158d6f1c5cc2a8b3d09c02a1f6bdbe159ef612cf1b20b0761e808a2f4e80634d

Analysis

max time kernel
115s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 05:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8feffe2531c688c8c1ce5d46fd89960N.exe
Size

468KB
MD5

c8feffe2531c688c8c1ce5d46fd89960
SHA1

b44771b32767b835b87cd890ee62725ab3a2c304
SHA256

158d6f1c5cc2a8b3d09c02a1f6bdbe159ef612cf1b20b0761e808a2f4e80634d
SHA512

eda1b4e69969c29f539d35a6164e3752ba837749e215d041b834dee11ccc379978df7a89dde45e37d12ce89be9ea1fe12291265ed5b0afc5895ea241f91ebd2a
SSDEEP

3072:OQoHogIKI05QtbYJHz5Ocfr/GCyzP0K9nLHeaVPdZwiLlXDg/Olq:OQIoD8QtOHVOcfQjQwZwk9Dg/

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2764	Unicorn-53651.exe
3040	Unicorn-37564.exe
2880	Unicorn-42010.exe
2516	Unicorn-37149.exe
2656	Unicorn-58124.exe
2504	Unicorn-4284.exe
2128	Unicorn-29181.exe
920	Unicorn-59593.exe
1916	Unicorn-20206.exe
2188	Unicorn-9816.exe
2212	Unicorn-3686.exe
2720	Unicorn-9816.exe
1988	Unicorn-55488.exe
2040	Unicorn-24072.exe
760	Unicorn-59405.exe
2376	Unicorn-23538.exe
1716	Unicorn-14415.exe
2932	Unicorn-23346.exe
1952	Unicorn-2904.exe
2064	Unicorn-22770.exe
1636	Unicorn-22770.exe
924	Unicorn-15378.exe
1564	Unicorn-5172.exe
948	Unicorn-5172.exe
316	Unicorn-26531.exe
2360	Unicorn-29796.exe
2532	Unicorn-30061.exe
1656	Unicorn-12307.exe
756	Unicorn-49168.exe
2324	Unicorn-32183.exe
3000	Unicorn-18040.exe
1720	Unicorn-32339.exe
2308	Unicorn-36852.exe
1732	Unicorn-12349.exe
2220	Unicorn-61934.exe
1588	Unicorn-53766.exe
3016	Unicorn-16303.exe
2100	Unicorn-1887.exe
2528	Unicorn-57039.exe
2756	Unicorn-13008.exe
2524	Unicorn-26199.exe
1616	Unicorn-54233.exe
1992	Unicorn-822.exe
1660	Unicorn-6952.exe
1900	Unicorn-28503.exe
2348	Unicorn-22796.exe
2228	Unicorn-7153.exe
1744	Unicorn-29620.exe
2896	Unicorn-21452.exe
2396	Unicorn-12250.exe
2404	Unicorn-53283.exe
1904	Unicorn-31348.exe
1452	Unicorn-61643.exe
2092	Unicorn-30855.exe
1556	Unicorn-45087.exe
2992	Unicorn-25221.exe
1748	Unicorn-28943.exe
2924	Unicorn-58824.exe
1180	Unicorn-36194.exe
1188	Unicorn-35663.exe
1088	Unicorn-16944.exe
1536	Unicorn-62741.exe
1612	Unicorn-20867.exe
2164	Unicorn-31413.exe

