ad5b03a91dc96733f8afcde9fe9543208022c99085b5a958bb2d8053d6b056d5

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 05:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aba2c86c0950e7cd8b3af059a2f00ca0N.exe
Size

468KB
MD5

aba2c86c0950e7cd8b3af059a2f00ca0
SHA1

bcdadad1be1aaa36cc424881e1e87a68b472262c
SHA256

ad5b03a91dc96733f8afcde9fe9543208022c99085b5a958bb2d8053d6b056d5
SHA512

2cdbb245699a40eb2305091bc49a7aff2c08784339ce52a1227c84eb731c1c6fa916dab5d2b42aa8deca77529670c1e1def61d93bf215067763166e7629d7f2e
SSDEEP

3072:ttAuorldI03YtbY2PzcIffT/ECpZtumpnsHEdVh9oOPaGSn7tWlx:ttZoQOYtBP4IffrhLjoOipn7t

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2636	Unicorn-57603.exe
2740	Unicorn-10981.exe
2552	Unicorn-7452.exe
2572	Unicorn-9715.exe
2984	Unicorn-55195.exe
1552	Unicorn-8620.exe
2080	Unicorn-51499.exe
2872	Unicorn-23883.exe
844	Unicorn-23691.exe
2204	Unicorn-28521.exe
2832	Unicorn-23115.exe
2512	Unicorn-17477.exe
1752	Unicorn-19585.exe
2188	Unicorn-39451.exe
1504	Unicorn-41983.exe
1088	Unicorn-23110.exe
2276	Unicorn-51485.exe
2044	Unicorn-30318.exe
2484	Unicorn-2668.exe
1632	Unicorn-6197.exe
1700	Unicorn-4396.exe
1044	Unicorn-57702.exe
2240	Unicorn-21823.exe
1268	Unicorn-30684.exe
1360	Unicorn-53654.exe
1236	Unicorn-4526.exe
2316	Unicorn-28268.exe
2964	Unicorn-47479.exe
2104	Unicorn-35781.exe
3012	Unicorn-55647.exe
2124	Unicorn-49901.exe
2000	Unicorn-58805.exe
2252	Unicorn-49028.exe
1724	Unicorn-19501.exe
1620	Unicorn-19501.exe
2664	Unicorn-35104.exe
2732	Unicorn-19152.exe
2456	Unicorn-46034.exe
2980	Unicorn-37866.exe
2596	Unicorn-24026.exe
2056	Unicorn-12136.exe
1560	Unicorn-63697.exe
1704	Unicorn-42784.exe
1736	Unicorn-761.exe
2880	Unicorn-20627.exe
532	Unicorn-49578.exe
2828	Unicorn-34763.exe
924	Unicorn-3906.exe
1780	Unicorn-3906.exe
2496	Unicorn-51026.exe
764	Unicorn-4237.exe
1108	Unicorn-35183.exe
2236	Unicorn-35448.exe
472	Unicorn-45536.exe
2228	Unicorn-33838.exe
2208	Unicorn-20648.exe
2268	Unicorn-49407.exe
768	Unicorn-62536.exe
2024	Unicorn-28816.exe
1048	Unicorn-37735.exe
1608	Unicorn-8348.exe
1516	Unicorn-21390.exe
2404	Unicorn-48717.exe
2908	Unicorn-33087.exe

Loads dropped DLL 64 IoCs

pid	Process
2792	aba2c86c0950e7cd8b3af059a2f00ca0N.exe
2792	aba2c86c0950e7cd8b3af059a2f00ca0N.exe
2636	Unicorn-57603.exe
2792	aba2c86c0950e7cd8b3af059a2f00ca0N.exe
2636	Unicorn-57603.exe
2792	aba2c86c0950e7cd8b3af059a2f00ca0N.exe
2740	Unicorn-10981.exe
2740	Unicorn-10981.exe
2636	Unicorn-57603.exe
2636	Unicorn-57603.exe
2552	Unicorn-7452.exe
2552	Unicorn-7452.exe
2792	aba2c86c0950e7cd8b3af059a2f00ca0N.exe
2792	aba2c86c0950e7cd8b3af059a2f00ca0N.exe
2572	Unicorn-9715.exe
2572	Unicorn-9715.exe
2984	Unicorn-55195.exe
2740	Unicorn-10981.exe
2984	Unicorn-55195.exe
2740	Unicorn-10981.exe
2636	Unicorn-57603.exe
1552	Unicorn-8620.exe
1552	Unicorn-8620.exe
2636	Unicorn-57603.exe
2552	Unicorn-7452.exe
2080	Unicorn-51499.exe
2552	Unicorn-7452.exe
2080	Unicorn-51499.exe
2792	aba2c86c0950e7cd8b3af059a2f00ca0N.exe
2792	aba2c86c0950e7cd8b3af059a2f00ca0N.exe
2872	Unicorn-23883.exe
2872	Unicorn-23883.exe
844	Unicorn-23691.exe
2572	Unicorn-9715.exe
844	Unicorn-23691.exe
2572	Unicorn-9715.exe
2984	Unicorn-55195.exe
2984	Unicorn-55195.exe
2832	Unicorn-23115.exe
2832	Unicorn-23115.exe
1552	Unicorn-8620.exe
1552	Unicorn-8620.exe
2512	Unicorn-17477.exe
2512	Unicorn-17477.exe
2204	Unicorn-28521.exe
2204	Unicorn-28521.exe
2740	Unicorn-10981.exe
2740	Unicorn-10981.exe
2636	Unicorn-57603.exe
2636	Unicorn-57603.exe
1504	Unicorn-41983.exe
1504	Unicorn-41983.exe
2792	aba2c86c0950e7cd8b3af059a2f00ca0N.exe
2792	aba2c86c0950e7cd8b3af059a2f00ca0N.exe
2188	Unicorn-39451.exe
2188	Unicorn-39451.exe
2080	Unicorn-51499.exe
1752	Unicorn-19585.exe
2080	Unicorn-51499.exe
1752	Unicorn-19585.exe
2552	Unicorn-7452.exe
2552	Unicorn-7452.exe
1088	Unicorn-23110.exe
1088	Unicorn-23110.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2260	2788	WerFault.exe	99

