8e24e952734ae317dcbe71e62c2439d1225d6f2b38065fa7b8dc6b53ea6c8903

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 18:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e24e952734ae317dcbe71e62c2439d1225d6f2b38065fa7b8dc6b53ea6c8903.exe
Size

468KB
MD5

9ba1ab3c338cd82e98adffbfaa99faae
SHA1

b84fd328de5529619dd3694fca3137bc75233e5a
SHA256

8e24e952734ae317dcbe71e62c2439d1225d6f2b38065fa7b8dc6b53ea6c8903
SHA512

632e24348b8ff25ab5c8eaa5bda2787233f4c76d8058c81bcb59a14c2ece82e039be82b74a8936f75cbd30341855190c9c0fb224666c24514ab5c4eb4193dad9
SSDEEP

3072:ysCyovQxy35/tbYmPXTtqfN/zCISUIpDVmHYkS9Iyl5wi8E31BlaM:ysLonJ/txPjtqfN01iylCzE31p

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2128	Unicorn-13400.exe
1972	Unicorn-34973.exe
2684	Unicorn-36596.exe
2788	Unicorn-35056.exe
2176	Unicorn-31526.exe
2880	Unicorn-20666.exe
2872	Unicorn-31639.exe
1252	Unicorn-35139.exe
2144	Unicorn-36461.exe
1632	Unicorn-3042.exe
2828	Unicorn-3597.exe
2496	Unicorn-58273.exe
2912	Unicorn-904.exe
2768	Unicorn-60311.exe
1072	Unicorn-39534.exe
2056	Unicorn-53395.exe
2064	Unicorn-1734.exe
1040	Unicorn-62440.exe
2188	Unicorn-3488.exe
2572	Unicorn-58164.exe
1124	Unicorn-40458.exe
1184	Unicorn-34327.exe
1752	Unicorn-54748.exe
1636	Unicorn-18454.exe
1304	Unicorn-60878.exe
492	Unicorn-38320.exe
612	Unicorn-38320.exe
2552	Unicorn-1106.exe
1696	Unicorn-47043.exe
2104	Unicorn-57978.exe
2172	Unicorn-1371.exe
1188	Unicorn-4241.exe
2980	Unicorn-47220.exe
2364	Unicorn-27354.exe
1588	Unicorn-49258.exe
1108	Unicorn-14355.exe
2700	Unicorn-37468.exe
1828	Unicorn-37490.exe
2860	Unicorn-49742.exe
2204	Unicorn-50297.exe
2832	Unicorn-31167.exe
2648	Unicorn-31076.exe
2604	Unicorn-51231.exe
1864	Unicorn-51496.exe
980	Unicorn-26176.exe
1560	Unicorn-46042.exe
1092	Unicorn-41443.exe
1832	Unicorn-55179.exe
1548	Unicorn-61309.exe
2680	Unicorn-8024.exe
1152	Unicorn-27053.exe
1456	Unicorn-36613.exe
900	Unicorn-46819.exe
2276	Unicorn-52949.exe
480	Unicorn-6441.exe
276	Unicorn-3748.exe
2092	Unicorn-12684.exe
1060	Unicorn-12419.exe
3004	Unicorn-16769.exe
2480	Unicorn-62870.exe
924	Unicorn-60931.exe
2072	Unicorn-19269.exe
2504	Unicorn-18523.exe
1132	Unicorn-61501.exe

Loads dropped DLL 64 IoCs

pid	Process
812	8e24e952734ae317dcbe71e62c2439d1225d6f2b38065fa7b8dc6b53ea6c8903.exe
812	8e24e952734ae317dcbe71e62c2439d1225d6f2b38065fa7b8dc6b53ea6c8903.exe
2128	Unicorn-13400.exe
2128	Unicorn-13400.exe
812	8e24e952734ae317dcbe71e62c2439d1225d6f2b38065fa7b8dc6b53ea6c8903.exe
812	8e24e952734ae317dcbe71e62c2439d1225d6f2b38065fa7b8dc6b53ea6c8903.exe
1972	Unicorn-34973.exe
1972	Unicorn-34973.exe
2128	Unicorn-13400.exe
2128	Unicorn-13400.exe
2684	Unicorn-36596.exe
2684	Unicorn-36596.exe
812	8e24e952734ae317dcbe71e62c2439d1225d6f2b38065fa7b8dc6b53ea6c8903.exe
812	8e24e952734ae317dcbe71e62c2439d1225d6f2b38065fa7b8dc6b53ea6c8903.exe
2788	Unicorn-35056.exe
2788	Unicorn-35056.exe
1972	Unicorn-34973.exe
1972	Unicorn-34973.exe
2880	Unicorn-20666.exe
2880	Unicorn-20666.exe
2684	Unicorn-36596.exe
2684	Unicorn-36596.exe
2176	Unicorn-31526.exe
2128	Unicorn-13400.exe
2176	Unicorn-31526.exe
2128	Unicorn-13400.exe
2872	Unicorn-31639.exe
2872	Unicorn-31639.exe
812	8e24e952734ae317dcbe71e62c2439d1225d6f2b38065fa7b8dc6b53ea6c8903.exe
812	8e24e952734ae317dcbe71e62c2439d1225d6f2b38065fa7b8dc6b53ea6c8903.exe
1252	Unicorn-35139.exe
1252	Unicorn-35139.exe
2788	Unicorn-35056.exe
2788	Unicorn-35056.exe
1632	Unicorn-3042.exe
1632	Unicorn-3042.exe
2880	Unicorn-20666.exe
2880	Unicorn-20666.exe
2144	Unicorn-36461.exe
2144	Unicorn-36461.exe
2828	Unicorn-3597.exe
2828	Unicorn-3597.exe
1972	Unicorn-34973.exe
1972	Unicorn-34973.exe
2684	Unicorn-36596.exe
2496	Unicorn-58273.exe
2684	Unicorn-36596.exe
2496	Unicorn-58273.exe
2176	Unicorn-31526.exe
2768	Unicorn-60311.exe
2912	Unicorn-904.exe
2176	Unicorn-31526.exe
2912	Unicorn-904.exe
2768	Unicorn-60311.exe
812	8e24e952734ae317dcbe71e62c2439d1225d6f2b38065fa7b8dc6b53ea6c8903.exe
2872	Unicorn-31639.exe
1072	Unicorn-39534.exe
2128	Unicorn-13400.exe
1072	Unicorn-39534.exe
812	8e24e952734ae317dcbe71e62c2439d1225d6f2b38065fa7b8dc6b53ea6c8903.exe
2128	Unicorn-13400.exe
2872	Unicorn-31639.exe
2056	Unicorn-53395.exe
2056	Unicorn-53395.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4120	2772	WerFault.exe	100