Loads dropped DLL 64 IoCs

pid	Process
2700	c8feffe2531c688c8c1ce5d46fd89960N.exe
2700	c8feffe2531c688c8c1ce5d46fd89960N.exe
2764	Unicorn-53651.exe
2764	Unicorn-53651.exe
2700	c8feffe2531c688c8c1ce5d46fd89960N.exe
2700	c8feffe2531c688c8c1ce5d46fd89960N.exe
3040	Unicorn-37564.exe
2764	Unicorn-53651.exe
3040	Unicorn-37564.exe
2880	Unicorn-42010.exe
2880	Unicorn-42010.exe
2764	Unicorn-53651.exe
2700	c8feffe2531c688c8c1ce5d46fd89960N.exe
2700	c8feffe2531c688c8c1ce5d46fd89960N.exe
2516	Unicorn-37149.exe
2656	Unicorn-58124.exe
2516	Unicorn-37149.exe
2656	Unicorn-58124.exe
2128	Unicorn-29181.exe
2504	Unicorn-4284.exe
2764	Unicorn-53651.exe
3040	Unicorn-37564.exe
2128	Unicorn-29181.exe
2504	Unicorn-4284.exe
2764	Unicorn-53651.exe
3040	Unicorn-37564.exe
2700	c8feffe2531c688c8c1ce5d46fd89960N.exe
2700	c8feffe2531c688c8c1ce5d46fd89960N.exe
2880	Unicorn-42010.exe
2880	Unicorn-42010.exe
2040	Unicorn-24072.exe
2700	c8feffe2531c688c8c1ce5d46fd89960N.exe
2040	Unicorn-24072.exe
2700	c8feffe2531c688c8c1ce5d46fd89960N.exe
1916	Unicorn-20206.exe
1916	Unicorn-20206.exe
2656	Unicorn-58124.exe
2656	Unicorn-58124.exe
1988	Unicorn-55488.exe
920	Unicorn-59593.exe
1988	Unicorn-55488.exe
920	Unicorn-59593.exe
3040	Unicorn-37564.exe
3040	Unicorn-37564.exe
2720	Unicorn-9816.exe
2720	Unicorn-9816.exe
2212	Unicorn-3686.exe
2212	Unicorn-3686.exe
2504	Unicorn-4284.exe
2764	Unicorn-53651.exe
2188	Unicorn-9816.exe
2764	Unicorn-53651.exe
2504	Unicorn-4284.exe
2188	Unicorn-9816.exe
2128	Unicorn-29181.exe
2128	Unicorn-29181.exe
760	Unicorn-59405.exe
760	Unicorn-59405.exe
2880	Unicorn-42010.exe
2880	Unicorn-42010.exe
2516	Unicorn-37149.exe
2516	Unicorn-37149.exe
1716	Unicorn-14415.exe
1716	Unicorn-14415.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3820	3384	WerFault.exe	289

