6a8ccdc155b24ea8ff1a928c18365d184486f157f43f517d64fbb99ff890a0ef

Analysis

max time kernel
119s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 14:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a8ccdc155b24ea8ff1a928c18365d184486f157f43f517d64fbb99ff890a0ef.exe
Size

468KB
MD5

e0c09c316101b4f1867b19ed4ce35d46
SHA1

2d810a245451d46c348e3ffdf447e67694c10b4b
SHA256

6a8ccdc155b24ea8ff1a928c18365d184486f157f43f517d64fbb99ff890a0ef
SHA512

f9a1b829b26561d35e24bb40e6bf35b1405bf59f18b914c15b4946c6a6112cf8f4f91630135f7733e7a826c5824aa528e920e69d35e09932e7a72e12ba366e9a
SSDEEP

3072:KoqTogjnI05ptbYzPz49ef8/ECMvkgpJ+mHe6Vs/k+b8sMibqQl8k:Kouoh8ptYPE9efKcunk+INibqI

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2336	Unicorn-55814.exe
2372	Unicorn-59680.exe
2072	Unicorn-2866.exe
2060	Unicorn-36603.exe
1680	Unicorn-49410.exe
2772	Unicorn-61107.exe
3048	Unicorn-19180.exe
2808	Unicorn-50054.exe
2644	Unicorn-31148.exe
2648	Unicorn-47122.exe
2560	Unicorn-51206.exe
2496	Unicorn-31340.exe
2240	Unicorn-49160.exe
1876	Unicorn-55290.exe
1908	Unicorn-13800.exe
2028	Unicorn-31829.exe
2400	Unicorn-2726.exe
316	Unicorn-14615.exe
1420	Unicorn-40774.exe
2784	Unicorn-35996.exe
2320	Unicorn-3131.exe
3064	Unicorn-3131.exe
1052	Unicorn-62538.exe
1560	Unicorn-19638.exe
1076	Unicorn-30573.exe
1180	Unicorn-59924.exe
376	Unicorn-10723.exe
980	Unicorn-10723.exe
1032	Unicorn-7194.exe
2276	Unicorn-59851.exe
2584	Unicorn-44335.exe
3040	Unicorn-24175.exe
1628	Unicorn-11901.exe
868	Unicorn-56271.exe
492	Unicorn-40127.exe
2196	Unicorn-33996.exe
884	Unicorn-62254.exe
2564	Unicorn-12233.exe
2052	Unicorn-49447.exe
1728	Unicorn-57786.exe
2080	Unicorn-28451.exe
2340	Unicorn-16945.exe
2948	Unicorn-4906.exe
2740	Unicorn-45809.exe
2756	Unicorn-137.exe
2492	Unicorn-40978.exe
2600	Unicorn-12944.exe
2920	Unicorn-57314.exe
2880	Unicorn-43724.exe
2360	Unicorn-52654.exe
1836	Unicorn-57677.exe
1668	Unicorn-12560.exe
2412	Unicorn-15003.exe
2020	Unicorn-29037.exe
2424	Unicorn-29302.exe
660	Unicorn-11111.exe
1292	Unicorn-58082.exe
1592	Unicorn-45830.exe
2136	Unicorn-50277.exe
2864	Unicorn-44676.exe
2128	Unicorn-64012.exe
832	Unicorn-521.exe
600	Unicorn-43068.exe
1012	Unicorn-46333.exe

