e4e1aff117773f0abd3d6499fa42295f06c368dd800a464c1e3f31c4baa679b3

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 04:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e4e1aff117773f0abd3d6499fa42295f06c368dd800a464c1e3f31c4baa679b3.exe
Size

468KB
MD5

34d81285a3f0dd1a8033ea5bc1c18d47
SHA1

cf9fa70d2a383a281512e94eea23711791a865f7
SHA256

e4e1aff117773f0abd3d6499fa42295f06c368dd800a464c1e3f31c4baa679b3
SHA512

f930c328926b7c7686bb427caf16b472ca0c168b73edb037c0bfc0d5c1f653d8ed38dcba431bc5f1921972322405edc7ff46b841e8422bb95899d7be5f6eda90
SSDEEP

3072:pU/Lo7uHj28U3bY+Pz3ynfovHx0x+2W0++ZZLC1vl6:pUToiXU3pPDynf+OW0ZnLC1

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2356	Unicorn-45288.exe
2040	Unicorn-55807.exe
2772	Unicorn-12013.exe
2884	Unicorn-29134.exe
2792	Unicorn-34156.exe
2872	Unicorn-62190.exe
3016	Unicorn-6859.exe
1612	Unicorn-12195.exe
2536	Unicorn-1308.exe
1924	Unicorn-61291.exe
2976	Unicorn-55532.exe
1128	Unicorn-34557.exe
1900	Unicorn-53114.exe
3020	Unicorn-52849.exe
1932	Unicorn-54396.exe
2004	Unicorn-27514.exe
1020	Unicorn-58153.exe
696	Unicorn-25289.exe
2404	Unicorn-63093.exe
1536	Unicorn-11291.exe
1068	Unicorn-17422.exe
1768	Unicorn-41661.exe
1532	Unicorn-49793.exe
884	Unicorn-36372.exe
2572	Unicorn-32916.exe
1568	Unicorn-52782.exe
1696	Unicorn-51252.exe
524	Unicorn-12242.exe
1576	Unicorn-47738.exe
2828	Unicorn-41947.exe
2232	Unicorn-11696.exe
2648	Unicorn-29368.exe
324	Unicorn-17094.exe
1144	Unicorn-22544.exe
2980	Unicorn-54292.exe
2700	Unicorn-8620.exe
2956	Unicorn-2490.exe
1416	Unicorn-62569.exe
1464	Unicorn-7297.exe
2728	Unicorn-18952.exe
1056	Unicorn-15959.exe
1368	Unicorn-35864.exe
1204	Unicorn-56799.exe
2072	Unicorn-1661.exe
1476	Unicorn-18263.exe
1328	Unicorn-54234.exe
2456	Unicorn-54039.exe
3068	Unicorn-62969.exe
868	Unicorn-62969.exe
1372	Unicorn-62969.exe
1648	Unicorn-62704.exe
2284	Unicorn-51656.exe
1976	Unicorn-37033.exe
2292	Unicorn-30902.exe
2880	Unicorn-7847.exe
2908	Unicorn-37526.exe
1948	Unicorn-25636.exe
2748	Unicorn-45502.exe
2588	Unicorn-61838.exe
2116	Unicorn-31470.exe
1572	Unicorn-52637.exe
940	Unicorn-15133.exe
2132	Unicorn-9003.exe
2732	Unicorn-54053.exe

Loads dropped DLL 64 IoCs

pid	Process
2552	e4e1aff117773f0abd3d6499fa42295f06c368dd800a464c1e3f31c4baa679b3.exe
2552	e4e1aff117773f0abd3d6499fa42295f06c368dd800a464c1e3f31c4baa679b3.exe
2356	Unicorn-45288.exe
2356	Unicorn-45288.exe
2552	e4e1aff117773f0abd3d6499fa42295f06c368dd800a464c1e3f31c4baa679b3.exe
2552	e4e1aff117773f0abd3d6499fa42295f06c368dd800a464c1e3f31c4baa679b3.exe
2040	Unicorn-55807.exe
2040	Unicorn-55807.exe
2772	Unicorn-12013.exe
2356	Unicorn-45288.exe
2356	Unicorn-45288.exe
2552	e4e1aff117773f0abd3d6499fa42295f06c368dd800a464c1e3f31c4baa679b3.exe
2772	Unicorn-12013.exe
2552	e4e1aff117773f0abd3d6499fa42295f06c368dd800a464c1e3f31c4baa679b3.exe
2704	WerFault.exe
2704	WerFault.exe
2704	WerFault.exe
2704	WerFault.exe
2704	WerFault.exe
2704	WerFault.exe
2040	Unicorn-55807.exe
2040	Unicorn-55807.exe
2792	Unicorn-34156.exe
2792	Unicorn-34156.exe
2356	Unicorn-45288.exe
2356	Unicorn-45288.exe
2772	Unicorn-12013.exe
2872	Unicorn-62190.exe
2772	Unicorn-12013.exe
2872	Unicorn-62190.exe
3016	Unicorn-6859.exe
3016	Unicorn-6859.exe
2552	e4e1aff117773f0abd3d6499fa42295f06c368dd800a464c1e3f31c4baa679b3.exe
2552	e4e1aff117773f0abd3d6499fa42295f06c368dd800a464c1e3f31c4baa679b3.exe
2704	WerFault.exe
2536	Unicorn-1308.exe
2536	Unicorn-1308.exe
2792	Unicorn-34156.exe
2792	Unicorn-34156.exe
1900	Unicorn-53114.exe
1900	Unicorn-53114.exe
2976	Unicorn-55532.exe
2976	Unicorn-55532.exe
3016	Unicorn-6859.exe
1924	Unicorn-61291.exe
3016	Unicorn-6859.exe
2772	Unicorn-12013.exe
1924	Unicorn-61291.exe
2772	Unicorn-12013.exe
1612	Unicorn-12195.exe
2356	Unicorn-45288.exe
1612	Unicorn-12195.exe
2356	Unicorn-45288.exe
2040	Unicorn-55807.exe
2040	Unicorn-55807.exe
2552	e4e1aff117773f0abd3d6499fa42295f06c368dd800a464c1e3f31c4baa679b3.exe
2872	Unicorn-62190.exe
2872	Unicorn-62190.exe
2552	e4e1aff117773f0abd3d6499fa42295f06c368dd800a464c1e3f31c4baa679b3.exe
3020	Unicorn-52849.exe
3020	Unicorn-52849.exe
1932	Unicorn-54396.exe
1932	Unicorn-54396.exe
2536	Unicorn-1308.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2704	2884	WerFault.exe	34