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21452.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7153.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36369.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6997.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14026.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44370.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26659.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59405.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20973.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29181.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35663.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38006.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29871.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53651.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26061.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29238.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62370.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29796.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24636.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60749.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39574.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33716.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6952.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8029.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4872.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41378.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2904.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40047.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60749.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12813.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23346.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46524.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29340.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37169.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54235.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5172.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56248.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12805.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62065.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49168.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54233.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9569.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12307.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20238.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49928.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38006.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4789.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35212.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1434.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6826.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29340.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-822.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54841.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8340.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27732.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-204.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57105.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29340.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54734.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28393.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4213.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2700	c8feffe2531c688c8c1ce5d46fd89960N.exe
2764	Unicorn-53651.exe
2880	Unicorn-42010.exe
3040	Unicorn-37564.exe
2516	Unicorn-37149.exe
2656	Unicorn-58124.exe
2128	Unicorn-29181.exe
2504	Unicorn-4284.exe
1916	Unicorn-20206.exe
920	Unicorn-59593.exe
2720	Unicorn-9816.exe
1988	Unicorn-55488.exe
2188	Unicorn-9816.exe
2212	Unicorn-3686.exe
2040	Unicorn-24072.exe
760	Unicorn-59405.exe
2376	Unicorn-23538.exe
1716	Unicorn-14415.exe
2064	Unicorn-22770.exe
1636	Unicorn-22770.exe
924	Unicorn-15378.exe
2932	Unicorn-23346.exe
1952	Unicorn-2904.exe
948	Unicorn-5172.exe
1564	Unicorn-5172.exe
2360	Unicorn-29796.exe
316	Unicorn-26531.exe
2532	Unicorn-30061.exe
1656	Unicorn-12307.exe
756	Unicorn-49168.exe
2324	Unicorn-32183.exe
3000	Unicorn-18040.exe
1720	Unicorn-32339.exe
2308	Unicorn-36852.exe
1732	Unicorn-12349.exe
2220	Unicorn-61934.exe
1588	Unicorn-53766.exe
3016	Unicorn-16303.exe
2100	Unicorn-1887.exe
2528	Unicorn-57039.exe
2756	Unicorn-13008.exe
1616	Unicorn-54233.exe
1992	Unicorn-822.exe
1660	Unicorn-6952.exe
2524	Unicorn-26199.exe
1900	Unicorn-28503.exe
2896	Unicorn-21452.exe
2228	Unicorn-7153.exe
2348	Unicorn-22796.exe
2396	Unicorn-12250.exe
1744	Unicorn-29620.exe
2404	Unicorn-53283.exe
1452	Unicorn-61643.exe
2092	Unicorn-30855.exe
1904	Unicorn-31348.exe
1556	Unicorn-45087.exe
2992	Unicorn-25221.exe
1748	Unicorn-28943.exe
1188	Unicorn-35663.exe
2924	Unicorn-58824.exe
1180	Unicorn-36194.exe
1088	Unicorn-16944.exe
1536	Unicorn-62741.exe
1612	Unicorn-20867.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2764	2700	c8feffe2531c688c8c1ce5d46fd89960N.exe	30
PID 2700 wrote to memory of 2764	2700	c8feffe2531c688c8c1ce5d46fd89960N.exe	30
PID 2700 wrote to memory of 2764	2700	c8feffe2531c688c8c1ce5d46fd89960N.exe	30
PID 2700 wrote to memory of 2764	2700	c8feffe2531c688c8c1ce5d46fd89960N.exe	30
PID 2764 wrote to memory of 3040	2764	Unicorn-53651.exe	31
PID 2764 wrote to memory of 3040	2764	Unicorn-53651.exe	31
PID 2764 wrote to memory of 3040	2764	Unicorn-53651.exe	31
PID 2764 wrote to memory of 3040	2764	Unicorn-53651.exe	31
PID 2700 wrote to memory of 2880	2700	c8feffe2531c688c8c1ce5d46fd89960N.exe	32
PID 2700 wrote to memory of 2880	2700	c8feffe2531c688c8c1ce5d46fd89960N.exe	32
PID 2700 wrote to memory of 2880	2700	c8feffe2531c688c8c1ce5d46fd89960N.exe	32
PID 2700 wrote to memory of 2880	2700	c8feffe2531c688c8c1ce5d46fd89960N.exe	32
PID 3040 wrote to memory of 2516	3040	Unicorn-37564.exe	33
PID 3040 wrote to memory of 2516	3040	Unicorn-37564.exe	33
PID 3040 wrote to memory of 2516	3040	Unicorn-37564.exe	33
PID 3040 wrote to memory of 2516	3040	Unicorn-37564.exe	33
PID 2880 wrote to memory of 2504	2880	Unicorn-42010.exe	35
PID 2880 wrote to memory of 2504	2880	Unicorn-42010.exe	35
PID 2880 wrote to memory of 2504	2880	Unicorn-42010.exe	35
PID 2880 wrote to memory of 2504	2880	Unicorn-42010.exe	35
PID 2764 wrote to memory of 2656	2764	Unicorn-53651.exe	34
PID 2764 wrote to memory of 2656	2764	Unicorn-53651.exe	34
PID 2764 wrote to memory of 2656	2764	Unicorn-53651.exe	34
PID 2764 wrote to memory of 2656	2764	Unicorn-53651.exe	34
PID 2700 wrote to memory of 2128	2700	c8feffe2531c688c8c1ce5d46fd89960N.exe	36
PID 2700 wrote to memory of 2128	2700	c8feffe2531c688c8c1ce5d46fd89960N.exe	36
PID 2700 wrote to memory of 2128	2700	c8feffe2531c688c8c1ce5d46fd89960N.exe	36
PID 2700 wrote to memory of 2128	2700	c8feffe2531c688c8c1ce5d46fd89960N.exe	36
PID 2516 wrote to memory of 920	2516	Unicorn-37149.exe	37
PID 2516 wrote to memory of 920	2516	Unicorn-37149.exe	37
PID 2516 wrote to memory of 920	2516	Unicorn-37149.exe	37
PID 2516 wrote to memory of 920	2516	Unicorn-37149.exe	37
PID 2656 wrote to memory of 1916	2656	Unicorn-58124.exe	38
PID 2656 wrote to memory of 1916	2656	Unicorn-58124.exe	38
PID 2656 wrote to memory of 1916	2656	Unicorn-58124.exe	38
PID 2656 wrote to memory of 1916	2656	Unicorn-58124.exe	38
PID 2128 wrote to memory of 2188	2128	Unicorn-29181.exe	39
PID 2128 wrote to memory of 2188	2128	Unicorn-29181.exe	39
PID 2128 wrote to memory of 2188	2128	Unicorn-29181.exe	39
PID 2128 wrote to memory of 2188	2128	Unicorn-29181.exe	39
PID 2504 wrote to memory of 2720	2504	Unicorn-4284.exe	40
PID 2504 wrote to memory of 2720	2504	Unicorn-4284.exe	40
PID 2504 wrote to memory of 2720	2504	Unicorn-4284.exe	40
PID 2504 wrote to memory of 2720	2504	Unicorn-4284.exe	40
PID 2764 wrote to memory of 2212	2764	Unicorn-53651.exe	41
PID 2764 wrote to memory of 2212	2764	Unicorn-53651.exe	41
PID 2764 wrote to memory of 2212	2764	Unicorn-53651.exe	41
PID 2764 wrote to memory of 2212	2764	Unicorn-53651.exe	41
PID 3040 wrote to memory of 1988	3040	Unicorn-37564.exe	42
PID 3040 wrote to memory of 1988	3040	Unicorn-37564.exe	42
PID 3040 wrote to memory of 1988	3040	Unicorn-37564.exe	42
PID 3040 wrote to memory of 1988	3040	Unicorn-37564.exe	42
PID 2700 wrote to memory of 2040	2700	c8feffe2531c688c8c1ce5d46fd89960N.exe	43
PID 2700 wrote to memory of 2040	2700	c8feffe2531c688c8c1ce5d46fd89960N.exe	43
PID 2700 wrote to memory of 2040	2700	c8feffe2531c688c8c1ce5d46fd89960N.exe	43
PID 2700 wrote to memory of 2040	2700	c8feffe2531c688c8c1ce5d46fd89960N.exe	43
PID 2880 wrote to memory of 760	2880	Unicorn-42010.exe	44
PID 2880 wrote to memory of 760	2880	Unicorn-42010.exe	44
PID 2880 wrote to memory of 760	2880	Unicorn-42010.exe	44
PID 2880 wrote to memory of 760	2880	Unicorn-42010.exe	44
PID 2040 wrote to memory of 2376	2040	Unicorn-24072.exe	45
PID 2040 wrote to memory of 2376	2040	Unicorn-24072.exe	45
PID 2040 wrote to memory of 2376	2040	Unicorn-24072.exe	45
PID 2040 wrote to memory of 2376	2040	Unicorn-24072.exe	45