Loads dropped DLL 64 IoCs

pid	Process
2900	6a8ccdc155b24ea8ff1a928c18365d184486f157f43f517d64fbb99ff890a0ef.exe
2900	6a8ccdc155b24ea8ff1a928c18365d184486f157f43f517d64fbb99ff890a0ef.exe
2336	Unicorn-55814.exe
2336	Unicorn-55814.exe
2900	6a8ccdc155b24ea8ff1a928c18365d184486f157f43f517d64fbb99ff890a0ef.exe
2900	6a8ccdc155b24ea8ff1a928c18365d184486f157f43f517d64fbb99ff890a0ef.exe
2372	Unicorn-59680.exe
2372	Unicorn-59680.exe
2336	Unicorn-55814.exe
2336	Unicorn-55814.exe
2072	Unicorn-2866.exe
2072	Unicorn-2866.exe
2900	6a8ccdc155b24ea8ff1a928c18365d184486f157f43f517d64fbb99ff890a0ef.exe
2900	6a8ccdc155b24ea8ff1a928c18365d184486f157f43f517d64fbb99ff890a0ef.exe
2060	Unicorn-36603.exe
2060	Unicorn-36603.exe
2372	Unicorn-59680.exe
2372	Unicorn-59680.exe
2772	Unicorn-61107.exe
2772	Unicorn-61107.exe
2072	Unicorn-2866.exe
1680	Unicorn-49410.exe
1680	Unicorn-49410.exe
2072	Unicorn-2866.exe
2336	Unicorn-55814.exe
3048	Unicorn-19180.exe
2336	Unicorn-55814.exe
3048	Unicorn-19180.exe
2900	6a8ccdc155b24ea8ff1a928c18365d184486f157f43f517d64fbb99ff890a0ef.exe
2900	6a8ccdc155b24ea8ff1a928c18365d184486f157f43f517d64fbb99ff890a0ef.exe
2808	Unicorn-50054.exe
2808	Unicorn-50054.exe
2060	Unicorn-36603.exe
2060	Unicorn-36603.exe
2644	Unicorn-31148.exe
2644	Unicorn-31148.exe
2372	Unicorn-59680.exe
2372	Unicorn-59680.exe
2496	Unicorn-31340.exe
2496	Unicorn-31340.exe
2560	Unicorn-51206.exe
1908	Unicorn-13800.exe
1908	Unicorn-13800.exe
2560	Unicorn-51206.exe
2072	Unicorn-2866.exe
2072	Unicorn-2866.exe
2900	6a8ccdc155b24ea8ff1a928c18365d184486f157f43f517d64fbb99ff890a0ef.exe
2900	6a8ccdc155b24ea8ff1a928c18365d184486f157f43f517d64fbb99ff890a0ef.exe
1680	Unicorn-49410.exe
1680	Unicorn-49410.exe
1876	Unicorn-55290.exe
1876	Unicorn-55290.exe
2648	Unicorn-47122.exe
2240	Unicorn-49160.exe
2648	Unicorn-47122.exe
2240	Unicorn-49160.exe
3048	Unicorn-19180.exe
3048	Unicorn-19180.exe
2336	Unicorn-55814.exe
2772	Unicorn-61107.exe
2336	Unicorn-55814.exe
2772	Unicorn-61107.exe
2028	Unicorn-31829.exe
2028	Unicorn-31829.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3228	600	WerFault.exe	92
3944	2424	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56113.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57866.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16505.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15216.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57317.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14615.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39878.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38289.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56409.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61489.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28682.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20970.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42272.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31372.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53321.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31340.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47978.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7937.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61783.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13311.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6917.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16833.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7904.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61783.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14095.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36233.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20652.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27820.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58115.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2866.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47239.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7825.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63082.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63082.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58082.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65306.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14947.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26923.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37775.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40002.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61038.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18346.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46954.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7904.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47204.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32382.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34136.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16243.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51162.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58115.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46954.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2900	6a8ccdc155b24ea8ff1a928c18365d184486f157f43f517d64fbb99ff890a0ef.exe
2336	Unicorn-55814.exe
2372	Unicorn-59680.exe
2072	Unicorn-2866.exe
2060	Unicorn-36603.exe
1680	Unicorn-49410.exe
2772	Unicorn-61107.exe
3048	Unicorn-19180.exe
2808	Unicorn-50054.exe
2644	Unicorn-31148.exe
2496	Unicorn-31340.exe
2648	Unicorn-47122.exe
1876	Unicorn-55290.exe
2240	Unicorn-49160.exe
1908	Unicorn-13800.exe
2560	Unicorn-51206.exe
2028	Unicorn-31829.exe
2400	Unicorn-2726.exe
316	Unicorn-14615.exe