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46042.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44734.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53198.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-327.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57029.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51958.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61034.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39663.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37374.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43989.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48644.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-696.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3488.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46125.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38210.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61735.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30874.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47068.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14142.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62172.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3042.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38198.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53504.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50297.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57552.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3665.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36596.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55179.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24309.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19939.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27316.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-696.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48237.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23596.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33622.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35198.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37035.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3597.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20521.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33743.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39663.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46528.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65244.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60311.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57978.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46819.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21891.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61034.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7302.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62113.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16442.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6139.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8631.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56080.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
812	8e24e952734ae317dcbe71e62c2439d1225d6f2b38065fa7b8dc6b53ea6c8903.exe
2128	Unicorn-13400.exe
1972	Unicorn-34973.exe
2684	Unicorn-36596.exe
2788	Unicorn-35056.exe
2176	Unicorn-31526.exe
2880	Unicorn-20666.exe
2872	Unicorn-31639.exe
1252	Unicorn-35139.exe
2144	Unicorn-36461.exe
1632	Unicorn-3042.exe
2496	Unicorn-58273.exe
2828	Unicorn-3597.exe
1072	Unicorn-39534.exe
2912	Unicorn-904.exe
2768	Unicorn-60311.exe
2056	Unicorn-53395.exe
2064	Unicorn-1734.exe
1040	Unicorn-62440.exe
2188	Unicorn-3488.exe
2572	Unicorn-58164.exe
1184	Unicorn-34327.exe
1124	Unicorn-40458.exe
1752	Unicorn-54748.exe
1636	Unicorn-18454.exe
492	Unicorn-38320.exe
2552	Unicorn-1106.exe
1696	Unicorn-47043.exe
612	Unicorn-38320.exe
2172	Unicorn-1371.exe
1304	Unicorn-60878.exe
2104	Unicorn-57978.exe
2980	Unicorn-47220.exe
1188	Unicorn-4241.exe
2364	Unicorn-27354.exe
1588	Unicorn-49258.exe
1108	Unicorn-14355.exe
2700	Unicorn-37468.exe
1828	Unicorn-37490.exe
2860	Unicorn-49742.exe
2204	Unicorn-50297.exe
2832	Unicorn-31167.exe
2648	Unicorn-31076.exe
1864	Unicorn-51496.exe
2604	Unicorn-51231.exe
1560	Unicorn-46042.exe
980	Unicorn-26176.exe
1092	Unicorn-41443.exe
1832	Unicorn-55179.exe
1548	Unicorn-61309.exe
1152	Unicorn-27053.exe
2680	Unicorn-8024.exe
2276	Unicorn-52949.exe
900	Unicorn-46819.exe
480	Unicorn-6441.exe
1456	Unicorn-36613.exe
276	Unicorn-3748.exe
2092	Unicorn-12684.exe
1060	Unicorn-12419.exe
3004	Unicorn-16769.exe
2480	Unicorn-62870.exe