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49967.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41750.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32591.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49596.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2960.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37791.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54039.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52427.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25808.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34156.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56799.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43270.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49605.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40065.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e4e1aff117773f0abd3d6499fa42295f06c368dd800a464c1e3f31c4baa679b3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60767.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33397.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62210.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22643.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52427.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19069.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24717.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11353.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11696.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58153.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30597.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51656.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43296.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25808.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37893.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11011.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30597.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58489.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58489.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62606.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52334.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33234.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36931.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48423.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33091.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25808.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62150.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26427.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48219.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43050.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5726.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57999.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49043.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52427.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3443.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63444.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-604.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2552	e4e1aff117773f0abd3d6499fa42295f06c368dd800a464c1e3f31c4baa679b3.exe
2356	Unicorn-45288.exe
2040	Unicorn-55807.exe
2772	Unicorn-12013.exe
2884	Unicorn-29134.exe
2792	Unicorn-34156.exe
2872	Unicorn-62190.exe
3016	Unicorn-6859.exe
1612	Unicorn-12195.exe
2536	Unicorn-1308.exe
2976	Unicorn-55532.exe
1924	Unicorn-61291.exe
1900	Unicorn-53114.exe
1128	Unicorn-34557.exe
3020	Unicorn-52849.exe
1932	Unicorn-54396.exe
2004	Unicorn-27514.exe
1020	Unicorn-58153.exe
696	Unicorn-25289.exe
2404	Unicorn-63093.exe
1536	Unicorn-11291.exe
1068	Unicorn-17422.exe
1696	Unicorn-51252.exe
524	Unicorn-12242.exe
884	Unicorn-36372.exe
2572	Unicorn-32916.exe
1576	Unicorn-47738.exe
1768	Unicorn-41661.exe
1532	Unicorn-49793.exe
1568	Unicorn-52782.exe
2828	Unicorn-41947.exe
2232	Unicorn-11696.exe
2648	Unicorn-29368.exe
324	Unicorn-17094.exe
2956	Unicorn-2490.exe
1144	Unicorn-22544.exe
2980	Unicorn-54292.exe
2700	Unicorn-8620.exe
1416	Unicorn-62569.exe
1464	Unicorn-7297.exe
2728	Unicorn-18952.exe
1056	Unicorn-15959.exe
1368	Unicorn-35864.exe
1204	Unicorn-56799.exe
2072	Unicorn-1661.exe
1476	Unicorn-18263.exe
1328	Unicorn-54234.exe
2456	Unicorn-54039.exe
3068	Unicorn-62969.exe
1372	Unicorn-62969.exe
868	Unicorn-62969.exe
1648	Unicorn-62704.exe
2284	Unicorn-51656.exe
2880	Unicorn-7847.exe
2588	Unicorn-61838.exe
2748	Unicorn-45502.exe
2908	Unicorn-37526.exe
2292	Unicorn-30902.exe
1572	Unicorn-52637.exe
940	Unicorn-15133.exe
1976	Unicorn-37033.exe
2820	Unicorn-54822.exe