C:\Users\Admin\AppData\Local\Temp\c8feffe2531c688c8c1ce5d46fd89960N.exe
"C:\Users\Admin\AppData\Local\Temp\c8feffe2531c688c8c1ce5d46fd89960N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53651.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53651.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37564.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37564.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37149.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59593.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22770.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12349.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24683.exe
        8⤵
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6826.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46559.exe
        8⤵
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62370.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8029.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33910.exe
        7⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11200.exe
        7⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
        7⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16303.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17755.exe
        7⤵
        
        PID:972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57604.exe
        8⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28044.exe
        8⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17225.exe
        8⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37169.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62051.exe
        7⤵
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54884.exe
        7⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44370.exe
        7⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29340.exe
        7⤵
        
        PID:4172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13544.exe
        6⤵
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25313.exe
        7⤵
        
        PID:3332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47433.exe
        6⤵
        
        PID:1648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62824.exe
        6⤵
        
        PID:3368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24727.exe
        6⤵
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54235.exe
        6⤵
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18040.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44179.exe
        6⤵
        
        PID:2140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27832.exe
        6⤵
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-87.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-87.exe
        6⤵
        
        PID:3352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49928.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62065.exe
        6⤵
        
        PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53317.exe
        5⤵
        
        PID:2692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43916.exe
        5⤵
        
        PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42177.exe
        5⤵
        
        PID:3396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32704.exe
        5⤵
        
        PID:4812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55488.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22770.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16944.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52470.exe
        7⤵
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39839.exe
        7⤵
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64865.exe
        7⤵
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27379.exe
        6⤵
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19877.exe
        6⤵
        
        PID:3656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-690.exe
        6⤵
        
        PID:4052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54235.exe
        6⤵
        
        PID:4764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12250.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6857.exe
        6⤵
        
        PID:2892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13725.exe
        6⤵
        
        PID:3836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50675.exe
        5⤵
        
        PID:2108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22680.exe
        5⤵
        
        PID:1096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36389.exe
        5⤵
        
        PID:4068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12805.exe
        5⤵
        
        PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15378.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62741.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53198.exe
        6⤵
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32980.exe
        6⤵
        
        PID:632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12765.exe
        6⤵
        
        PID:784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21141.exe
        6⤵
        
        PID:4472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50053.exe
        5⤵
        
        PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30187.exe
        5⤵
        
        PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44370.exe
        5⤵
        
        PID:3472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29340.exe
        5⤵
        
        PID:3124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20867.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42856.exe
        5⤵
        
        PID:1560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1434.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49928.exe
        5⤵
        
        PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62065.exe
        5⤵
        
        PID:4748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33240.exe
      4⤵
      PID:2696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42258.exe
      4⤵
      PID:3428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2602.exe
      4⤵
      PID:3920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8340.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58124.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58124.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20206.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23346.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6952.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-204.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3079.exe
        7⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39574.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe
        7⤵
        
        PID:4328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22611.exe
        6⤵
        
        PID:2792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16814.exe
        6⤵
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10737.exe
        6⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29340.exe
        6⤵
        
        PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28503.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17200.exe
        6⤵
        
        PID:1776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20107.exe
        6⤵
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34360.exe
        6⤵
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62065.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10026.exe
        5⤵
        
        PID:1892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22680.exe
        5⤵
        
        PID:3076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35704.exe
        5⤵
        
        PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12805.exe
        5⤵
        
        PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2904.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54233.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28393.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-225.exe
        6⤵
        
        PID:1424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1374.exe
        6⤵
        
        PID:3520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41537.exe
        6⤵
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23227.exe
        6⤵
        
        PID:4384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41583.exe
        5⤵
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55790.exe
        6⤵
        
        PID:3852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14965.exe
        6⤵
        
        PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57105.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19014.exe
        5⤵
        
        PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29340.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-822.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-822.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4656.exe
        5⤵
        
        PID:1080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59748.exe
        6⤵
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57058.exe
        6⤵
        
        PID:3316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
        6⤵
        
        PID:4104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57594.exe
        5⤵
        