924	Unicorn-60931.exe
2072	Unicorn-19269.exe
2504	Unicorn-18523.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 2128	812	8e24e952734ae317dcbe71e62c2439d1225d6f2b38065fa7b8dc6b53ea6c8903.exe	30
PID 812 wrote to memory of 2128	812	8e24e952734ae317dcbe71e62c2439d1225d6f2b38065fa7b8dc6b53ea6c8903.exe	30
PID 812 wrote to memory of 2128	812	8e24e952734ae317dcbe71e62c2439d1225d6f2b38065fa7b8dc6b53ea6c8903.exe	30
PID 812 wrote to memory of 2128	812	8e24e952734ae317dcbe71e62c2439d1225d6f2b38065fa7b8dc6b53ea6c8903.exe	30
PID 2128 wrote to memory of 1972	2128	Unicorn-13400.exe	31
PID 2128 wrote to memory of 1972	2128	Unicorn-13400.exe	31
PID 2128 wrote to memory of 1972	2128	Unicorn-13400.exe	31
PID 2128 wrote to memory of 1972	2128	Unicorn-13400.exe	31
PID 812 wrote to memory of 2684	812	8e24e952734ae317dcbe71e62c2439d1225d6f2b38065fa7b8dc6b53ea6c8903.exe	32
PID 812 wrote to memory of 2684	812	8e24e952734ae317dcbe71e62c2439d1225d6f2b38065fa7b8dc6b53ea6c8903.exe	32
PID 812 wrote to memory of 2684	812	8e24e952734ae317dcbe71e62c2439d1225d6f2b38065fa7b8dc6b53ea6c8903.exe	32
PID 812 wrote to memory of 2684	812	8e24e952734ae317dcbe71e62c2439d1225d6f2b38065fa7b8dc6b53ea6c8903.exe	32
PID 1972 wrote to memory of 2788	1972	Unicorn-34973.exe	33
PID 1972 wrote to memory of 2788	1972	Unicorn-34973.exe	33
PID 1972 wrote to memory of 2788	1972	Unicorn-34973.exe	33
PID 1972 wrote to memory of 2788	1972	Unicorn-34973.exe	33
PID 2128 wrote to memory of 2176	2128	Unicorn-13400.exe	34
PID 2128 wrote to memory of 2176	2128	Unicorn-13400.exe	34
PID 2128 wrote to memory of 2176	2128	Unicorn-13400.exe	34
PID 2128 wrote to memory of 2176	2128	Unicorn-13400.exe	34
PID 2684 wrote to memory of 2880	2684	Unicorn-36596.exe	35
PID 2684 wrote to memory of 2880	2684	Unicorn-36596.exe	35
PID 2684 wrote to memory of 2880	2684	Unicorn-36596.exe	35
PID 2684 wrote to memory of 2880	2684	Unicorn-36596.exe	35
PID 812 wrote to memory of 2872	812	8e24e952734ae317dcbe71e62c2439d1225d6f2b38065fa7b8dc6b53ea6c8903.exe	36
PID 812 wrote to memory of 2872	812	8e24e952734ae317dcbe71e62c2439d1225d6f2b38065fa7b8dc6b53ea6c8903.exe	36
PID 812 wrote to memory of 2872	812	8e24e952734ae317dcbe71e62c2439d1225d6f2b38065fa7b8dc6b53ea6c8903.exe	36
PID 812 wrote to memory of 2872	812	8e24e952734ae317dcbe71e62c2439d1225d6f2b38065fa7b8dc6b53ea6c8903.exe	36
PID 2788 wrote to memory of 1252	2788	Unicorn-35056.exe	37
PID 2788 wrote to memory of 1252	2788	Unicorn-35056.exe	37
PID 2788 wrote to memory of 1252	2788	Unicorn-35056.exe	37
PID 2788 wrote to memory of 1252	2788	Unicorn-35056.exe	37
PID 1972 wrote to memory of 2144	1972	Unicorn-34973.exe	38
PID 1972 wrote to memory of 2144	1972	Unicorn-34973.exe	38
PID 1972 wrote to memory of 2144	1972	Unicorn-34973.exe	38
PID 1972 wrote to memory of 2144	1972	Unicorn-34973.exe	38
PID 2880 wrote to memory of 1632	2880	Unicorn-20666.exe	39
PID 2880 wrote to memory of 1632	2880	Unicorn-20666.exe	39
PID 2880 wrote to memory of 1632	2880	Unicorn-20666.exe	39
PID 2880 wrote to memory of 1632	2880	Unicorn-20666.exe	39
PID 2684 wrote to memory of 2828	2684	Unicorn-36596.exe	40
PID 2684 wrote to memory of 2828	2684	Unicorn-36596.exe	40
PID 2684 wrote to memory of 2828	2684	Unicorn-36596.exe	40
PID 2684 wrote to memory of 2828	2684	Unicorn-36596.exe	40
PID 2176 wrote to memory of 2496	2176	Unicorn-31526.exe	41
PID 2176 wrote to memory of 2496	2176	Unicorn-31526.exe	41
PID 2176 wrote to memory of 2496	2176	Unicorn-31526.exe	41
PID 2176 wrote to memory of 2496	2176	Unicorn-31526.exe	41
PID 2128 wrote to memory of 2768	2128	Unicorn-13400.exe	42
PID 2128 wrote to memory of 2768	2128	Unicorn-13400.exe	42
PID 2128 wrote to memory of 2768	2128	Unicorn-13400.exe	42
PID 2128 wrote to memory of 2768	2128	Unicorn-13400.exe	42
PID 2872 wrote to memory of 2912	2872	Unicorn-31639.exe	43
PID 2872 wrote to memory of 2912	2872	Unicorn-31639.exe	43
PID 2872 wrote to memory of 2912	2872	Unicorn-31639.exe	43
PID 2872 wrote to memory of 2912	2872	Unicorn-31639.exe	43
PID 812 wrote to memory of 1072	812	8e24e952734ae317dcbe71e62c2439d1225d6f2b38065fa7b8dc6b53ea6c8903.exe	44
PID 812 wrote to memory of 1072	812	8e24e952734ae317dcbe71e62c2439d1225d6f2b38065fa7b8dc6b53ea6c8903.exe	44
PID 812 wrote to memory of 1072	812	8e24e952734ae317dcbe71e62c2439d1225d6f2b38065fa7b8dc6b53ea6c8903.exe	44
PID 812 wrote to memory of 1072	812	8e24e952734ae317dcbe71e62c2439d1225d6f2b38065fa7b8dc6b53ea6c8903.exe	44
PID 1252 wrote to memory of 2056	1252	Unicorn-35139.exe	45
PID 1252 wrote to memory of 2056	1252	Unicorn-35139.exe	45
PID 1252 wrote to memory of 2056	1252	Unicorn-35139.exe	45
PID 1252 wrote to memory of 2056	1252	Unicorn-35139.exe	45

