exe

Filesize
468KB

MD5
b38cfa5f8339d0d5d51d496a1459351b

SHA1
17b37986109088803bc9eec74f5aa1a852c3e85f

SHA256
52c6c0c87495e1bcc08f857b039d5034864b5541d0e298e5c133d6891e911426

SHA512
29ee373f59b20af3429919e8e36ba935b4308308185a698bc25c2a4a3967661aa2c58fe5b291b070c15f900f3b16d5b42d9ccb496bf861bfa10a3f3ac12032d2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-50900.exe

Filesize
468KB

MD5
18eb10237811e55b7784d9a30eb9c3d0

SHA1
5d9a416777c7539839a94fc5f1729c345d946214

SHA256
ae9ac0fa603166cd0a59b6020ecb2d22093028ddacc4db2b51fd12043465e7e5

SHA512
3c7ac1d5767428809a39b0a6a351d6ee60d8a30979119b6e351f93cf49e8ef9492df5aecc6eec3256a369ed4791ae39fdc4fb2e99ee63f0bc544117d6060bdf4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57419.exe

Filesize
468KB

MD5
2030c60b0f19c07eab21eb666e8ee813

SHA1
7579a0ab0ef87f963c5d88914a23b78bad52e472

SHA256
a4c60d8420d7944355aa9c82f6a7b04f71ee2722e153dbe5f44213f5350c6b5a

SHA512
0cbb511f1a09b6f43c9cedd81ef076ade86ff2f01f3f4a3e8c8aa9a763bb4deca0e29d61dc6a4e71f07b2e109fb928b606f9cb3574243c47e2970306f0eb4ec5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60740.exe

Filesize
468KB

MD5
a3f16cfc96354f1fbd2011bde04b2090

SHA1
de1fbfdbb522b37cd9ea58adda9fc95139cd456b

SHA256
b71adebdf03f1f6da1719c16e46c3d164627348ab9c110394fa7876f708154d7

SHA512
601eeee880db422cf2348dc47ddf5100324cefda58fb7b9a71385d25711c121805695ed1bf2648e01f6a3af42873b05cc7422b37b71bba20816758def1954bfc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-626.exe

Filesize
468KB

MD5
d51624afd953e4b720f1a6d27428830e

SHA1
a90e7803b20124e9c4f925fbb53a96bc748b29a7

SHA256
00c72376caae08b288c4c974664ce5706fa19974e15a43140e71803f56ab7a2b

SHA512
40d6259014905a16489d1c98aa4184062c9b7457dbdc3432da3ad648bd72306d9f3219b2987f7969b9c31a886483b946bccc65f226a052eecca8bf19c1779b65

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64269.exe

Filesize
468KB

MD5
3b55c78748280b1e2c1e8ae6b901fbc8

SHA1
b8e250b4681e56f64d02c14b80c0a1fd7a0cc10f

SHA256
703325a1983b0e477732e6e6c2133a056198811ff53ee95974690222ce7f822b

SHA512
3465f900ea490d7b02713f1739bc95515462d6d1a703c84237b161983d91681d6041c421fed79d43e74b374b5edd18acf061f8c7c450b40be8d4bd7834299bc8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-65416.exe

Filesize
468KB

MD5
6422a674da52a64dbca0bf45d930fb32

SHA1
ecf0125bfabb18545edbdb84dff22d914ed20c52

SHA256
7d2dd7c76634350aa7b59fc207fe00a3814ac3877177e5bad88b67172d8df666

SHA512
0b4f7d3b24e3be7756e5983861df9f81f2c44740b925a210ec0509166a281a72c739af15fe60c5b738ba3436a0b3fd72b321cc3222963c41e2021d5bdb90b3c2

Download Submit