1420	Unicorn-40774.exe
2784	Unicorn-35996.exe
2320	Unicorn-3131.exe
3064	Unicorn-3131.exe
1052	Unicorn-62538.exe
376	Unicorn-10723.exe
1032	Unicorn-7194.exe
1180	Unicorn-59924.exe
980	Unicorn-10723.exe
1560	Unicorn-19638.exe
2276	Unicorn-59851.exe
2584	Unicorn-44335.exe
1076	Unicorn-30573.exe
3040	Unicorn-24175.exe
1628	Unicorn-11901.exe
868	Unicorn-56271.exe
492	Unicorn-40127.exe
884	Unicorn-62254.exe
2564	Unicorn-12233.exe
2052	Unicorn-49447.exe
1728	Unicorn-57786.exe
2080	Unicorn-28451.exe
2340	Unicorn-16945.exe
2948	Unicorn-4906.exe
2740	Unicorn-45809.exe
2756	Unicorn-137.exe
2492	Unicorn-40978.exe
2920	Unicorn-57314.exe
2600	Unicorn-12944.exe
2880	Unicorn-43724.exe
2360	Unicorn-52654.exe
1836	Unicorn-57677.exe
1668	Unicorn-12560.exe
2412	Unicorn-15003.exe
2020	Unicorn-29037.exe
2424	Unicorn-29302.exe
660	Unicorn-11111.exe
1292	Unicorn-58082.exe
1592	Unicorn-45830.exe
832	Unicorn-521.exe
2128	Unicorn-64012.exe
2864	Unicorn-44676.exe
2136	Unicorn-50277.exe
600	Unicorn-43068.exe
1312	Unicorn-46406.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 2336	2900	6a8ccdc155b24ea8ff1a928c18365d184486f157f43f517d64fbb99ff890a0ef.exe	28
PID 2900 wrote to memory of 2336	2900	6a8ccdc155b24ea8ff1a928c18365d184486f157f43f517d64fbb99ff890a0ef.exe	28
PID 2900 wrote to memory of 2336	2900	6a8ccdc155b24ea8ff1a928c18365d184486f157f43f517d64fbb99ff890a0ef.exe	28
PID 2900 wrote to memory of 2336	2900	6a8ccdc155b24ea8ff1a928c18365d184486f157f43f517d64fbb99ff890a0ef.exe	28
PID 2336 wrote to memory of 2372	2336	Unicorn-55814.exe	29
PID 2336 wrote to memory of 2372	2336	Unicorn-55814.exe	29
PID 2336 wrote to memory of 2372	2336	Unicorn-55814.exe	29
PID 2336 wrote to memory of 2372	2336	Unicorn-55814.exe	29
PID 2900 wrote to memory of 2072	2900	6a8ccdc155b24ea8ff1a928c18365d184486f157f43f517d64fbb99ff890a0ef.exe	30
PID 2900 wrote to memory of 2072	2900	6a8ccdc155b24ea8ff1a928c18365d184486f157f43f517d64fbb99ff890a0ef.exe	30
PID 2900 wrote to memory of 2072	2900	6a8ccdc155b24ea8ff1a928c18365d184486f157f43f517d64fbb99ff890a0ef.exe	30
PID 2900 wrote to memory of 2072	2900	6a8ccdc155b24ea8ff1a928c18365d184486f157f43f517d64fbb99ff890a0ef.exe	30
PID 2372 wrote to memory of 2060	2372	Unicorn-59680.exe	31
PID 2372 wrote to memory of 2060	2372	Unicorn-59680.exe	31
PID 2372 wrote to memory of 2060	2372	Unicorn-59680.exe	31
PID 2372 wrote to memory of 2060	2372	Unicorn-59680.exe	31
PID 2336 wrote to memory of 1680	2336	Unicorn-55814.exe	32
PID 2336 wrote to memory of 1680	2336	Unicorn-55814.exe	32
PID 2336 wrote to memory of 1680	2336	Unicorn-55814.exe	32
PID 2336 wrote to memory of 1680	2336	Unicorn-55814.exe	32
PID 2072 wrote to memory of 2772	2072	Unicorn-2866.exe	33
PID 2072 wrote to memory of 2772	2072	Unicorn-2866.exe	33
PID 2072 wrote to memory of 2772	2072	Unicorn-2866.exe	33
PID 2072 wrote to memory of 2772	2072	Unicorn-2866.exe	33
PID 2900 wrote to memory of 3048	2900	6a8ccdc155b24ea8ff1a928c18365d184486f157f43f517d64fbb99ff890a0ef.exe	34
PID 2900 wrote to memory of 3048	2900	6a8ccdc155b24ea8ff1a928c18365d184486f157f43f517d64fbb99ff890a0ef.exe	34
PID 2900 wrote to memory of 3048	2900	6a8ccdc155b24ea8ff1a928c18365d184486f157f43f517d64fbb99ff890a0ef.exe	34
PID 2900 wrote to memory of 3048	2900	6a8ccdc155b24ea8ff1a928c18365d184486f157f43f517d64fbb99ff890a0ef.exe	34
PID 2060 wrote to memory of 2808	2060	Unicorn-36603.exe	35
PID 2060 wrote to memory of 2808	2060	Unicorn-36603.exe	35
PID 2060 wrote to memory of 2808	2060	Unicorn-36603.exe	35
PID 2060 wrote to memory of 2808	2060	Unicorn-36603.exe	35
PID 2372 wrote to memory of 2644	2372	Unicorn-59680.exe	36
PID 2372 wrote to memory of 2644	2372	Unicorn-59680.exe	36
PID 2372 wrote to memory of 2644	2372	Unicorn-59680.exe	36
PID 2372 wrote to memory of 2644	2372	Unicorn-59680.exe	36
PID 2772 wrote to memory of 2648	2772	Unicorn-61107.exe	37
PID 2772 wrote to memory of 2648	2772	Unicorn-61107.exe	37
PID 2772 wrote to memory of 2648	2772	Unicorn-61107.exe	37
PID 2772 wrote to memory of 2648	2772	Unicorn-61107.exe	37
PID 1680 wrote to memory of 2560	1680	Unicorn-49410.exe	39
PID 1680 wrote to memory of 2560	1680	Unicorn-49410.exe	39
PID 1680 wrote to memory of 2560	1680	Unicorn-49410.exe	39
PID 1680 wrote to memory of 2560	1680	Unicorn-49410.exe	39
PID 2072 wrote to memory of 2496	2072	Unicorn-2866.exe	38
PID 2072 wrote to memory of 2496	2072	Unicorn-2866.exe	38
PID 2072 wrote to memory of 2496	2072	Unicorn-2866.exe	38
PID 2072 wrote to memory of 2496	2072	Unicorn-2866.exe	38
PID 2336 wrote to memory of 2240	2336	Unicorn-55814.exe	40
PID 2336 wrote to memory of 2240	2336	Unicorn-55814.exe	40
PID 2336 wrote to memory of 2240	2336	Unicorn-55814.exe	40
PID 2336 wrote to memory of 2240	2336	Unicorn-55814.exe	40
PID 3048 wrote to memory of 1876	3048	Unicorn-19180.exe	41
PID 3048 wrote to memory of 1876	3048	Unicorn-19180.exe	41
PID 3048 wrote to memory of 1876	3048	Unicorn-19180.exe	41
PID 3048 wrote to memory of 1876	3048	Unicorn-19180.exe	41
PID 2900 wrote to memory of 1908	2900	6a8ccdc155b24ea8ff1a928c18365d184486f157f43f517d64fbb99ff890a0ef.exe	42
PID 2900 wrote to memory of 1908	2900	6a8ccdc155b24ea8ff1a928c18365d184486f157f43f517d64fbb99ff890a0ef.exe	42
PID 2900 wrote to memory of 1908	2900	6a8ccdc155b24ea8ff1a928c18365d184486f157f43f517d64fbb99ff890a0ef.exe	42
PID 2900 wrote to memory of 1908	2900	6a8ccdc155b24ea8ff1a928c18365d184486f157f43f517d64fbb99ff890a0ef.exe	42
PID 2808 wrote to memory of 2028	2808	Unicorn-50054.exe	43
PID 2808 wrote to memory of 2028	2808	Unicorn-50054.exe	43
PID 2808 wrote to memory of 2028	2808	Unicorn-50054.exe	43
PID 2808 wrote to memory of 2028	2808	Unicorn-50054.exe	43