1720	Unicorn-49487.exe
1948	Unicorn-25636.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2356	2552	e4e1aff117773f0abd3d6499fa42295f06c368dd800a464c1e3f31c4baa679b3.exe	31
PID 2552 wrote to memory of 2356	2552	e4e1aff117773f0abd3d6499fa42295f06c368dd800a464c1e3f31c4baa679b3.exe	31
PID 2552 wrote to memory of 2356	2552	e4e1aff117773f0abd3d6499fa42295f06c368dd800a464c1e3f31c4baa679b3.exe	31
PID 2552 wrote to memory of 2356	2552	e4e1aff117773f0abd3d6499fa42295f06c368dd800a464c1e3f31c4baa679b3.exe	31
PID 2356 wrote to memory of 2040	2356	Unicorn-45288.exe	32
PID 2356 wrote to memory of 2040	2356	Unicorn-45288.exe	32
PID 2356 wrote to memory of 2040	2356	Unicorn-45288.exe	32
PID 2356 wrote to memory of 2040	2356	Unicorn-45288.exe	32
PID 2552 wrote to memory of 2772	2552	e4e1aff117773f0abd3d6499fa42295f06c368dd800a464c1e3f31c4baa679b3.exe	33
PID 2552 wrote to memory of 2772	2552	e4e1aff117773f0abd3d6499fa42295f06c368dd800a464c1e3f31c4baa679b3.exe	33
PID 2552 wrote to memory of 2772	2552	e4e1aff117773f0abd3d6499fa42295f06c368dd800a464c1e3f31c4baa679b3.exe	33
PID 2552 wrote to memory of 2772	2552	e4e1aff117773f0abd3d6499fa42295f06c368dd800a464c1e3f31c4baa679b3.exe	33
PID 2040 wrote to memory of 2884	2040	Unicorn-55807.exe	34
PID 2040 wrote to memory of 2884	2040	Unicorn-55807.exe	34
PID 2040 wrote to memory of 2884	2040	Unicorn-55807.exe	34
PID 2040 wrote to memory of 2884	2040	Unicorn-55807.exe	34
PID 2356 wrote to memory of 2792	2356	Unicorn-45288.exe	36
PID 2356 wrote to memory of 2792	2356	Unicorn-45288.exe	36
PID 2356 wrote to memory of 2792	2356	Unicorn-45288.exe	36
PID 2356 wrote to memory of 2792	2356	Unicorn-45288.exe	36
PID 2772 wrote to memory of 2872	2772	Unicorn-12013.exe	35
PID 2772 wrote to memory of 2872	2772	Unicorn-12013.exe	35
PID 2772 wrote to memory of 2872	2772	Unicorn-12013.exe	35
PID 2772 wrote to memory of 2872	2772	Unicorn-12013.exe	35
PID 2552 wrote to memory of 3016	2552	e4e1aff117773f0abd3d6499fa42295f06c368dd800a464c1e3f31c4baa679b3.exe	37
PID 2552 wrote to memory of 3016	2552	e4e1aff117773f0abd3d6499fa42295f06c368dd800a464c1e3f31c4baa679b3.exe	37
PID 2552 wrote to memory of 3016	2552	e4e1aff117773f0abd3d6499fa42295f06c368dd800a464c1e3f31c4baa679b3.exe	37
PID 2552 wrote to memory of 3016	2552	e4e1aff117773f0abd3d6499fa42295f06c368dd800a464c1e3f31c4baa679b3.exe	37
PID 2884 wrote to memory of 2704	2884	Unicorn-29134.exe	38
PID 2884 wrote to memory of 2704	2884	Unicorn-29134.exe	38
PID 2884 wrote to memory of 2704	2884	Unicorn-29134.exe	38
PID 2884 wrote to memory of 2704	2884	Unicorn-29134.exe	38
PID 2040 wrote to memory of 1612	2040	Unicorn-55807.exe	39
PID 2040 wrote to memory of 1612	2040	Unicorn-55807.exe	39
PID 2040 wrote to memory of 1612	2040	Unicorn-55807.exe	39
PID 2040 wrote to memory of 1612	2040	Unicorn-55807.exe	39
PID 2792 wrote to memory of 2536	2792	Unicorn-34156.exe	40
PID 2792 wrote to memory of 2536	2792	Unicorn-34156.exe	40
PID 2792 wrote to memory of 2536	2792	Unicorn-34156.exe	40
PID 2792 wrote to memory of 2536	2792	Unicorn-34156.exe	40
PID 2356 wrote to memory of 1924	2356	Unicorn-45288.exe	41
PID 2356 wrote to memory of 1924	2356	Unicorn-45288.exe	41
PID 2356 wrote to memory of 1924	2356	Unicorn-45288.exe	41
PID 2356 wrote to memory of 1924	2356	Unicorn-45288.exe	41
PID 2772 wrote to memory of 2976	2772	Unicorn-12013.exe	42
PID 2772 wrote to memory of 2976	2772	Unicorn-12013.exe	42
PID 2772 wrote to memory of 2976	2772	Unicorn-12013.exe	42
PID 2772 wrote to memory of 2976	2772	Unicorn-12013.exe	42
PID 2872 wrote to memory of 1128	2872	Unicorn-62190.exe	43
PID 2872 wrote to memory of 1128	2872	Unicorn-62190.exe	43
PID 2872 wrote to memory of 1128	2872	Unicorn-62190.exe	43
PID 2872 wrote to memory of 1128	2872	Unicorn-62190.exe	43
PID 3016 wrote to memory of 1900	3016	Unicorn-6859.exe	44
PID 3016 wrote to memory of 1900	3016	Unicorn-6859.exe	44
PID 3016 wrote to memory of 1900	3016	Unicorn-6859.exe	44
PID 3016 wrote to memory of 1900	3016	Unicorn-6859.exe	44
PID 2552 wrote to memory of 3020	2552	e4e1aff117773f0abd3d6499fa42295f06c368dd800a464c1e3f31c4baa679b3.exe	45
PID 2552 wrote to memory of 3020	2552	e4e1aff117773f0abd3d6499fa42295f06c368dd800a464c1e3f31c4baa679b3.exe	45
PID 2552 wrote to memory of 3020	2552	e4e1aff117773f0abd3d6499fa42295f06c368dd800a464c1e3f31c4baa679b3.exe	45
PID 2552 wrote to memory of 3020	2552	e4e1aff117773f0abd3d6499fa42295f06c368dd800a464c1e3f31c4baa679b3.exe	45
PID 2536 wrote to memory of 1932	2536	Unicorn-1308.exe	46
PID 2536 wrote to memory of 1932	2536	Unicorn-1308.exe	46
PID 2536 wrote to memory of 1932	2536	Unicorn-1308.exe	46
PID 2536 wrote to memory of 1932	2536	Unicorn-1308.exe	46