        PID:1856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4789.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe
        5⤵
        
        PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13056.exe
        5⤵
        
        PID:4620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44464.exe
      4⤵
      PID:2076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11160.exe
      4⤵
      PID:1968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63336.exe
      4⤵
      PID:3508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58482.exe
      4⤵
      PID:3780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27307.exe
      4⤵
      PID:4548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3686.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3686.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5172.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21452.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31413.exe
        6⤵
        Executes dropped EXE
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2969.exe
        7⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12292.exe
        7⤵
        
        PID:4408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60697.exe
        6⤵
        
        PID:880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56248.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29340.exe
        6⤵
        
        PID:4220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47090.exe
        5⤵
        
        PID:2292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8787.exe
        6⤵
        
        PID:1408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41148.exe
        6⤵
        
        PID:2948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39190.exe
        6⤵
        
        PID:676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe
        6⤵
        
        PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3124.exe
        5⤵
        
        PID:1020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60749.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52041.exe
        5⤵
        
        PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12805.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61643.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24683.exe
        5⤵
        
        PID:2612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6826.exe
        5⤵
        
        PID:3480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53414.exe
        5⤵
        
        PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2776.exe
        5⤵
        
        PID:4588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35574.exe
      4⤵
      PID:900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37755.exe
      4⤵
      PID:3188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2072.exe
      4⤵
      PID:2672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20973.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29796.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29796.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30855.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35212.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41148.exe
        5⤵
        
        PID:2996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54841.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2776.exe
        5⤵
        
        PID:4572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63369.exe
      4⤵
      PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54884.exe
      4⤵
      PID:2288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44370.exe
      4⤵
      PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29340.exe
      4⤵
      PID:3176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58824.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58824.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12813.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17689.exe
      4⤵
      PID:4992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40825.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40825.exe
    3⤵
    PID:2708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59324.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59324.exe
    3⤵
    PID:3440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55736.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55736.exe
    3⤵
    PID:3312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3005.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3005.exe
    3⤵
    PID:4124
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42010.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42010.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4284.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4284.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9816.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5172.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31348.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18222.exe
        7⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64396.exe
        7⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48080.exe
        7⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29340.exe
        7⤵
        
        PID:4188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33716.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46524.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19865.exe
        6⤵
        
        PID:2444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29340.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25221.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12057.exe
        6⤵
        
        PID:3812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52698.exe
        6⤵
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9569.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26061.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17307.exe
        5⤵
        
        PID:4080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9159.exe
        5⤵
        
        PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
        5⤵
        
        PID:4680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26531.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22796.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27926.exe
        6⤵
        
        PID:904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57594.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14026.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2776.exe
        6⤵
        
        PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40047.exe
        5⤵
        
        PID:1876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4698.exe
        5⤵
        
        PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41378.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46321.exe
        5⤵
        
        PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7153.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18627.exe
        5⤵
        
        PID:2560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-277.exe
        5⤵
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4872.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46174.exe
        5⤵
        
        PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47796.exe
      4⤵
      PID:3004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14014.exe
      4⤵
      PID:3112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51074.exe
      4⤵
      PID:3900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29871.exe
      4⤵
      PID:3224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59405.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59405.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49168.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29620.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6997.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16888.exe
        6⤵
        
        PID:3768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58288.exe
        6⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62065.exe
        6⤵
        
        PID:4732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28195.exe
        5⤵
        
        PID:2936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16814.exe
        5⤵
        
        PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45439.exe
        5⤵
        
        PID:2440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29340.exe
        5⤵
        
        PID:3108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53283.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36369.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-225.exe
        5⤵
        
        PID:1640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13149.exe
        5⤵
        
        PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe
        5⤵
        
        PID:4304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12278.exe
      4⤵
      PID:2988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35570.exe
        5⤵
        
        PID:1192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49701.exe
        5⤵
        
        PID:1312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38505.exe
        5⤵
        
        PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe
        5⤵
        
        PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24636.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14014.exe
      4⤵
      PID:3092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60202.exe
      4⤵
      PID:2596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29871.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32183.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32183.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28943.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49104.exe
        5⤵
        
        PID:1704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9794.exe
        5⤵
        
        PID:3232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4213.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe
        5⤵
        
        PID:4296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29238.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15169.exe
      4⤵
      PID:3252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59279.exe
      4⤵
      PID:3936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37508.exe
      4⤵
      PID:3808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35663.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35663.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3146.exe
      4⤵
      PID:2432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13768.exe
      4⤵
      PID:2916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19014.exe
      4⤵
      PID:3752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29340.exe
      4⤵
      PID:4196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27732.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27732.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3797.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3797.exe
    3⤵
    PID:2912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15389.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15389.exe
    3⤵
    PID:428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3005.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3005.exe
    3⤵
    PID:3628
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29181.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29181.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9816.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9816.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30061.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13008.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6857.exe
        6⤵
        