C:\Users\Admin\AppData\Local\Temp\8e24e952734ae317dcbe71e62c2439d1225d6f2b38065fa7b8dc6b53ea6c8903.exe
"C:\Users\Admin\AppData\Local\Temp\8e24e952734ae317dcbe71e62c2439d1225d6f2b38065fa7b8dc6b53ea6c8903.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:812
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13400.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13400.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34973.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34973.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35056.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35139.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53395.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4241.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29213.exe
        8⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 220
        9⤵
        Program crash
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21978.exe
        8⤵
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34421.exe
        8⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57559.exe
        8⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4166.exe
        8⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50188.exe
        7⤵
        
        PID:1292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12726.exe
        8⤵
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37178.exe
        8⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7302.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40593.exe
        7⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39521.exe
        7⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27113.exe
        7⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37097.exe
        7⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27354.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31351.exe
        7⤵
        
        PID:856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40754.exe
        8⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43826.exe
        8⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10816.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65244.exe
        8⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20940.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62113.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-384.exe
        7⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29462.exe
        7⤵
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57029.exe
        7⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8631.exe
        7⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49725.exe
        6⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65129.exe
        7⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62804.exe
        7⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37495.exe
        6⤵
        
        PID:2620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50589.exe
        6⤵
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
        6⤵
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33486.exe
        6⤵
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42432.exe
        6⤵
        
        PID:4636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1734.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47220.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25129.exe
        7⤵
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46696.exe
        8⤵
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22824.exe
        8⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40493.exe
        8⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25697.exe
        8⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21978.exe
        7⤵
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36560.exe
        7⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40858.exe
        7⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32955.exe
        7⤵
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53504.exe
        7⤵
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50188.exe
        6⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43655.exe
        7⤵
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4951.exe
        7⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8372.exe
        7⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37475.exe
        7⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29491.exe
        6⤵
        
        PID:376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42425.exe
        6⤵
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        6⤵
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58823.exe
        6⤵
        
        PID:4200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3278.exe
        6⤵
        
        PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49258.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61501.exe
        6⤵
        Executes dropped EXE
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62778.exe
        7⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19939.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51864.exe
        7⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52129.exe
        6⤵
        
        PID:1524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29462.exe
        6⤵
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39663.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38198.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6581.exe
        5⤵
        
        PID:1692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57552.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56753.exe
        6⤵
        
        PID:3944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2507.exe
        6⤵
        
        PID:5048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49732.exe
        6⤵
        
        PID:5816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63064.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21326.exe
        5⤵
        
        PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31368.exe
        5⤵
        
        PID:4116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64368.exe
        5⤵
        
        PID:4584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36461.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58164.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37490.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35819.exe
        7⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21554.exe
        8⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22295.exe
        8⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-696.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42974.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55418.exe
        7⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40858.exe
        7⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32955.exe
        7⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53504.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59508.exe
        6⤵
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5943.exe
        7⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59223.exe
        8⤵
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4951.exe
        8⤵
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8372.exe
        8⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37475.exe
        8⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35657.exe
        7⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10816.exe
        7⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65244.exe
        7⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64988.exe
        7⤵
        
        PID:5644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10311.exe
        6⤵
        
        PID:1616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6249.exe
        6⤵
        
        PID:2916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20796.exe
        6⤵
        
        PID:464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35833.exe
        6⤵
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15982.exe
        6⤵
        
        PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50297.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58076.exe
        6⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52005.exe
        7⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37178.exe
        7⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-696.exe
        7⤵
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17100.exe
        6⤵
        
        PID:2776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23596.exe
        6⤵
        
        PID:3352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56199.exe
        6⤵
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33384.exe
        6⤵
        
        PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51946.exe
        5⤵
        
        PID:1452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61735.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54309.exe
        6⤵
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52035.exe
        6⤵
        
        PID:5844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36701.exe
        5⤵
        
        PID:2312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20796.exe
        5⤵
        
        PID:1544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56729.exe
        5⤵
        
        PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50517.exe
        5⤵
        
        PID:5372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34327.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31076.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16442.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52186.exe
        6⤵
        
        PID:2444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23596.exe
        6⤵
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3665.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25166.exe
        6⤵
        
        PID:2272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62113.exe
        5⤵
        
        PID:2396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34008.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33622.exe
        6⤵
        
        PID:4232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30874.exe
        6⤵
        
        PID:4856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42066.exe
        6⤵
        
        PID:5784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-384.exe
        5⤵
        
        PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29462.exe
        5⤵
        
        PID:3512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39663.exe
        5⤵
        
        PID:4688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27316.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51231.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46125.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13618.exe
        5⤵
        
        PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29462.exe
        5⤵
        
        PID:3500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57029.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8631.exe
        5⤵
        
        PID:5140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30972.exe
      4⤵
      PID:2216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37374.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9593.exe
      4⤵
      PID:3816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
      4⤵
      PID:3968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6620.exe
      4⤵
      PID:4472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41297.exe
      4⤵
      PID:6072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31526.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31526.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58273.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60878.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61309.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65170.exe
        7⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22824.exe
        7⤵
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56946.exe
        7⤵
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8631.exe
        7⤵
        
        PID:4708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44838.exe
        6⤵
        
        PID:1836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27877.exe
        6⤵
        
        PID:3208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10816.exe
        6⤵
        
        PID:3924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65244.exe
        6⤵
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32699.exe
        6⤵
        
        PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27053.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14142.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4951.exe
        6⤵
        
        PID:1980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8372.exe
        6⤵
        
        PID:4900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37475.exe
        6⤵
        
        PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58573.exe
        5⤵
        
        PID:568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33743.exe
        5⤵
        
        PID:3124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14287.exe
        5⤵
        
        PID:4256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48644.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42432.exe
        5⤵
        
        PID:4328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18454.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8024.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13535.exe
        6⤵
        
        PID:1600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15839.exe
        6⤵
        
        PID:1872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23596.exe
        6⤵
        
        PID:3440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61034.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25166.exe
        6⤵
        
        PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33332.exe
        5⤵
        
        PID:696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64309.exe
        6⤵
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7402.exe
        6⤵
        
        PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46679.exe
        5⤵
        
        PID:2520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29462.exe
        5⤵
        
        PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39663.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38198.exe
        5⤵
        
        PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46819.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17044.exe
        5⤵
        
        PID:2556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57941.exe
        5⤵
        
        PID:2432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23596.exe
        5⤵
        
        PID:3416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61034.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25166.exe
        5⤵
        
        PID:1392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53535.exe
      4⤵
      PID:2804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61024.exe
        5⤵
        
        PID:4904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43483.exe
        5⤵
        
        PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-696.exe
        5⤵
        
        PID:5172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50402.exe
      4⤵
      PID:1944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4261.exe
      4⤵
      PID:3328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35198.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15416.exe
      4⤵
      PID:5384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60311.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60311.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38320.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46042.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53198.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34008.exe
        7⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56753.exe
        7⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2507.exe
        7⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57900.exe
        7⤵
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32943.exe
        6⤵
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23596.exe
        6⤵
        
        PID:3364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61034.exe
        6⤵
        
        PID:3260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25166.exe
        6⤵
        
        PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62113.exe
        5⤵
        
        PID:1684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33743.exe
        5⤵
        
        PID:3132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2151.exe
        5⤵
        
        PID:3048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48708.exe
        5⤵
        
        PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe
        5⤵
        
        PID:5632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41443.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60977.exe
        5⤵
        
        PID:1372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9861.exe
        5⤵
        
        PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64450.exe
        5⤵
        
        PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53504.exe
        5⤵
        
        PID:5436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38153.exe
      4⤵
      PID:1640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28554.exe
        5⤵
        
        PID:3252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33622.exe
        5⤵
        
        PID:4248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30874.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42066.exe
        5⤵
        
        PID:5768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33743.exe
      4⤵
      PID:3176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2151.exe
      4⤵
      PID:3900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48708.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49765.exe
      4⤵
      PID:5852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1106.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1106.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12684.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20521.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4951.exe
        5⤵
        
        PID:3828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8372.exe
        5⤵
        
        PID:4936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37475.exe
        5⤵
        
        PID:5576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48237.exe
      4⤵
      PID:3040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24992.exe
      4⤵
      PID:3444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43459.exe
      4⤵
      PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33332.exe
      4⤵
      PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63963.exe
      4⤵
      PID:6132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60931.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60931.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23370.exe
      4⤵
      PID:2664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22824.exe
      4⤵
      PID:3732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8146.exe
      4⤵
      PID:5108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37097.exe
      4⤵
      PID:6104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46528.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46528.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7163.exe
      4⤵
      PID:4868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22295.exe
      4⤵
      PID:4528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-696.exe
      4⤵
      PID:5216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22722.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22722.exe
    3⤵
    PID:3392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
    3⤵
    PID:3976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6620.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6620.exe
    3⤵
    PID:4460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47903.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47903.exe
    3⤵
    PID:5392
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36596.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36596.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20666.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20666.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3042.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62440.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14355.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18523.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58076.exe
        8⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56219.exe
        9⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13016.exe
        8⤵
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23596.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56199.exe
        8⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14334.exe
        8⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15652.exe
        7⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34008.exe
        8⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33622.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56779.exe
        8⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63433.exe
        8⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6139.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29462.exe
        7⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39663.exe
        7⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48312.exe
        7⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40265.exe
        6⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53198.exe
        7⤵
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32943.exe
        7⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10816.exe
        7⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65244.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20940.exe
        7⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47068.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52544.exe
        6⤵
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52898.exe
        6⤵
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54853.exe
        6⤵
        
        PID:3824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-922.exe
        6⤵
        
        PID:4548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56080.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37468.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34257.exe
        6⤵
        
        PID:1572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9918.exe
        6⤵
        
        PID:2780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26746.exe
        6⤵
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57559.exe
        6⤵
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4166.exe
        6⤵
        
        PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51946.exe
        5⤵
        
        PID:2928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34008.exe
        6⤵
        
        PID:3192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56753.exe
        6⤵
        
        PID:3856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2507.exe
        6⤵
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46141.exe
        6⤵
        
        PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32617.exe
        5⤵
        
        PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51153.exe
        5⤵
        
        PID:3880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-237.exe
        5⤵
        
        PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16475.exe
        5⤵
        
        PID:5608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3488.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49742.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24309.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52186.exe
        6⤵
        
        PID:2812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23596.exe
        6⤵
        
        PID:3312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56199.exe
        6⤵
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65481.exe
        6⤵
        
        PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62113.exe
        5⤵
        
        PID:1552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33743.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2151.exe
        5⤵
        
        PID:3892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48708.exe
        5⤵
        
        PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41597.exe
        5⤵
        
        PID:5808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31167.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53198.exe
        5⤵
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3717.exe
        6⤵
        
        PID:1156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36145.exe
        6⤵
        
        PID:3628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        6⤵
        
        PID:3108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41621.exe
        6⤵
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4502.exe
        6⤵
        
        PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49280.exe
        5⤵
        
        PID:2360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10816.exe
        5⤵
        
        PID:3908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65244.exe
        5⤵
        
        PID:4948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64988.exe
        5⤵
        
        PID:5652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52933.exe
      4⤵
      PID:2168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25638.exe
        5⤵
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22295.exe
        5⤵
        
        PID:4224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-696.exe
        5⤵
        
        PID:5168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43879.exe
      4⤵
      PID:2716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4261.exe
      4⤵
      PID:3320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52899.exe
      4⤵
      PID:4180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4166.exe
      4⤵
      PID:4732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3597.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3597.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40458.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51496.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51958.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18740.exe
        6⤵
        
        PID:3612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        6⤵
        
        PID:4080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41621.exe
        6⤵
        