C:\Users\Admin\AppData\Local\Temp\e4e1aff117773f0abd3d6499fa42295f06c368dd800a464c1e3f31c4baa679b3.exe
"C:\Users\Admin\AppData\Local\Temp\e4e1aff117773f0abd3d6499fa42295f06c368dd800a464c1e3f31c4baa679b3.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45288.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45288.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55807.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55807.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29134.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2884
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 240
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:2704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12195.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49793.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33948.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8411.exe
        6⤵
        
        PID:1064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37112.exe
        6⤵
        
        PID:3376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37362.exe
        6⤵
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48645.exe
        6⤵
        
        PID:4368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62731.exe
        6⤵
        
        PID:4752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63444.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9272.exe
        6⤵
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27705.exe
        6⤵
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25808.exe
        6⤵
        
        PID:3288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22643.exe
        6⤵
        
        PID:5032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28722.exe
        6⤵
        
        PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14299.exe
        5⤵
        
        PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8193.exe
        5⤵
        
        PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23008.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16549.exe
        5⤵
        
        PID:4584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62731.exe
        5⤵
        
        PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36372.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56799.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9570.exe
        6⤵
        
        PID:436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53197.exe
        7⤵
        
        PID:5492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62993.exe
        6⤵
        
        PID:2704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3043.exe
        6⤵
        
        PID:3700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28035.exe
        6⤵
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-174.exe
        6⤵
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        6⤵
        
        PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49487.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16844.exe
        6⤵
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58489.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
        6⤵
        
        PID:3152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36931.exe
        6⤵
        
        PID:3604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43050.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5726.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3142.exe
        5⤵
        
        PID:1292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22802.exe
        5⤵
        
        PID:2744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23008.exe
        5⤵
        
        PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62979.exe
        5⤵
        
        PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-438.exe
        5⤵
        
        PID:5620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1661.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54822.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46020.exe
        6⤵
        
        PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64062.exe
        5⤵
        
        PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5146.exe
        5⤵
        
        PID:3916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22624.exe
        5⤵
        
        PID:3840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33084.exe
        5⤵
        
        PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59322.exe
        5⤵
        
        PID:6076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49841.exe
      4⤵
      PID:1252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15069.exe
        5⤵
        
        PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1800.exe
        5⤵
        
        PID:1016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47594.exe
        5⤵
        
        PID:3744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9269.exe
        5⤵
        
        PID:4884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21936.exe
        5⤵
        
        PID:5292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57393.exe
      4⤵
      PID:1388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2876.exe
      4⤵
      PID:3772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2008.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6749.exe
      4⤵
      PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40065.exe
      4⤵
      PID:4732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34156.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34156.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1308.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54396.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12242.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7297.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15133.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28277.exe
        9⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        9⤵
        
        PID:1296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53236.exe
        9⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32591.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59322.exe
        9⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28012.exe
        8⤵
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59806.exe
        8⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45101.exe
        8⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20384.exe
        8⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27125.exe
        8⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52637.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4538.exe
        7⤵
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11011.exe
        7⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23008.exe
        7⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16549.exe
        7⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32425.exe
        7⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18952.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61838.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56486.exe
        8⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57999.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31065.exe
        8⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8117.exe
        8⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62201.exe
        8⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32929.exe
        7⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11011.exe
        7⤵
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23008.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16549.exe
        7⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37791.exe
        7⤵
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26636.exe
        6⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11353.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56948.exe
        7⤵
        
        PID:3812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25808.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13837.exe
        7⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5401.exe
        7⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36953.exe
        6⤵
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51348.exe
        6⤵
        
        PID:3780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23538.exe
        6⤵
        
        PID:3900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20252.exe
        6⤵
        
        PID:4312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45618.exe
        6⤵
        
        PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47738.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9272.exe
        6⤵
        
        PID:1492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27705.exe
        6⤵
        
        PID:1916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25808.exe
        6⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22643.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30597.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8383.exe
        5⤵
        
        PID:2652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25173.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35402.exe
        5⤵
        
        PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62960.exe
        5⤵
        
        PID:3684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41783.exe
        5⤵
        
        PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57754.exe
        5⤵
        
        PID:5820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27514.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41947.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15959.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42298.exe
        7⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        7⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25808.exe
        7⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6083.exe
        7⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30597.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32468.exe
        6⤵
        
        PID:900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2960.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28265.exe
        6⤵
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49605.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37791.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35864.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45502.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4159.exe
        7⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17330.exe
        7⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60773.exe
        7⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35584.exe
        7⤵
        
        PID:5564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22432.exe
        6⤵
        
        PID:1700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19069.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31674.exe
        6⤵
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33084.exe
        6⤵
        
        PID:4412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5773.exe
        6⤵
        
        PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9003.exe
        5⤵
        Executes dropped EXE
        
        PID:2132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21706.exe
        6⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37525.exe
        6⤵
        
        PID:4232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14259.exe
        6⤵
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10403.exe
        5⤵
        
        PID:2632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2346.exe
        5⤵
        
        PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6473.exe
        5⤵
        
        PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33615.exe
        5⤵
        
        PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        5⤵
        
        PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11696.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52334.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30529.exe
        6⤵
        
        PID:2328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7939.exe
        6⤵
        
        PID:3996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16758.exe
        6⤵
        
        PID:3820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41750.exe
        6⤵
        
        PID:4392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42256.exe
        6⤵
        
        PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8411.exe
        5⤵
        
        PID:972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23008.exe
        5⤵
        
        PID:4080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16549.exe
        5⤵
        
        PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62731.exe
        5⤵
        
        PID:4748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63750.exe
      4⤵
      PID:2620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19346.exe
      4⤵
      PID:2952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43270.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23570.exe
      4⤵
      PID:4504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38845.exe
      4⤵
      PID:4556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8462.exe
      4⤵
      PID:4328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61291.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61291.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17422.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37526.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19854.exe
        6⤵
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46367.exe
        6⤵
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25808.exe
        6⤵
        
        PID:3260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22643.exe
        6⤵
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28722.exe
        6⤵
        
        PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3190.exe
        5⤵
        
        PID:828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52427.exe
        5⤵
        
        PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31674.exe
        5⤵
        
        PID:4056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33084.exe
        5⤵
        
        PID:4440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59322.exe
        5⤵
        
        PID:6048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25636.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49043.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26363.exe
        5⤵
        
        PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40.exe
        5⤵
        
        PID:5232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36168.exe
      4⤵
      PID:2500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24935.exe
      4⤵
      PID:3588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23008.exe
      4⤵
      PID:3076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16549.exe
      4⤵
      PID:4348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22466.exe
      4⤵
      PID:5284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41661.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41661.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62969.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9272.exe
        5⤵
        
        PID:2192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62812.exe
        5⤵
        
        PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25808.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13837.exe
        5⤵
        
        PID:4180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45665.exe
        5⤵
        
        PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54944.exe
      4⤵
      PID:2608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24912.exe
      4⤵
      PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31674.exe
      4⤵
      PID:4028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33084.exe
      4⤵
      PID:4240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29905.exe
      4⤵
      PID:5268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54039.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54039.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3815.exe
      4⤵
      PID:1444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52334.exe
        5⤵
        
        PID:1080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62632.exe
        5⤵
        
        PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36931.exe
        5⤵
        
        PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57973.exe
        5⤵
        
        PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59322.exe
        5⤵
        
        PID:6040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57357.exe
      4⤵
      PID:1376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52427.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31674.exe
      4⤵
      PID:4012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41253.exe
      4⤵
      PID:4256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45665.exe
      4⤵
      PID:4800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34566.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34566.exe
    3⤵
    PID:3032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58068.exe
      4⤵
      PID:2244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8411.exe
      4⤵
      PID:2144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
      4⤵
      PID:3168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36931.exe
      4⤵
      PID:3548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-604.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45767.exe
      4⤵
      PID:5264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23902.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23902.exe
    3⤵
    PID:372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48423.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48423.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
    3⤵
    PID:3096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6130.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6130.exe
    3⤵
    PID:3896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16270.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16270.exe
    3⤵
    PID:4852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59666.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59666.exe
    3⤵
    PID:4644
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12013.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12013.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62190.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62190.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34557.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54292.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56275.exe
        6⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3443.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26427.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35392.exe
        7⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54914.exe
        7⤵
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59655.exe
        6⤵
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59915.exe
        6⤵
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11730.exe
        6⤵
        
        PID:3716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1134.exe
        6⤵
        
        PID:4820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-936.exe
        6⤵
        
        PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11608.exe
        5⤵
        
        PID:1736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17056.exe
        5⤵
        
        PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43379.exe
        5⤵
        
        PID:3756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1074.exe
        5⤵
        
        PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48219.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62106.exe
        5⤵
        
        PID:5160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32916.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18263.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36948.exe
        6⤵
        
        PID:536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62715.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38000.exe
        6⤵
        
        PID:3640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49229.exe
        6⤵
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38566.exe
        6⤵
        
        PID:2712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43625.exe
        5⤵
        
        PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52427.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31674.exe
        5⤵
        
        PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41253.exe
        5⤵
        
        PID:4264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45665.exe
        5⤵
        
        PID:3676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54234.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57373.exe
        5⤵
        
        PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38691.exe
        5⤵
        
        PID:3404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25808.exe
        5⤵
        
        PID:3468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41750.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62201.exe
        5⤵
        
        PID:4780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13662.exe
      4⤵
      PID:2984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59133.exe
        5⤵
        
        PID:3508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12073.exe
        5⤵
        
        PID:2260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16777.exe
        5⤵
        
        PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5329.exe
        5⤵
        
        PID:4152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49627.exe
      4⤵
      PID:3396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56250.exe
      4⤵
      PID:3492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9749.exe
      4⤵
      PID:4736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36656.exe
      4⤵
      PID:6000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55532.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55532.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25289.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8620.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32303.exe
        6⤵
        
        PID:1740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8411.exe
        6⤵
        
        PID:2944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
        6⤵
        
        PID:3140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36931.exe
        6⤵
        
        PID:3616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40485.exe
        6⤵
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45665.exe
        6⤵
        
        PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54944.exe
        5⤵
        
        PID:2180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16936.exe
        5⤵
        
        PID:2708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31674.exe
        5⤵
        
        PID:3976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13977.exe
        5⤵
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45788.exe
        5⤵
        
        PID:5740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62569.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49295.exe
        5⤵
        
        PID:1936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45029.exe
        6⤵
        
        PID:5428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13796.exe
        5⤵
        
        PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11011.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23008.exe
        5⤵
        
        PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16549.exe
        5⤵
        
        PID:4576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30902.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48614.exe
        5⤵
        
        PID:3216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12073.exe
        5⤵
        
        PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58277.exe
        5⤵
        
        PID:4208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5329.exe
        5⤵
        
        PID:4172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65468.exe
      4⤵
      PID:908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43296.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23570.exe
      4⤵
      PID:4512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13957.exe
      4⤵
      PID:4228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40065.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11291.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11291.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62969.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9272.exe
        5⤵
        
        PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3201.exe
        5⤵
        
        PID:2524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13717.exe
        6⤵
        
        PID:4336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26154.exe
        6⤵
        
        PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25808.exe
        5⤵
        
        PID:4032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22643.exe
        5⤵
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11740.exe
        5⤵
        
        PID:5360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54944.exe
      4⤵
      PID:568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39988.exe
      4⤵
      PID:1728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31674.exe
      4⤵
      PID:3932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22145.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14062.exe
      4⤵
      PID:4596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62704.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62704.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18775.exe
      4⤵
      PID:1152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56948.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25808.exe
      4⤵
      PID:3352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12756.exe
      4⤵
      PID:4488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55632.exe
      4⤵
      PID:3940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6258.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6258.exe
    3⤵
    PID:2916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33091.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33091.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23538.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23538.exe
    3⤵
    PID:924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12084.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12084.exe
    3⤵
    PID:4628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61138.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61138.exe
    3⤵
    PID:5304
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6859.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6859.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58153.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29368.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37033.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31939.exe
        7⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3042.exe
        7⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65001.exe
        7⤵
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45868.exe
        6⤵
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52427.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31674.exe
        6⤵
        
        PID:4036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33084.exe
        6⤵
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59322.exe
        6⤵
        
        PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7847.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11177.exe
        6⤵
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25808.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49809.exe
        6⤵
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62201.exe
        6⤵
        
        PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10210.exe
        5⤵
        
        PID:768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58292.exe
        5⤵
        
        PID:3380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23008.exe
        5⤵
        
        PID:3908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24717.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63090.exe
        5⤵
        
        PID:5844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17094.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60767.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56948.exe
        5⤵
        
        PID:3788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16872.exe
        5⤵
        
        PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49918.exe
        5⤵
        
        PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62201.exe
        5⤵
        
        PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35493.exe
      4⤵
      PID:1756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28012.exe
      4⤵
      PID:1796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11911.exe
      4⤵
      PID:3300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37893.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44180.exe
      4⤵
      PID:4468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35865.exe
      4⤵
      PID:5024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63093.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63093.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22544.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3815.exe
        5⤵
        
        PID:2464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
        6⤵
        
        PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16397.exe
        5⤵
        
        PID:2764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5146.exe
        5⤵
        
        PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64154.exe
        5⤵
        
        PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33084.exe
        5⤵
        
        PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59322.exe
        5⤵
        
        PID:6028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49596.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3475.exe
        5⤵
        
        PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11070.exe
        5⤵
        
        PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33397.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63106.exe
      4⤵
      PID:2084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33234.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37893.exe
      4⤵
      PID:4652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28617.exe
      4⤵
      PID:4244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40065.exe
      4⤵
      PID:4716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2490.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2490.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38935.exe
      4⤵
      PID:3040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36620.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6197.exe
      4⤵
      PID:3992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36931.exe
      4⤵
      PID:3520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64989.exe
      4⤵
      PID:4960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30398.exe
      4⤵
      PID:4696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40974.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40974.exe
    3⤵
    PID:2964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3887.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3887.exe
    3⤵
    PID:1724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43270.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43270.exe
    3⤵
    PID:3088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28796.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28796.exe
    3⤵
    PID:3232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45140.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45140.exe
    3⤵
    PID:4876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20105.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20105.exe
    3⤵
    PID:5276
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52849.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52849.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:3020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52782.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52782.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62969.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43045.exe
        5⤵
        
        PID:2900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9272.exe
        6⤵
        
        PID:2520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28748.exe
        6⤵
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25808.exe
        6⤵
        
        PID:3368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49918.exe
        6⤵
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62201.exe
        6⤵
        
        PID:4840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22981.exe
        5⤵
        
        PID:672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58292.exe
        5⤵
        
        PID:3388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23008.exe
        5⤵
        
        PID:3196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16549.exe
        5⤵
        
        PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37791.exe
        5⤵
        
        PID:6112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59225.exe
      4⤵
      PID:2540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24398.exe
      4⤵
      PID:376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27540.exe
      4⤵
      PID:3984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13958.exe
      4⤵
      PID:3764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16549.exe
      4⤵
      PID:4420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37791.exe
      4⤵
      PID:6084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51656.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51656.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33071.exe
      4⤵
      PID:2120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58489.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36931.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54479.exe
      4⤵
      PID:5048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49967.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52021.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52021.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62150.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10809.exe
      4⤵
      PID:5188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28012.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28012.exe
    3⤵
    PID:1944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59806.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59806.exe
    3⤵
    PID:3240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45101.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45101.exe
    3⤵
    PID:4472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11591.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11591.exe
    3⤵
    PID:4560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29342.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29342.exe
    3⤵
    PID:5168
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51252.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51252.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31470.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31470.exe
    3⤵
    - Executes dropped EXE
    PID:2116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56340.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56340.exe
    3⤵
    PID:1688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5146.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5146.exe
    3⤵
    PID:3852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38960.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38960.exe
    3⤵
    PID:3464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41253.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41253.exe
    3⤵
    PID:4252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2747.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2747.exe
    3⤵
    PID:5864
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54053.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54053.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9272.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9272.exe
    3⤵
    PID:580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11177.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11177.exe
    3⤵
    PID:3112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25808.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25808.exe
    3⤵
    PID:3480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41750.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41750.exe
    3⤵
    PID:4364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42256.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42256.exe
    3⤵
    PID:6092
- C:\Users\Admin\AppData\Local\Temp\Unicorn-872.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-872.exe
  2⤵
  PID:1656
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1112.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1112.exe
  2⤵
  PID:3120
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62210.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62210.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2228
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10949.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10949.exe
  2⤵
  PID:4620
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37602.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37602.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11696.exe

Filesize
468KB

MD5
484839ae86c3c76cc9f1aabdf1646fe6

SHA1
7f561e2ec589195a7bb5511e71027b0ecc8694c7

SHA256
8804f12c5a20e640b3b3eb38b397518d2cfce2a34a14b71bd482fea01bb09eb3

SHA512
1cbe63097e83cc4a4e333e1599012ef05f21403b1e0d4c434b3a12f50d65e39ccf1de0fbfcc5106badfc7a6dfbca3a436532526164389081baa85a0ef6046ba0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12013.exe

Filesize
468KB

MD5
5ac1bf206c16ca1ca69c82e27beeec23

SHA1
5aaf4ef2cd5a45b605d91312f086fe67f55ae5c7

SHA256
259b21cd1e84cb0d70926b127d53ac306b66740d3a1749fa17c31e394d061fb8

SHA512
26a78dc010ce1f5e9aa8b599b2b55d655a595b71f19f0fa2f0cdbdf4bc7ab009a9558eebb14585f6898b14321335e2e4a45d564b967fc113fa83265e2ea19a4f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12195.exe

Filesize
468KB

MD5
ecabc5a5653ac571b2fe7d99bf472c2a

SHA1
bb6d8c5d17c30a9ccd9d160aa1b758f21afc7955

SHA256
0a0862c792584cbe05d8f7566f33b8e2a5233283c231b63b98e1f7a77a494ec4

SHA512
7b4cbc97297ffa4ce8d2f939b3538c3063160d4fad89e2363e7b3a23661375da38c670eb7f080ed7198f9af1b5618526e70e4ee17dba7685e6e061de19ebec34