        PID:2736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13149.exe
        6⤵
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2776.exe
        6⤵
        
        PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16280.exe
        5⤵
        
        PID:2600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54884.exe
        5⤵
        
        PID:2604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60898.exe
        5⤵
        
        PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29340.exe
        5⤵
        
        PID:2952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26199.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16380.exe
        5⤵
        
        PID:1008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41148.exe
        5⤵
        
        PID:2572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50312.exe
        5⤵
        
        PID:3336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62065.exe
        5⤵
        
        PID:4708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10716.exe
      4⤵
      PID:2172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60749.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25111.exe
      4⤵
      PID:3384
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 188
        5⤵
        Program crash
        
        PID:3820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54235.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12307.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12307.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53766.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6857.exe
        5⤵
        
        PID:2760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62734.exe
        5⤵
        
        PID:3876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2776.exe
        5⤵
        
        PID:4596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6877.exe
      4⤵
      PID:2844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54884.exe
      4⤵
      PID:2564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44370.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29340.exe
      4⤵
      PID:3180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57039.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57039.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15025.exe
      4⤵
      PID:1676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51889.exe
      4⤵
      PID:3360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44063.exe
      4⤵
      PID:3884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5193.exe
      4⤵
      PID:4700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35881.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35881.exe
    3⤵
    PID:2476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52084.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52084.exe
    3⤵
    PID:1972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20238.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20238.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29871.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29871.exe
    3⤵
    PID:540
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24072.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24072.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23538.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23538.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61934.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40552.exe
        5⤵
        
        PID:1908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18154.exe
        5⤵
        
        PID:3168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14000.exe
        5⤵
        
        PID:876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7837.exe
      4⤵
      PID:3052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54884.exe
      4⤵
      PID:2960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44370.exe
      4⤵
      PID:3488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29340.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1887.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1887.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49820.exe
      4⤵
      PID:824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51875.exe
        5⤵
        
        PID:1680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-277.exe
        5⤵
        
        PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4872.exe
        5⤵
        
        PID:936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2776.exe
        5⤵
        
        PID:4604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18543.exe
      4⤵
      PID:1132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20107.exe
      4⤵
      PID:4060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3887.exe
      4⤵
      PID:3612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53705.exe
      4⤵
      PID:4844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5044.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5044.exe
    3⤵
    PID:2124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60749.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60749.exe
    3⤵
    PID:548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60401.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60401.exe
    3⤵
    PID:3244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12805.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12805.exe
    3⤵
    PID:4320
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14415.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14415.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32339.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32339.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52430.exe
      4⤵
      PID:2472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
      4⤵
      PID:520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26659.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58571.exe
      4⤵
      PID:4796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40047.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40047.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13960.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13960.exe
    3⤵
    PID:2580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51740.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51740.exe
    3⤵
    PID:3388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62333.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62333.exe
    3⤵
    PID:3868
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36852.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36852.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45087.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45087.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54734.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-225.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51687.exe
      4⤵
      PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29340.exe
      4⤵
      PID:4212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17655.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17655.exe
    3⤵
    PID:1156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13960.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13960.exe
    3⤵
    PID:1984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23000.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23000.exe
    3⤵
    PID:3452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57376.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57376.exe
    3⤵
    PID:3156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6692.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6692.exe
    3⤵
    PID:4264
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36194.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36194.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11730.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11730.exe
    3⤵
    PID:912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36647.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36647.exe
    3⤵
    PID:3604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32140.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32140.exe
    3⤵
    PID:4140
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21944.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21944.exe
  2⤵
  PID:992
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50413.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50413.exe
  2⤵
  PID:3664
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45473.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45473.exe
  2⤵
  PID:3924
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45006.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45006.exe
  2⤵
  PID:4132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-17225.exe

Filesize
468KB

MD5
ddc65ac3a3152c740ecaeca2660d31e7

SHA1
3a31f1226e3accf52bf9321db2555bfa412fb2fd

SHA256
eb6579783860659ebc3aeab96e3737519dcdb569a932f06d8261739260de4d5e

SHA512
006b6c3403643ab92a0c9da9d942e5be828b76bdd461d5f6a35185f640229e4f49bb8e1203e09ba443b451298f566c224d4d7475c9cd62935afc5bd89922de1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42258.exe

Filesize
468KB

MD5
04aee6a623d1db7dc2d32b1b4f7027e7

SHA1
3bf122f42dbf3b79162c735c41a086be66fa162f

SHA256
f620c4381164dd2958b3e111c02da1a9583f93747d41f37efb413022dc68e3f8

SHA512
9ae63d915dfb289c2fbc0bd59ca590a7ce96bf1544f3eae6ef614f55361e992507b8fa7eea1f0c2ec7000290e135dfc1747897fb736155b8eb90251d87e466cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4284.exe