C:\Users\Admin\AppData\Local\Temp\6a8ccdc155b24ea8ff1a928c18365d184486f157f43f517d64fbb99ff890a0ef.exe
"C:\Users\Admin\AppData\Local\Temp\6a8ccdc155b24ea8ff1a928c18365d184486f157f43f517d64fbb99ff890a0ef.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55814.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55814.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59680.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59680.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36603.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50054.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31829.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24175.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-521.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8495.exe
        9⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15366.exe
        9⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32329.exe
        9⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8042.exe
        9⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47239.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9023.exe
        8⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50806.exe
        8⤵
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12994.exe
        8⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13311.exe
        8⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43068.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:600
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 600 -s 240
        8⤵
        Program crash
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48421.exe
        7⤵
        
        PID:988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63758.exe
        7⤵
        
        PID:3876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15116.exe
        7⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30060.exe
        7⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57317.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11901.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3505.exe
        7⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63902.exe
        7⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57866.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11988.exe
        7⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61214.exe
        7⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54360.exe
        6⤵
        
        PID:1320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41172.exe
        7⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63082.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1781.exe
        6⤵
        
        PID:3660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26751.exe
        6⤵
        
        PID:5096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61744.exe
        6⤵
        
        PID:5572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2726.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50277.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44593.exe
        7⤵
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41437.exe
        7⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46171.exe
        7⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
        7⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61166.exe
        6⤵
        
        PID:2544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14888.exe
        6⤵
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52373.exe
        6⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48240.exe
        6⤵
        
        PID:912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36555.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33996.exe
        5⤵
        Executes dropped EXE
        
        PID:2196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46406.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49670.exe
        7⤵
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19500.exe
        7⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29051.exe
        7⤵
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64776.exe
        7⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
        7⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23738.exe
        6⤵
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48046.exe
        7⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6917.exe
        7⤵
        
        PID:1300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16833.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
        7⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
        7⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26923.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17965.exe
        6⤵
        
        PID:1756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55066.exe
        6⤵
        
        PID:3800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56409.exe
        6⤵
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61744.exe
        6⤵
        
        PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46333.exe
        5⤵
        Executes dropped EXE
        
        PID:1012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34136.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34503.exe
        5⤵
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52903.exe
        5⤵
        
        PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43775.exe
        5⤵
        
        PID:4732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51982.exe
        5⤵
        
        PID:5996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31148.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14615.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56271.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18346.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42365.exe
        7⤵
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36160.exe
        7⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52373.exe
        7⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48240.exe
        7⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13311.exe
        7⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55020.exe
        6⤵
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57641.exe
        7⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36512.exe
        7⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
        7⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
        7⤵
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51511.exe
        6⤵
        
        PID:744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26565.exe
        6⤵
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52373.exe
        6⤵
        
        PID:3932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38036.exe
        6⤵
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57317.exe
        6⤵
        
        PID:6108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62254.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17901.exe
        6⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60737.exe
        7⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41437.exe
        7⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2039.exe
        7⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38195.exe
        7⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36024.exe
        7⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31561.exe
        6⤵
        
        PID:1116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58115.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61038.exe
        6⤵
        
        PID:3348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64776.exe
        6⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7237.exe
        6⤵
        
        PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32382.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39878.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6917.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36233.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64776.exe
        6⤵
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
        6⤵
        
        PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24045.exe
        5⤵
        
        PID:344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54417.exe
        5⤵
        
        PID:1144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50783.exe
        5⤵
        
        PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3853.exe
        5⤵
        
        PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40213.exe
        5⤵
        
        PID:5580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40774.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40127.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46598.exe
        6⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12524.exe
        7⤵
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36512.exe
        7⤵
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe
        7⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
        7⤵
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
        7⤵
        
        PID:4288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38878.exe
        6⤵
        
        PID:2696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9023.exe
        6⤵
        
        PID:3852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50806.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12994.exe
        6⤵
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13311.exe
        6⤵
        
        PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4859.exe
        5⤵
        
        PID:2008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16700.exe
        5⤵
        
        PID:1380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38530.exe
        5⤵
        
        PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7937.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56165.exe
        5⤵
        
        PID:5752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12233.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62633.exe
        5⤵
        
        PID:1736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18566.exe
        5⤵
        
        PID:2036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46954.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44356.exe
        5⤵
        
        PID:4848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31310.exe
        5⤵
        
        PID:5464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53895.exe
      4⤵
      PID:1552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57641.exe
        5⤵
        
        PID:872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36512.exe
        5⤵
        
        PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59471.exe
        5⤵
        
        PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29529.exe
        5⤵
        
        PID:4636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48378.exe
        5⤵
        
        PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52596.exe
      4⤵
      PID:1576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47978.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31372.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46608.exe
      4⤵
      PID:5032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59115.exe
      4⤵
      PID:5636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49410.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49410.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51206.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3131.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14179.exe
        6⤵
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58307.exe
        7⤵
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36937.exe
        6⤵
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59704.exe
        6⤵
        
        PID:4088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52373.exe
        6⤵
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38036.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15216.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57677.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34813.exe
        6⤵
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43259.exe
        7⤵
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40103.exe
        7⤵
        
        PID:796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe
        7⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
        7⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
        7⤵
        
        PID:4624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51982.exe
        6⤵
        
        PID:3016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58115.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61038.exe
        6⤵
        
        PID:3536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20970.exe
        6⤵
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24302.exe
        6⤵
        
        PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52803.exe
        5⤵
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62967.exe
        6⤵
        
        PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51162.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55315.exe
        5⤵
        
        PID:3216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35837.exe
        5⤵
        
        PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65306.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57317.exe
        5⤵
        
        PID:6132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19638.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29302.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2424
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 240
        6⤵
        Program crash
        
        PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38878.exe
        5⤵
        
        PID:2712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42272.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50806.exe
        5⤵
        
        PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12994.exe
        5⤵
        
        PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65444.exe
        5⤵
        
        PID:5872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11111.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29738.exe
        5⤵
        
        PID:532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6964.exe
        5⤵
        
        PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
        5⤵
        
        PID:4220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
        5⤵
        
        PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57376.exe
      4⤵
      PID:2964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17899.exe
      4⤵
      PID:3440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35837.exe
      4⤵
      PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65306.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65306.exe
      4⤵
      PID:4516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15024.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49160.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49160.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10723.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4906.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48485.exe
        6⤵
        
        PID:3756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41437.exe
        6⤵
        
        PID:2844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46171.exe
        6⤵
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36024.exe
        6⤵
        
        PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58388.exe
        5⤵
        
        PID:2104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42272.exe
        5⤵
        
        PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50806.exe
        5⤵
        
        PID:4680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12994.exe
        5⤵
        
        PID:4692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13311.exe
        5⤵
        
        PID:5212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45809.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24502.exe
        5⤵
        
        PID:1036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4831.exe
        5⤵
        
        PID:296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41089.exe
        5⤵
        
        PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37505.exe
        5⤵
        
        PID:4116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48378.exe
        5⤵
        
        PID:5912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51511.exe
      4⤵
      PID:3000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56113.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52373.exe
      4⤵
      PID:3824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56409.exe
      4⤵
      PID:5072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40748.exe
      4⤵
      PID:5800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59851.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59851.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40978.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39302.exe
        5⤵
        
        PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6917.exe
        5⤵
        
        PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36233.exe
        5⤵
        
        PID:4176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64776.exe
        5⤵
        
        PID:4972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
        5⤵
        
        PID:6064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20396.exe
      4⤵
      PID:1612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20652.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22699.exe
      4⤵
      PID:3992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64776.exe
      4⤵
      PID:4832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43724.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43724.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47525.exe
      4⤵
      PID:3244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41437.exe
      4⤵
      PID:3820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2039.exe
      4⤵
      PID:4728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44690.exe
      4⤵
      PID:5204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33278.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33278.exe
    3⤵
    PID:2752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40002.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40002.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31372.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31372.exe
    3⤵
    PID:3104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38440.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38440.exe
    3⤵
    PID:4788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13889.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13889.exe
    3⤵
    PID:5312
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2866.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2866.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61107.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61107.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47122.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10723.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-137.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46492.exe
        7⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28536.exe
        7⤵
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe
        7⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53321.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26626.exe
        6⤵
        
        PID:2536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42272.exe
        6⤵
        
        PID:3700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61038.exe
        6⤵
        
        PID:3312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7407.exe
        6⤵
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23682.exe
        6⤵
        
        PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12944.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        6⤵
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1021.exe
        6⤵
        
        PID:3812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40317.exe
        6⤵
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29529.exe
        6⤵
        
        PID:4700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19489.exe
        6⤵
        
        PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52614.exe
        5⤵
        
        PID:2508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14888.exe
        5⤵
        
        PID:3828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52373.exe
        5⤵
        
        PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48240.exe
        5⤵
        
        PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13311.exe
        5⤵
        
        PID:5172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44335.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45830.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57641.exe
        6⤵
        
        PID:2820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36512.exe
        6⤵
        
        PID:3552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
        6⤵
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
        6⤵
        
        PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37775.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20699.exe
        5⤵
        
        PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61038.exe
        5⤵
        
        PID:3540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64776.exe
        5⤵
        
        PID:4936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19489.exe
        5⤵
        
        PID:6056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64012.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23898.exe
        5⤵
        
        PID:3636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41437.exe
        5⤵
        
        PID:3652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2039.exe
        5⤵
        
        PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21446.exe
        5⤵
        
        PID:5156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59055.exe
      4⤵
      PID:1772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39472.exe
      4⤵
      PID:3676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35837.exe
      4⤵
      PID:2100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65306.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65306.exe
      4⤵
      PID:4508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57317.exe
      4⤵
      PID:6100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31340.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31340.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35996.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49447.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39328.exe
        6⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24310.exe
        7⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31421.exe
        7⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61950.exe
        7⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
        7⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36024.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49836.exe
        6⤵
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45157.exe
        6⤵
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2278.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20970.exe
        6⤵
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36555.exe
        6⤵
        
        PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19462.exe
        5⤵
        
        PID:2416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52130.exe
        6⤵
        
        PID:2720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6917.exe
        6⤵
        
        PID:684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36233.exe
        6⤵
        
        PID:4168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20970.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13311.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14095.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63082.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55066.exe
        5⤵
        
        PID:3760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56409.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16243.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57786.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12939.exe
        5⤵
        
        PID:1672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65345.exe
        6⤵
        
        PID:616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27353.exe
        6⤵
        
        PID:3368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47156.exe
        6⤵
        
        PID:4940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56511.exe
        6⤵
        
        PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25366.exe
        5⤵
        
        PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59150.exe
        5⤵
        
        PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38036.exe
        5⤵
        
        PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57317.exe
        5⤵
        
        PID:6116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24489.exe
      4⤵
      PID:2264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60290.exe
      4⤵
      PID:572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6114.exe
      4⤵
      PID:3328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35837.exe
      4⤵
      PID:3916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7937.exe
      4⤵
      PID:5080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31469.exe
      4⤵
      PID:5784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62538.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62538.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9519.exe
      4⤵
      PID:2160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57110.exe
        5⤵
        
        PID:4128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13083.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15581.exe
        5⤵
        