        PID:4504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4502.exe
        6⤵
        
        PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40213.exe
        5⤵
        
        PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27877.exe
        5⤵
        
        PID:3216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10816.exe
        5⤵
        
        PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65244.exe
        5⤵
        
        PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32699.exe
        5⤵
        
        PID:5868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26176.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60785.exe
        5⤵
        
        PID:2040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4951.exe
        5⤵
        
        PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8372.exe
        5⤵
        
        PID:4864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37475.exe
        5⤵
        
        PID:5600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38153.exe
      4⤵
      PID:1816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33743.exe
      4⤵
      PID:3160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2151.exe
      4⤵
      PID:3912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48708.exe
      4⤵
      PID:4928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49765.exe
      4⤵
      PID:5884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54748.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54748.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52949.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58076.exe
        5⤵
        
        PID:2924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52768.exe
        6⤵
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62057.exe
        6⤵
        
        PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13016.exe
        5⤵
        
        PID:1148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23596.exe
        5⤵
        
        PID:688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61034.exe
        5⤵
        
        PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25166.exe
        5⤵
        
        PID:4620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38210.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26751.exe
      4⤵
      PID:1880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29462.exe
      4⤵
      PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52369.exe
      4⤵
      PID:3248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8631.exe
      4⤵
      PID:5132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12419.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12419.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18383.exe
      4⤵
      PID:2036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9861.exe
      4⤵
      PID:3640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55169.exe
      4⤵
      PID:4192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33832.exe
      4⤵
      PID:4772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59172.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59172.exe
    3⤵
    PID:2024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5657.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5657.exe
    3⤵
    PID:3400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22458.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22458.exe
    3⤵
    PID:4428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23532.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23532.exe
    3⤵
    PID:4332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3794.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3794.exe
    3⤵
    PID:5688
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31639.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31639.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-904.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-904.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38320.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16769.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11776.exe
        6⤵
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4951.exe
        6⤵
        
        PID:3840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8372.exe
        6⤵
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26868.exe
        6⤵
        
        PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48237.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24992.exe
        5⤵
        
        PID:3432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40410.exe
        5⤵
        
        PID:5060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25697.exe
        5⤵
        
        PID:4760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19269.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37760.exe
        5⤵
        
        PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13011.exe
        5⤵
        
        PID:3560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        5⤵
        
        PID:3812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41621.exe
        5⤵
        
        PID:2392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37558.exe
        5⤵
        
        PID:5300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-327.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30858.exe
      4⤵
      PID:3424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26923.exe
      4⤵
      PID:4464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50398.exe
      4⤵
      PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42432.exe
      4⤵
      PID:6092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47043.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47043.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44734.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5710.exe
        5⤵
        
        PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22295.exe
        5⤵
        
        PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-696.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27353.exe
      4⤵
      PID:3016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42425.exe
      4⤵
      PID:3672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58823.exe
      4⤵
      PID:4104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63963.exe
      4⤵
      PID:6040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55179.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55179.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35622.exe
      4⤵
      PID:2908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22824.exe
      4⤵
      PID:3716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10351.exe
      4⤵
      PID:4188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42432.exe
      4⤵
      PID:6124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44018.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44018.exe
    3⤵
    PID:1668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59140.exe
      4⤵
      PID:2596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13011.exe
      4⤵
      PID:3552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52124.exe
      4⤵
      PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49868.exe
      4⤵
      PID:3104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46897.exe
      4⤵
      PID:6056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56240.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56240.exe
    3⤵
    PID:3060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26461.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26461.exe
    3⤵
    PID:3596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32723.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32723.exe
    3⤵
    PID:3544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37035.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37035.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6371.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6371.exe
    3⤵
    PID:5236
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39534.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39534.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1371.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1371.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36613.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24880.exe
        5⤵
        
        PID:2388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62399.exe
        5⤵
        
        PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3192.exe
        5⤵
        
        PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20209.exe
        5⤵
        
        PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48237.exe
      4⤵
      PID:1432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29462.exe
      4⤵
      PID:3492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57029.exe
      4⤵
      PID:4360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8631.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6441.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6441.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12632.exe
      4⤵
      PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14142.exe
      4⤵
      PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39488.exe
      4⤵
      PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48114.exe
      4⤵
      PID:4112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46897.exe
      4⤵
      PID:6140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21276.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21276.exe
    3⤵
    PID:524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22192.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22192.exe
    3⤵
    PID:3372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43989.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43989.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28867.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28867.exe
    3⤵
    PID:4356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65131.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65131.exe
    3⤵
    PID:5680
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57978.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57978.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3748.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3748.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21891.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9861.exe
      4⤵
      PID:3624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64864.exe
      4⤵
      PID:4684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62172.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36482.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36482.exe
    3⤵
    PID:2224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42425.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42425.exe
    3⤵
    PID:3644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
    3⤵
    PID:3804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54739.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54739.exe
    3⤵
    PID:3292
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62870.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62870.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3006.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3006.exe
    3⤵
    PID:3020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9861.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9861.exe
    3⤵
    PID:1804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64864.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64864.exe
    3⤵
    PID:4656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27361.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27361.exe
    3⤵
    PID:5428
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35006.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35006.exe
  2⤵
  PID:1844
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1192.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1192.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3384
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5857.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5857.exe
  2⤵
  PID:3116
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57307.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57307.exe
  2⤵
  PID:4264
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34174.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34174.exe
  2⤵
  PID:5964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-31639.exe