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1308.exe

Filesize
468KB

MD5
6918e63012c44559c96f6e336bf03875

SHA1
2e06b3a935166fa9134f4d69daf9100195ac46bb

SHA256
280d876ecddc4a939d1f1129ab55f1ebf05a43c3c26daab54e1b7e4265b94c3d

SHA512
03205507c4c7030427a37a2bf63fd99444fb8cb77d83f2e7c609664bf2d957b29efca8e91f5b985ef73ee9ada3a3b2eb670e94639996aa6b2806e8b45fef0e8d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27514.exe

Filesize
468KB

MD5
20bbfd285bfb0d736adf84dd51b8f8f5

SHA1
02ed9a54ce8cf0d64ea4e0865f8dfaee86fbb0c4

SHA256
4e8017ce20c60f46675cfddc37a4ed6bab93912b66576ccab8192fc37bed37be

SHA512
5e4f4362c77ac3215f585b2e01af2c005b0bb2543d3920de188027b4380be34a602b0dc16dd0b0f4b8a9c5fd361e65231fd62475b5240dc0a4bd2dea4fca8dc3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29134.exe

Filesize
468KB

MD5
b987cc69fc19c23892c6de489ed01646

SHA1
d5002a204acdaafff78541a63e8ae608918434da

SHA256
4eeaad0af50de2861a55cbddc7471537a21b5ae98d308f5e5109dfed2deb2eb4

SHA512
5fbb1e41c6c415de15dd744eee20efd5699db66ce12fcd2729d30ba07617ef11158bcb75d90d81957e15027fcb58a2acffe069c6adf53c7e46df78afc458eb4c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34156.exe

Filesize
468KB

MD5
26bf4f7d8d040db339744989a62efd88

SHA1
1c49f8ead47a9eb17cf775f0762dca6675f43e7a

SHA256
ad6941d3f7da8d8d1afb3ccd54461389f1ba66a4cc6f89a36826db63b50dfdb9

SHA512
a93ae762a53a77c267451c2e52a58c242a0e7ef3ff5f455c8cf87c25fb1a53e644c6d984ac46a4f9bcf77f68f41ab0b6efa17d71b8818e0ba578e7c97c13bd75

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34557.exe

Filesize
468KB

MD5
fac6176cbb9168e2bca88749f17707ae

SHA1
b09cbe16498e142ae69af7f078364a8ef1392116

SHA256
725b1d701ffbffe12cb8aa8a9ceb09ee15ca0df8d5554d9c9511e074f45eaacb

SHA512
eedb2118c572f050ec9e4778ebee58c4327cdd867dc0dc34e18efa4a6deaca609d11e437bb1449c064b947e9daf844eb16e52c6d209184acf5ebae871df06cf6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45288.exe

Filesize
468KB

MD5
2c13fb3326126832c10306b9f7386d5a

SHA1
6843b2faad39821ef5b54a74a4f65f28b12a3be0

SHA256
302ba0be5e4a41ca678aa4b35c99796bf9e6ec3c33901e372b9f6434df65c823

SHA512
a97cfa0e98266afdfdf683036c358a25b6677aeba321b43f15a0ea84b8792370d0ce9bcc4ad7cb95c9312fc454e2e6629e6d1a7c6b81e5a6edc9f490d0835b05

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52849.exe

Filesize
468KB

MD5
6078259460124530e92820d4e71f9957

SHA1
f8ef3e5df2c33d978d32c818df0bc5ab79a80d25

SHA256
b0d129a68d6f6fa1f2b036718f7c5d36e4acdf41c1f066ee0f4514afde93d8ba

SHA512
20638e24a92fadcb97ceea0107120ecf7a55645306f5d1162e61e759fd116dd719a0635068dc14712179d7ed7ae6072a61ea7ac63c2569a981045f866318f241

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe

Filesize
468KB

MD5
35a0e6aa1910c51fff22dcbb1099b37b

SHA1
c7b882e1704e5c64687af6e1fcedc3f02614c973

SHA256
5ba43d3bf43fac62095bef1d6898c127fe9fbc4f0f04be28ff105b5c13b2f299

SHA512
56b60067c7bd97efda2f373fc4c7e8764ab13ebf83af6b0341b0e1ce97b7c80851b8909b78dcdccb50047fde38ee5826bd56522a805240acbd2c1551c2c363e0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54396.exe

Filesize
468KB

MD5
4e8e45eabebbb5ae9e0105282e9d5c8e

SHA1
135980a7ddc8b7dc76411949e0f6babf0fd59a25

SHA256
f3ae55c3a7e60620d4478a036f6b34c99426a816b90f43931f7cb7e0008c587d

SHA512
c24eb4b67dd004a313a4335f20ad99122c6f9132a21671db0d1cda6bd8f0ca556e5fc8d0e3c6f23d5148582fd0a63d246c5cc36d3d50c026d69d42dc0a78235d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55532.exe

Filesize
468KB

MD5
6b524579bbc80cbe8d86bb4511c8620d

SHA1
60a6c172faad28fd90adffade5817d44f60d993b

SHA256
8fa61d98bd9af86351eab8d4437e3041298d37b454ff69ef773897c57801ef26

SHA512
e0d9fa64ab4e99fb5347f933b72e719a13e6612a8608168e7b0a6346e4faad75e3e42f91af2a96514ec45a058fbb67d76fa3bbad763f8d803b18d7a6b7a45e15

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55807.exe

Filesize
468KB

MD5
b3d23d575db8fb483c2973874afd5a13

SHA1
097189f5d8a0a9db559ba1d7c0929d78e4c10094

SHA256
836c2323258a6e2dfb2926c7090779c5fd0385a5c4ebabd1818f26971d6fa1a5

SHA512
840917c853c055376828c9e1eb8829c6ed126aa2d0df8957e8a959b4a5ad418ea518d506e1118c5610d5fdcdc644b394599652df4060d355be3af0b16fc7cea5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61291.exe