        PID:5180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-180.exe
      4⤵
      PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63980.exe
      4⤵
      PID:3256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52373.exe
      4⤵
      PID:4032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48240.exe
      4⤵
      PID:4816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36555.exe
      4⤵
      PID:5280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29037.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29037.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43604.exe
      4⤵
      PID:800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40179.exe
        5⤵
        
        PID:1496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5765.exe
        5⤵
        
        PID:2392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39330.exe
        5⤵
        
        PID:3484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
        5⤵
        
        PID:4192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36024.exe
        5⤵
        
        PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3100.exe
      4⤵
      PID:2448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57217.exe
      4⤵
      PID:2140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63731.exe
      4⤵
      PID:3764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7407.exe
      4⤵
      PID:5040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64715.exe
      4⤵
      PID:5652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46350.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46350.exe
    3⤵
    PID:2180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64768.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64768.exe
    3⤵
    PID:2504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38819.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38819.exe
    3⤵
    PID:3392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23355.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23355.exe
    3⤵
    PID:4928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21510.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21510.exe
    3⤵
    PID:5428
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19180.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19180.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55290.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55290.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59924.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57314.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1886.exe
        6⤵
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4831.exe
        6⤵
        
        PID:2768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41089.exe
        6⤵
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53021.exe
        6⤵
        
        PID:4896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47846.exe
        6⤵
        
        PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23053.exe
        5⤵
        
        PID:1276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18566.exe
        5⤵
        
        PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46954.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44356.exe
        5⤵
        
        PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        5⤵
        
        PID:5952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12560.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56131.exe
        5⤵
        
        PID:1528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4831.exe
        5⤵
        
        PID:2760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41089.exe
        5⤵
        
        PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53021.exe
        5⤵
        
        PID:4884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7704.exe
        5⤵
        
        PID:5944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16944.exe
      4⤵
      PID:2216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24432.exe
      4⤵
      PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38289.exe
      4⤵
      PID:3388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27820.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19787.exe
      4⤵
      PID:5456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7194.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7194.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52654.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5923.exe
        5⤵
        
        PID:2556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50245.exe
        6⤵
        
        PID:4588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29173.exe
        6⤵
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7825.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8914.exe
        5⤵
        
        PID:3336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61038.exe
        5⤵
        
        PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64776.exe
        5⤵
        
        PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
        5⤵
        
        PID:6040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19462.exe
      4⤵
      PID:1988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18566.exe
      4⤵
      PID:2652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46954.exe
      4⤵
      PID:3504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44356.exe
      4⤵
      PID:4876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31310.exe
      4⤵
      PID:5492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15003.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15003.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20802.exe
      4⤵
      PID:2748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52273.exe
      4⤵
      PID:3292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
      4⤵
      PID:4148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3707.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3707.exe
    3⤵
    PID:2724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9300.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9300.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38530.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38530.exe
    3⤵
    PID:3788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7937.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7937.exe
    3⤵
    PID:5008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60249.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60249.exe
    3⤵
    PID:5628
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13800.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13800.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3131.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3131.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28451.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34045.exe
        5⤵
        
        PID:2272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18566.exe
        5⤵
        
        PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46954.exe
        5⤵
        
        PID:3460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44356.exe
        5⤵
        
        PID:4904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31310.exe
        5⤵
        
        PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14947.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47204.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17881.exe
        5⤵
        
        PID:5536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45297.exe
      4⤵
      PID:2996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38289.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27820.exe
      4⤵
      PID:4868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19787.exe
      4⤵
      PID:5448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16945.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16945.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34045.exe
      4⤵
      PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42491.exe
        5⤵
        
        PID:2916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26891.exe
        5⤵
        
        PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe
        5⤵
        
        PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
        5⤵
        
        PID:4272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61489.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23201.exe
      4⤵
      PID:1424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53839.exe
      4⤵
      PID:4076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61038.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64776.exe
      4⤵
      PID:4956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28682.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28682.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6045.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6045.exe
    3⤵
    PID:2256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55315.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55315.exe
    3⤵
    PID:3240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35837.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35837.exe
    3⤵
    PID:3904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16505.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16505.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9689.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9689.exe
    3⤵
    PID:5296
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30573.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30573.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58082.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58082.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46492.exe
      4⤵
      PID:1488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60825.exe
      4⤵
      PID:3860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe
      4⤵
      PID:3360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36024.exe
      4⤵
      PID:5356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38878.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38878.exe
    3⤵
    PID:2572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9023.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9023.exe
    3⤵
    PID:3844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61038.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61038.exe
    3⤵
    PID:3568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64776.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64776.exe
    3⤵
    PID:4892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19489.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19489.exe
    3⤵
    PID:6032
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44676.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44676.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61687.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61687.exe
    3⤵
    PID:3084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29528.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29528.exe
    3⤵
    PID:4992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38825.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38825.exe
    3⤵
    PID:5304
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50920.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50920.exe
  2⤵
  PID:1788
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18471.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18471.exe
  2⤵
  PID:3668
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26037.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26037.exe
  2⤵
  PID:3648
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42640.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42640.exe
  2⤵
  PID:4772
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
  2⤵
  PID:6008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-15366.exe

Filesize
468KB

MD5
3ccfb08a0c603a1f01225e45a65cb46f

SHA1
ba3c5b6b8f430798fba65810dcc4f5e388d411a2

SHA256
a96f2924d264085b88d7399c0249893d2819e426e3528fae9aedcd8704b4edf6

SHA512
89fb0181dc89d545b2e682a5818553bb9f264ce104893bdf2ad2ccf8b48313e0049d9e7a7b3a8601c5f5179ced010f0c0dc67606dc67cff20d55b3360bc3eaa1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24302.exe