Filesize
468KB

MD5
b2ca82d1a9a5b4412f918f59b0e6e1cf

SHA1
365fcb23d77279076c93605224ec1f4556cdfe49

SHA256
0ce75a8a133dbed564db2678afb6e01e19941ff8d12f0684e425e1eca94425ee

SHA512
71503f8378105b9ea1ce35a2e87c30b3b33479acc55d26c08b4952267a5ee74c1fc4fc2bb20d88d11d97c6606babc0a4a75c0fab3d77b8dd38896c934ee0d1fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33486.exe

Filesize
468KB

MD5
99c1491f1fd1bd47b5c7586275968923

SHA1
377199741ae2477b26726c82ecbc06b81a42259e

SHA256
627c475a108bd7dcb3a2c97ab0ae3c98b4fe9f78da2f0ee7539ce85834fa1a31

SHA512
dc25fef90ac048f3172bfd572012b68c1f16e49d2da0add4be14743942bd76d7321f64fc14cc729617c1166d1905e40c3d0f672606d5d7a02da52946c4b248f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35056.exe

Filesize
468KB

MD5
412579dc2ae14cc72b8f432e47bc330d

SHA1
9a0d5ebb74c5220c79aaafd364fc0f23d9bbc0b7

SHA256
0f41d4d4d5166a7ef13ed56c03170bb982311d0f4ebb18399dbff82972eacb9a

SHA512
b56d98c5f6b66a43bb2be7055b13b141e3e4db6f839688f18d4fbeb37d80236abc6c64ce2f260080602a5f81635fa73feca8b5c4ab7704a0a50c67b5e0c8a051

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35139.exe

Filesize
468KB

MD5
e9091faede2b532eb89eef525bce3e18

SHA1
f31e7b62d5204e9440be63aed6fe8a8b4ab52cad

SHA256
22cdc4aa656c3addd1b9772317486c52564dea1e5852e263f9d48b27f2a11386

SHA512
acd88efc799881cc0c7185a3a47ba8ea51b868f7f33537e0dc02779c204d837a0faecef05278591af95f677679c684d84c537bd3b371910681f34eb388f26d77

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3597.exe

Filesize
468KB

MD5
087727515bdffb557bed8ec8dd19ef2b

SHA1
b8aa803468328d74c64624cf3e59294a10c51a2a

SHA256
be4244cca4c5784d050fcd03274b3f4d5c86f9897df47af7414c26c1f7c0bbc9

SHA512
f975e20c5aca23397945d54d61fa9d02edd613e698091c283c09a6a18e73e03bc9e2c37bc8129d5c6ce0fc3b0b29ba10f27fa0dbfe14530f57008530077ffa37

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36596.exe

Filesize
468KB

MD5
8538ee285c3dce5f095142cb05c5d1d4

SHA1
3d5cfba521f64b858c99ffb0991b55c5f320da0d

SHA256
0bc9456c5156dc474d2c44aba74e46179ff2bf4746de35200b0bc27427e06361

SHA512
46d4b88376f7d45fe1042fb48796359b6e3947bfbd4b56217f913200603d32bef15e6cb7746c77526eb62b698bfed29aaed65f0a50903fe753bc1652b15304f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39534.exe

Filesize
468KB

MD5
3e8f38a8ad304fd9cafa076595c7954d

SHA1
93e7a1fee2623f26195b7f7780b770fe05470d4d

SHA256
1f3f6182e3ff6e2e61a63f7a9ad8fb2ae15918f06227b91048fe3e5e58a44581

SHA512
424568cdabb6b9ed904cb03bc1a0fc271bf03f9359a2d3959043e12ab672abfcd2f846a0d45563dbb0c96d16588936903678690e7541f9440d33fde2e00eb1e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52544.exe

Filesize
468KB

MD5
40d9a5b2ed550216dc6feb7693fa01c4

SHA1
8944ff5f2caa381d41348e0dcfcb5f76fb42b63d

SHA256
31b388b553b9fc934dabe88791b75c27822f6e4c6d208156343aab0a30df37ca

SHA512
7a95dc8632fde256ffa61aaaba7cc709d5dca2b7ecc0f002f90e8242a5825450673c6040366eaa2e631d34bd485e2b4912f16976b530dd0f8092ef388ec3e721

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53395.exe

Filesize
468KB

MD5
eb2b45f2946d7919645bc507fa9fab22

SHA1
567f963c8d2e478335c16726dc4dc57119fad942

SHA256
739de83a7fa5dbd09042f48ab424137af5d042a9f8a6ed9662997ceea30372d0

SHA512
4fe6bca5e9b8e49a1c674376f2a2e6f7104c666d33a81d1b5a29887262f60f507107eee54058efed8be3b1ce493c97e8ed4047ddb903a51d95c05624997e400e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58273.exe

Filesize
468KB

MD5
498c407916b3ece2b9613ae82430ac8d

SHA1
8e95df8789dde49b84d78b56489feee0e61cbeb1

SHA256
20b4a21091488febd2ec0299f065c2fec7834dee35547883e83cd7fcb947eb8c

SHA512
a45afdf68d478c6ff37d0e48f55f612e5124b148df212bb0b2dfdea484ca56b8afe1aca5864a0c2926ae54d85f52eb00950ffc15243fe36a9d49d2f6f0d1d3a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5943.exe

Filesize
468KB

MD5
76c45e71012fe9071798527acf19daad

SHA1
6d96abc2c92eb996d243bb856b8d185428368734

SHA256
2aca266a49a77b8d3925504053272c8955e17229b7b239f20ebb7ecbf12ffacb

SHA512
e617a79256d137adc9666871c823666e446a1e771d3fa44cc7f8e416885cd6547454f072438c8d641680ba8c1b6757249433ac739220b09edb6c987b49122f2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60311.exe