Filesize
468KB

MD5
d68b2bf098ef6dd7255ce87fa17459e4

SHA1
1ad700ee9104bc5e96db97350c31d237b37cae80

SHA256
4eabdecb555beb974aef7963df3a0ad55455af8bf8a71ff90b3e466ccbd941be

SHA512
24aebbd47453784d596392cea27fb1f75df267502d9ba404e960415fde8db47a908d4e728d56e69fba7f2fe3ee1d480bc4f3d21d3a27fbd3d2a0b8e85b106b84

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62190.exe

Filesize
468KB

MD5
1bb01654e518901e9c8ce95c1314482a

SHA1
b8675b0b1700d1af4973b32159b7e47f2c07312e

SHA256
b47339f6fa6f1182c07099be003a6c08cf4fec093498b3dfc4d81d7d66d06ccf

SHA512
361b747bf2b100ff432fb9e526141d80cbd16ab4110d6f7811af1d2138daa0b428925878cd3f1be58af257be2372b14d3f6a099c221ba250c2747196b2475eac

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-6859.exe

Filesize
468KB

MD5
0a27c225beb05a74f12184e78ffd2dd6

SHA1
19804458a202401f4656e0bbdf80fc4f2a2dc3f2

SHA256
940c5d5d32884bbda61ee9d6a98c366a484cdc8f65936616f94ffb3d402455ef

SHA512
f4544abb0a34f98ad6bbc0a4b5be626bc99c944395c86e0086bdab790e2fc00a485447a9d2d05aba43da5c1fc0d70154856101c0f558c4122d248332dff40d84

Download Submit
memory/324-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/524-316-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/696-409-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/696-229-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/696-411-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/1020-364-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/1020-228-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1068-257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1128-407-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/1128-408-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/1128-150-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1144-387-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1532-279-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1536-256-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1568-306-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1576-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1612-263-0x0000000000710000-0x0000000000785000-memory.dmp

Filesize
468KB

Download
memory/1612-274-0x0000000000710000-0x0000000000785000-memory.dmp

Filesize
468KB

Download
memory/1612-102-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1696-307-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1768-278-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1900-377-0x0000000002560000-0x00000000025D5000-memory.dmp

Filesize
468KB

Download
memory/1900-226-0x0000000002560000-0x00000000025D5000-memory.dmp

Filesize
468KB

Download
memory/1900-174-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1900-225-0x0000000002560000-0x00000000025D5000-memory.dmp

Filesize
468KB

Download
memory/1924-255-0x0000000002980000-0x00000000029F5000-memory.dmp

Filesize
468KB

Download
memory/1924-249-0x0000000002980000-0x00000000029F5000-memory.dmp

Filesize
468KB

Download
memory/1924-133-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1932-197-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1932-314-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/1932-310-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/2004-208-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2004-347-0x00000000026D0000-0x0000000002745000-memory.dmp

Filesize
468KB

Download
memory/2004-346-0x00000000026D0000-0x0000000002745000-memory.dmp

Filesize
468KB

Download
memory/2040-277-0x0000000000700000-0x0000000000775000-memory.dmp

Filesize
468KB

Download
memory/2040-283-0x0000000000700000-0x0000000000775000-memory.dmp

Filesize
468KB

Download
memory/2040-47-0x0000000000700000-0x0000000000775000-memory.dmp

Filesize
468KB

Download
memory/2040-405-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2040-26-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2232-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2356-122-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/2356-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2356-24-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/2356-273-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/2356-275-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/2404-386-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2404-385-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2404-252-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2536-195-0x0000000001CB0000-0x0000000001D25000-memory.dmp

Filesize
468KB

Download
memory/2536-116-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2536-196-0x0000000001CB0000-0x0000000001D25000-memory.dmp

Filesize
468KB

Download
memory/2536-318-0x0000000001CB0000-0x0000000001D25000-memory.dmp

Filesize
468KB

Download
memory/2536-322-0x0000000001CB0000-0x0000000001D25000-memory.dmp

Filesize
468KB

Download
memory/2552-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2552-348-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2552-10-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2552-296-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2552-11-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2552-172-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2552-297-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2552-173-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2572-303-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2648-368-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2700-413-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2772-58-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/2772-36-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2772-131-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/2772-254-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/2772-251-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/2792-113-0x0000000001CC0000-0x0000000001D35000-memory.dmp

Filesize
468KB

Download
memory/2792-66-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2792-206-0x0000000001CC0000-0x0000000001D35000-memory.dmp

Filesize
468KB

Download
memory/2792-205-0x0000000001CC0000-0x0000000001D35000-memory.dmp

Filesize
468KB

Download
memory/2792-357-0x0000000001CC0000-0x0000000001D35000-memory.dmp

Filesize
468KB

Download
memory/2792-358-0x0000000001CC0000-0x0000000001D35000-memory.dmp

Filesize
468KB

Download
memory/2828-349-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2872-136-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/2872-74-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2872-298-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/2872-148-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/2884-49-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2956-414-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2976-227-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/2976-222-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/2976-147-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2980-410-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3016-235-0x0000000001DB0000-0x0000000001E25000-memory.dmp

Filesize
468KB

Download
memory/3016-412-0x0000000001DB0000-0x0000000001E25000-memory.dmp

Filesize
468KB

Download
memory/3016-170-0x0000000001DB0000-0x0000000001E25000-memory.dmp

Filesize
468KB

Download
memory/3016-80-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3016-250-0x0000000001DB0000-0x0000000001E25000-memory.dmp

Filesize
468KB

Download
memory/3016-171-0x0000000001DB0000-0x0000000001E25000-memory.dmp

Filesize
468KB

Download
memory/3016-406-0x0000000001DB0000-0x0000000001E25000-memory.dmp

Filesize
468KB

Download
memory/3020-305-0x00000000029A0000-0x0000000002A15000-memory.dmp

Filesize
468KB

Download
memory/3020-304-0x00000000029A0000-0x0000000002A15000-memory.dmp

Filesize
468KB

Download
memory/3020-179-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download