Filesize
468KB

MD5
4f27a1fa876d3bfcf6df459cbc11d998

SHA1
1b94377530f8917bbe523458a03f0db635a53623

SHA256
463e06f0fd1ef06d6fdc8c9959012c0d31ed095c1b5a37ee33b0c0108e8c5aaa

SHA512
886bd4ecda3eeb5babb4b1df50efcf86e0a85b2c6baeb88661ea6002367652b660b77a643a33cea481049faa59b66f139d62ca61b0142fcd2da661766e826197

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31340.exe

Filesize
468KB

MD5
3e52965d63c3f2cbce853bf5245e19fe

SHA1
045b52a8f740dbc152d29991917886f0407b56c8

SHA256
ec0cee59a3afd29b6812045273743864b9598d10ebea8e78ba695859b20cbe77

SHA512
e4ae7c482a9191cf6cefca05b68768ddd2248acd7bdabcf26acd95ece1cf3fee7d4359e97ba35dd4a98ce0f6e7e577ba6d92bbb95937b49b83bc9f9b77838c5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31829.exe

Filesize
468KB

MD5
dd5000d592ff25d6c9a0fc8580254bf4

SHA1
1b8efc2667f0727e1298625462974fb336c69b01

SHA256
73acf3213793bfce28b42d12fa51e579e46fd79b27f44f15e820305d9dd47a1c

SHA512
fdaeeb721fc076112fadf8c6afd433015c055dee6619055b80dce907255de36ca6eaa23608e9516c1e2dd9ad50cf66b13c09bb0be4183dbb9eb0ec2ea7f5ebcd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49410.exe

Filesize
468KB

MD5
1b600dfc27c6e71c0abd59844474848a

SHA1
597f9eeea518775d63ee35b3440f2ae71e38d328

SHA256
7e3522172f098e00cdf9277b119d80c14857c892f29763c003e6f472ab6e1f5e

SHA512
e55dd1712182a7951fbe55de6130997c1ca139e141ff51c9b654a27d3838fc0153607186b4f1913df1938d704518d99dd1697a5beaf553ad618821cf9d4f8eaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50054.exe

Filesize
468KB

MD5
a52eeaed221c5a337e2bc0240003b34f

SHA1
be7b2ed2b12c8acf29ff1e71c1b63358bbb2f882

SHA256
a51b32d6208fda57b2a8342395c72acaea184fd2d8e5bf5273fdd3196d166472

SHA512
e0050183c6e126b65bccfd53ed499dab8270f5dd71e1a50466cfefb3dcc6a16f83595d8d0b2a8af21ba778ea49960bf6efc117d1bf826848927c2f568b7c95b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51206.exe

Filesize
468KB

MD5
498a01b73b074fa7860c2f614c1ad56f

SHA1
8128a2124a37b34e19337debd5223d8fc7d37d39

SHA256
ceb81bcf7dec9cb92b40165358b6756b2860ab1452a5d6ba48c904020ad0d8ad

SHA512
51f3268959901db74ea519fd8aceef10419d8979762a607eeb52a61656b0c0dc761e09753de99d013bbb2b2526e0c7899a87310aea492619c8e3fa277e6ed54e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5923.exe

Filesize
468KB

MD5
aa15769055be1dbb6f12b1a120fe32c5

SHA1
18ec782bd1bce781b221994941ae9d191c28612a

SHA256
b094449f8345c3c73f566981f515c48c586deb75ef8e381b4f5a94088afc0030

SHA512
07744198238d72ac2ae77050611456111d782bc64ddf87399d5daee91ca2ae3e3013a5ec0913be2f9b145caf964c8c13945d7413920d248c30987fd67bfff1cc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13800.exe

Filesize
468KB

MD5
07d66a2dfd604642f06e4fccb0f2a273

SHA1
e145e59e77922c6aa2a820171612bc55841d845b

SHA256
163bdbb0d3bb5d7f2c7c39813776d2800b3d86df207b2ea0580411235ad85d49

SHA512
bdc3bf2d66eefadf0ba53929f4f3a46e9fd404396d34d15d33fe8ded77395836b036b2aa9d77159f6f617ef2163b7682d9322204d13f687edd4cc410488c6a9e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14615.exe

Filesize
468KB

MD5
5ad31314538824edfd446a9e524a7863

SHA1
34fbb1c93b1b759c382c4461c26cdd1965d893d7

SHA256
c5132eb9d4046bf0d6ba24ff67755924cd61aa10985e56b4520c95a99cc0ef74

SHA512
ad0dd23293ad20c3d7d6a16f19b447d74af9c00c652d8f42ae7de71764ea6865439c92f896050398e9135b47551e272ee2e59e9ac58501790d992d6544a3362a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19180.exe

Filesize
468KB

MD5
1c241229220dd1f947d969eb5170dacf

SHA1
fbfa4516f9b405e4c7fd838547dc40d2720d4c2f

SHA256
a68ea4e53b89791a392a309a3b27db1d9d5dae00620d6fa04bd5e8ab09138845

SHA512
d8d8adfc99b15ed99da9dcf2f891d9f503678184ceff1e20db8bbb7f21071fb2ec417fd6836ead6c1d4faa0e3db30734d4a04a90fe07a930280bcaedb7a4c2e0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-2726.exe