Filesize
468KB

MD5
8a101873d97e6a33a097ee4b046e55ef

SHA1
c4c36e37b81d6e6f1457c856d916585c5d6e4cfe

SHA256
14b9fe7793d25c2c62490a7d830b76a6ed9aa1381ad326edc6b5cf35ed59a7f8

SHA512
4039138869ea7615cf83c27f3e80ded25df65311cb9c7e3ab5d6bdb1c70dfd62bf3ab25bb64296691003c64a8385e44ca2e6f01419373445813a3b494d70ff89

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55488.exe

Filesize
468KB

MD5
91f9bcdb726cfa6f44772d324b3169b7

SHA1
3d73ae605afaf5e5ab37c2d00e521bcd471fd43f

SHA256
220b3c4b67b021df4b3ce222af601878e517c503c6f543ed18916cbfd104e99e

SHA512
fa0e150b7acaef2449685b2e5171897ceba1f4fc279b301c917b84d7b830fe5297df341ea2e6be902771117af106b8103b2caf19bb4f55a2fa787c9837834ee7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58571.exe

Filesize
468KB

MD5
7e66a8cc5eeb60b917886baa0e94e3c2

SHA1
25c9f7ff024a630514e23e359d845ecf064f8b2a

SHA256
c733c8207d30b1c4af13de2ee9d66ba25d7f655db69ffb77b9f8befebe5ce1b3

SHA512
9cd6354e11ce295e1808d04eb3a870c20b145b91857759d2b312c66ba2e8ad11bca100f891de1f6320475e2e86cd318cc1057baa968fe5f508e043583a87050b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9816.exe

Filesize
468KB

MD5
f6c2be7c95941eb7f0e94e3bc98999b2

SHA1
a5cd4ae544ffd0cda43deaf75667fd3fe7c93de6

SHA256
e274333d789383d228c0d23e76ef75cbfebaa327ae8943ef2065f66aa8891651

SHA512
1dc2ae06af68983f18ec7d1917be4677dbc34c265b27a1c5ca036fcf0187571642969f986a5314a1ebccdbd6f1e01ccad4a6228565277a793815db2e0a977aae

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14415.exe

Filesize
468KB

MD5
e253e1958aa10f1894d6dc77dc509ee2

SHA1
91797324f095871ce255458ae6b1a25946a73596

SHA256
4c7ce8e058a9a601181b99c2f85087dbb1c2e288b253bda8d2015909dde358eb

SHA512
72b41b5c41cc5540cfb2f6ced39907b42f2047273d1f307403ac665a3d22de337324b777467b07de06e4d2e969e9de7813519765faabc8560fb96471cb752d67

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20206.exe

Filesize
468KB

MD5
6457e1723671966db7c063e862143ee0

SHA1
f583775e296c8f31f5eaa2214046580231ba23fd

SHA256
097ee1c9acd917be4d882d69c262f34c4e3436c8ed8bad9bcd34c00f2d9d5d32

SHA512
47b5e9085ff78a3f4e21c2ea39853da5030e0a83b87bb971ab6a1c70e005e38ff888ef7718188a756c69e9bb72fb8afeb322f9e845c998ae3b926c9069481a6c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23346.exe

Filesize
468KB

MD5
443e650d985f6fae5cec5b879f2eb638

SHA1
8f418b914807df6d3517441468abbfafa27a0ac0

SHA256
e0ebb7e9b004663b61c559dd6fad621b7a6f9f9f5a21b6e9252bb05185e81d52

SHA512
4ceaa2d7d52df03563514403de6bb82ab0455383b4e3c1f2a638ff1deeac17cb58e9e44f43486ab8d66d263b0f79bf8e2fb531173ac2a27a4d9d819542e559db

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23538.exe

Filesize
468KB

MD5
b1283eb73b1040b760bd8c44f8b2b78e

SHA1
711eb486140d247949c8ff233805ab1f34d57fac

SHA256
f07a2b1bdfe2498d7894540fbb082d2ee8d84d13420b3973a1708510f5d05d9f

SHA512
3af3a15674bd8b1ecc1b48eb85b8e039f541f28893483f4b5b2a1e84df1dd55260e29bc3309c6409f71d82dd43ed6f71e38e3183df6969f2bb41bba15ef8c4be

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24072.exe

Filesize
468KB

MD5
398ffe0c4c62c53b71edd543aba369f5

SHA1
3269a874560c65abbbdbeabf9e91fa680ec6f880

SHA256
275c5a1542f23417674cdce5c1ef8b8a6dba329b4c1ed58362042183e12e0275

SHA512
b045f83f674fb3f8e7d10f74ea4b210c834ae682a61a18cf0e3c6a979efa0538671d6254eb228beaef5ee440903c4b096c4a61156881d2683fe021b422d3e827