Filesize
468KB

MD5
c09e6f9b8dcaaf2f51b0a9a7445ca684

SHA1
ef5b2d67246088434776a0d9d7e7cf6927446fd3

SHA256
d1aca28d7a1cf4839514d776bc6d6780bb4dd7ba39f756e4f0b07aff09cb495d

SHA512
8ecbd3f24a448dc0b612c882835edc807d40a0ec23f75b955d8594ee36de27cbd159068a24e94721f2da1c37e97f233f30f035c5b0377e4b27989925267d2b58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-904.exe

Filesize
468KB

MD5
694a70c8a9fa9f47737565a86ee9fc46

SHA1
5348395713923a539f7cc733c7c871a124956c27

SHA256
490f3db4b11d5a06c9fbf413bd96a1a731d0adecafb355186a876e8a443a8b44

SHA512
ab132ae0c648f62cc7dda2161af6deac2d1f679d4b917adc710d6c2d5d4057925de94d3f6b042aa50548554ff9f139822d06178b40cbc2ca542a5996a54d9c7b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13400.exe

Filesize
468KB

MD5
0455244537cacbafd76402be6d769d68

SHA1
5988b177b9502a14a9128b6efb9dc5314bce9951

SHA256
5b5644408a89f05ac21702c8bb00157aa4f300f4098e570fbc210f716cf696e7

SHA512
ca579e1d1a132d1f1fa1c92ef1a0c108686cd04d31f0ca6a83831513330833ec38f7b57141c79ded653d2ee7fdea73448b418702921db3e1eea1babcf5ff67b6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1734.exe

Filesize
468KB

MD5
82d40f768fd10f0211c659d99e82151e

SHA1
b1318f637440d601a2bcff43f9ff234a30f1f624

SHA256
fecc54f1c407dfb9802f3e898f0d8773151eab7e46ea0c8de02d963b7dbf211c

SHA512
fd58ed33ca24721928c881a8177bc1a6ec7a6aeca351d0a6df83b51a774aebd60c1fb92edc56615ffd3a52c6ed24e0687305b0c73f26170469d495bcbaad1797

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20666.exe

Filesize
468KB

MD5
4227a73159cdd67f2a5756c438d3c5ee

SHA1
82c851f115d6f67cced57557616aadf1bcc86d2e

SHA256
54222c44086fda52d80a8f675ffd4e963af81a128c7b8f9d70b4627a7ad9c481

SHA512
8346c48a4378b600c80953173f54d6d642fc0d6673fb41b565bab9793134d6158e5222a5b9a69fd67ba3fafaa0d8c41cce357b38ed2c5c87fd61fb40e5edab08

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3042.exe

Filesize
468KB

MD5
861bc25ff479e05098f237139b83845c

SHA1
da876a1e7de2ce24c3b64f7c37038fb5e5b3e0a9

SHA256
656ad3d18e32d0998f96061b08539c5317454677d006e8ae046b47624f9ea154

SHA512
faef06d17b34f1f01206f5798490857f4d578c9d0a3105e8b2a8a0df624800899afc05dca11639af1b91df5d744ee4502b501f33604330101aec897842f6de85

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31526.exe

Filesize
468KB

MD5
d0ecd79db8c74fb0b5e370d1104ad347

SHA1
db3d0d5b8a000db4af90c713de5d85afb21ada67

SHA256
674a7690fb881640c1c2a2ea221229cb6f23e15d8da9cefb05a3f0281460f8c6

SHA512
f03409aa534bef7ba356f6febb5cba994970e3de44b75dbe4037fa971a3d4abe536bf5370685290003ce8d8dbbc68625dc2d0ff6551a8632d2f04a03327dc56c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3488.exe

Filesize
468KB

MD5
b1f56240efcc5c823202696144d65127

SHA1
f3e7e4c5f0e4c36cb9c55cfcc6abcef26060d890

SHA256
b010fa10b19e9b35389b59ec631d8a9a49d112d4af646844b8118c40d01ea7ca

SHA512
61fe45fcbea6ebefbbd2354ab471a90a38ea28987a28610971998ca085ae44990a5835cb54f8a5c3e9629f6b6c6110910d2936dd2ae3bf4c1566a26ec97190f5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34973.exe

Filesize
468KB

MD5
3ae86e8148385b74adb1dcd9a6ef2a97

SHA1
3ba4901ecd38ebaf255c843a7ffdd5eff96a8357

SHA256
62044aab5bd8c197b1f9168d6e2392cc9cd051725b64014e0cf6bb722c535118

SHA512
5d813afd451d0bc1922df77d8c8619abe285dbfdc6b90db40c8efe127ed524f3c8ff15e8ec134d8e71870dbd67565847aaf69eb2350ffbb377fe7ae5f0b9e7c5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36461.exe

Filesize
468KB

MD5
b90166e94b6307acea4da52ddeb506be

SHA1
14b6826367e381ad5a925bdfd5c4bb2a89b0b266

SHA256
09ff6168e37b869822b0cc73669b356d85adedde00c7b4a97498757693c00409

SHA512
f582afca107050911f31a45e90f22bfd47aab5bcbd39738de529307cc87012a6f339f9cef6d61b042afce19c521fd03c7d08a06f965b050bc1f3e54e27d02204

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62440.exe

Filesize
468KB

MD5
f6edaf8ed0ccd1d9fa3931f81150bdf7

SHA1
39869a9fac6afb6d00e753afaf4099c3ba47bb12

SHA256
f49cd0a3a86b65a3ed5a3c6df00f724593d45aa8333854fd201a1916121318c7

SHA512
589c8f8832e64a125ebafaf75704bfdeb0a2d3eab19923fe53d52a3a6157133add069ec1ded653dbc6a598f81139d583333eae03ce3dedab4e317f83726ebb9e

Download Submit