Filesize
468KB

MD5
351a45d79f81b27ded87ba8f20d5f331

SHA1
c68cb07a7f9643717b7b6211d0142164fb289071

SHA256
6aacc38538a13ddc2797669c2c5cb401bfdfb2d35d6e5e2f84df35b3be6c7b99

SHA512
86fa049c11b53d0c749d4721d223a21b0600244c4bee49a82acfbe158db96ff462b0dc061155b4d6772fad4f37029c959af5186dbe2cd7a7dae6996a623d9a79

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-2866.exe

Filesize
468KB

MD5
c64bf61183828dd4759ecf1883185327

SHA1
c0df1ade3768f665a2ca8a7ef77b76ff87dcae0b

SHA256
3cbf20762481dde86eef944f67f6c55c62a61d9edb0025ae7482f00f5195b826

SHA512
e13b794f4442d79d7cf6e1b1c5f8d0fee3e28e8242a73214cb9eeda467b4d6af68f7d9be5955ed94911c985efc8109491ab593b1eb6f51935c9aaeaca471f39c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31148.exe

Filesize
468KB

MD5
26e1c355319dac51280d7a3a77941c55

SHA1
1df390522478d32e247346f27185b2fc4f387e5a

SHA256
aaca3ed69ec80951836ccf89ee819998dc93635c1699ae21be00d7ca3dc20e55

SHA512
80962631dce0e8338eedb0c41ca4dcbd19a0abb1e0b9ca1bd93c7df564c34f4eb18ffe2cf380fe5585a443393ebdcfe7d17db2c1cc49a892cd7feb2317743366

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36603.exe

Filesize
468KB

MD5
53902e48d383d28f09d5bdd1ebd7913a

SHA1
b4ebb7355019033b58c37d6e11d6ef1ad5496e74

SHA256
d2a87dacebbb9e7b77386c5a3209e926e8bbb8f0547984954ee0791d52ed8b3e

SHA512
53db5899c01de4c49c8417fb6403b2dbc5a8f73eb04779ccf06fe4b9e19bea3380764760ddaae4175bbbc013f71c6a9ec96803677992bf457ab2cf1cdffa2d9e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40774.exe

Filesize
468KB

MD5
9c24173b40955778ddc86d55427f9525

SHA1
0c4b36a7991d69dbd216a630f5494ae93cd9ae17

SHA256
b575e1a69521e09549d57ff9a3ad65ea5c4e839c467736cbf46cdb77c9620331

SHA512
5687174e4bb07e75b729743e2d4baf362cba6ad346b29716d014e33d93cf3b3c3d9a8f183897d7ca1697876f9298ed3e442692ecc3beed0d9a1d546dca449e3d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47122.exe

Filesize
468KB

MD5
442fda2f402c4017cba96d3030e9c87d

SHA1
9626722838ff6ff04d158cb34cf8405246421d55

SHA256
2ca3dca2914f9d20b0342e19066a8fd1783486a017dc354349ba0d877974ed8a

SHA512
e401c30b7362040ba11015a24e1c706d9cfb98529bda780a7ae6899b56188ea5a5f71df66b109db847515b590539876d96801719e8489ff57d4ef5680cf9a09e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49160.exe

Filesize
468KB

MD5
357daa2503f80b26ec0c9b17cd2cd66d

SHA1
0c7e22a289e98e656625f5c90e8f4d1e666ed1ac

SHA256
ee14846372bb8d9ca75a5ac14790c65443f7452e4e4aed652676ae54949ee5f2

SHA512
89b7f33bf4d7280ca97dcb7dfd6f575457cf84a0fa18ec215e823812dcbb77b2558365bb762d8d38cf3e0e4546ec856e9ec61d7e9785cfc81d0be3b32f61aaf0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55290.exe

Filesize
468KB

MD5
7d1149094b2200ea0a9d3933f6ad0da6

SHA1
16186cbfa62cb0d3cd36072a83156b85322ab964

SHA256
7a38e9af6ec593aea524f37e32d65d03453ebe8ba335da19ddc3f69010b15579

SHA512
5ede960cbf5b434bf1df2a95165eebd97c42ede1206c3fc25988a67c0cefd4afccc939524e6d4b651f05b36120548504af0a04aa979318b0a335baba177cd0b4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55814.exe

Filesize
468KB

MD5
a08f260f1030e9dfd32f6a13118cb7e3

SHA1
1d72ebae4680bed423a2b1e0892fbe57f71a9799

SHA256
b4337f510cbefb7a315dd9b94b2a7843b731c4c33210713879618567ff9cff10

SHA512
6867661364da93898e726d44c3d8b02906c32c98c19f0120a8789485e5c4229eb6a104ad82a63810aa7a91b9a0cdb05ecd61b6c2a1b2718247ae90298742bbca

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59680.exe

Filesize
468KB

MD5
554a85965d29f5769b085461430105bd

SHA1
d1214d1fa0b83ae4649f183e910f42cec4de64e1

SHA256
bec2ab3f3a95a02d5f452b811ca3359ce6b06cd3d0af80d2060bcb11823ecaa8

SHA512
fd7aa29e6fac72c85d25cbba8a0acd37995d7002b96ff07b889fec5f07d98985a2291bd514d8c085e30f8ea62c70311fb76a0522647c2a25ad7cd1e46c5c3c8e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61107.exe

Filesize
468KB

MD5
c02784f57a9dfd65b5aae473beff4ac1

SHA1
99878807fde97fe673b4caa238cfc93829a53ec0

SHA256
6c20c144810252e1ff10bc2403c48680d26d6dded39261a59faaa47d4daf90a5

SHA512
490754a56d63a1c2450fc856ae89ad194aa2536e8f9afff7079ce51dcd81a07dfacaffb1a957ddce09692297b2ac6a35b49d56d2c45447e03462bd67125383b0

Download Submit