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29181.exe

Filesize
468KB

MD5
63fa0dc6a20b80a3f56a0721b7e40f51

SHA1
072a8473b52ff848aac52e49603c0a42f1ef5ef7

SHA256
683e60d5fd1c0a301e48971a0ad214f7221dd7960ef40e750012f44439a4643e

SHA512
6f3aa55de9dd5b555bb0d142d1e420179ff9bf3c6324035f8c27f8cbbbf71e2b032be05a045bfd8e32fafbd8fed9655a354b6d5b7428f56567401b47e56cc24e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3686.exe

Filesize
468KB

MD5
11352c252893135fb015a48f9a2b93eb

SHA1
5e425096fc4ea4e4ffe877ddd3f31766901f4353

SHA256
60f8e2f48b6a1f88b83fdf9c80d22b25aecc49e3a7529562ab8c42996cdba591

SHA512
9e9c420be2084acd99365cf330bd5c22071d73778a7bfa426ef66b8ebdece8c23ed9bba03635b9e82c667f494c2411ecc92d622f9ca61e7f3be3cd1d32f2cb01

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37149.exe

Filesize
468KB

MD5
f752d7f16e094deeeb8c24109877eba1

SHA1
628c84cc33b124cfcc7e0bcbff781a62d52be24e

SHA256
7cedccb2ef7eca8dc7f582defcf7c898851a768ca5e1f2110367f44118bb8a7d

SHA512
55d3bfa62491f46f4408c5b4bfd83ede15423b2ef3c5a631a4eca3990529747a324095f39bac5ebe94af3e923da70a116c63da713b3d88f0c9e2bebd197f34e2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37564.exe

Filesize
468KB

MD5
37f78d96d5b1be39d2a9798ea512e4d4

SHA1
bcecc9afe64c73cfd249ba885281950d307887a5

SHA256
06d996968cf4d2d415bb39323647067a6f029440fcd6798cf03ae0fe130173a5

SHA512
e8400972bf528fcbbfc682db3bc3cdf3ded3bd7ac1166b4607e40ed4dc69e3c167aa04937e304d7b7f17c87a16e3296e4a647aa0a3bc9ed3c1fdfeb97003a3e6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42010.exe

Filesize
468KB

MD5
3572428e85f91eb370fa805bffb179eb

SHA1
dc5368fa6410fde1a894be06c33e8f23c64fdabd

SHA256
b6af7b96070c190ef5b22c580427e8d4023228bb18ead3e1337f4cd0532b4cef

SHA512
d54590e5058db25d1c9303bfa5a9dba1047b71047169ea312423330fcd628665f4f12a1d23be1c7a54c8d051eaa4923c0f7628beabf07f7c2b3fe939e95279c7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53651.exe

Filesize
468KB

MD5
86c06dcf74aa8737714086a554487766

SHA1
a6165ea723449baf2a5c4b5c5ced6a1977a2e143

SHA256
0350c12f6df96255b83361018c54d07524e52f14b71c0017da94c2e802a517e3

SHA512
06d22502b818961567395dccb8a1fb8071f576e3558eebacef6a3f3daf577566e8692e4543ef38bc2d8553ec3c8a5257ec0958f7aa680431451310be708bc7df

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58124.exe

Filesize
468KB

MD5
7bba4613f606838d23a93b0c5cdbd53c

SHA1
234005d6878115e676a21193172ec9fa157d86fc

SHA256
1d68fcd69d26e489c2f5bb6bed8ceec74349f8b8ca00d441d90717872de50bea

SHA512
83b529226df4df83e61d9775261a6ee36a63ebb30df6da697d7e5a472368e8607fc652e2e8a3bd153f6418ac529a34c29e479323a5f55c072aaa31c6decb78db

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59405.exe

Filesize
468KB

MD5
22b9342d20902f3c8da5f2f2a7114fbc

SHA1
f11198456440108ad0c96a1512a546b686e8c7db

SHA256
19621eed47e3f678d536b28c91ce87c1b6d11ada17f44f91a74df2a849b342a6

SHA512
5e06d5fdf9e66f5afede4e62a6fb721c7a6d8da63d291d88f4ff4cc17d7d1043fb17cbbb5ef71465bd4e3666f448eae413dd0a25775689c9b6ae81f8d9411ffd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59593.exe

Filesize
468KB

MD5
879efa97a1ed45343d31efc51d4a3270

SHA1
6988dd14067167bd7b872116ef0fcb1bca582349

SHA256
bf1a6ac3ba6d6f29781e9be7d3726acbc368cfa25e720dcdb80828dc5a9fbe45

SHA512
42479a633cf7cc9bbc17386789c61fdc7aba68e7b458f34cfe69e0cbf76447184c4c72400a16ac5ef953326bac16977a1190a15d7410f63e9a009e7cab743f9c

Download Submit