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63697.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29074.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19722.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38525.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58488.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55688.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11704.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37866.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3906.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46299.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18328.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63452.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39989.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7227.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51026.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45536.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1369.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45614.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42558.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33595.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23453.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62190.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23115.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35448.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33838.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41422.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6262.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38799.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30810.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41983.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31856.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7896.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23410.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23453.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54734.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53896.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26203.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21823.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20627.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13090.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36941.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58488.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7452.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13812.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3780.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20539.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58488.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29453.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19152.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13857.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39253.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23110.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50760.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2792	aba2c86c0950e7cd8b3af059a2f00ca0N.exe
2636	Unicorn-57603.exe
2740	Unicorn-10981.exe
2552	Unicorn-7452.exe
2572	Unicorn-9715.exe
2984	Unicorn-55195.exe
1552	Unicorn-8620.exe
2080	Unicorn-51499.exe
2872	Unicorn-23883.exe
844	Unicorn-23691.exe
2832	Unicorn-23115.exe
2512	Unicorn-17477.exe
2204	Unicorn-28521.exe
1752	Unicorn-19585.exe
2188	Unicorn-39451.exe
1504	Unicorn-41983.exe
1088	Unicorn-23110.exe
2484	Unicorn-2668.exe
2276	Unicorn-51485.exe
2044	Unicorn-30318.exe
1632	Unicorn-6197.exe
1700	Unicorn-4396.exe
1044	Unicorn-57702.exe
2240	Unicorn-21823.exe
1268	Unicorn-30684.exe
3012	Unicorn-55647.exe
2104	Unicorn-35781.exe
1360	Unicorn-53654.exe
1236	Unicorn-4526.exe
2124	Unicorn-49901.exe
2964	Unicorn-47479.exe
2316	Unicorn-28268.exe
2000	Unicorn-58805.exe
2252	Unicorn-49028.exe
1620	Unicorn-19501.exe
1724	Unicorn-19501.exe
2664	Unicorn-35104.exe
2732	Unicorn-19152.exe
2980	Unicorn-37866.exe
2456	Unicorn-46034.exe
2056	Unicorn-12136.exe
2596	Unicorn-24026.exe
1560	Unicorn-63697.exe
1704	Unicorn-42784.exe
924	Unicorn-3906.exe
1780	Unicorn-3906.exe
1736	Unicorn-761.exe
532	Unicorn-49578.exe
2880	Unicorn-20627.exe
2828	Unicorn-34763.exe
2496	Unicorn-51026.exe
1108	Unicorn-35183.exe
2236	Unicorn-35448.exe
472	Unicorn-45536.exe
2228	Unicorn-33838.exe
2208	Unicorn-20648.exe
764	Unicorn-4237.exe
2268	Unicorn-49407.exe
768	Unicorn-62536.exe
2024	Unicorn-28816.exe
1048	Unicorn-37735.exe
1608	Unicorn-8348.exe
1516	Unicorn-21390.exe
2404	Unicorn-48717.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2636	2792	aba2c86c0950e7cd8b3af059a2f00ca0N.exe	30
PID 2792 wrote to memory of 2636	2792	aba2c86c0950e7cd8b3af059a2f00ca0N.exe	30
PID 2792 wrote to memory of 2636	2792	aba2c86c0950e7cd8b3af059a2f00ca0N.exe	30
PID 2792 wrote to memory of 2636	2792	aba2c86c0950e7cd8b3af059a2f00ca0N.exe	30
PID 2636 wrote to memory of 2740	2636	Unicorn-57603.exe	31
PID 2636 wrote to memory of 2740	2636	Unicorn-57603.exe	31
PID 2636 wrote to memory of 2740	2636	Unicorn-57603.exe	31
PID 2636 wrote to memory of 2740	2636	Unicorn-57603.exe	31
PID 2792 wrote to memory of 2552	2792	aba2c86c0950e7cd8b3af059a2f00ca0N.exe	32
PID 2792 wrote to memory of 2552	2792	aba2c86c0950e7cd8b3af059a2f00ca0N.exe	32
PID 2792 wrote to memory of 2552	2792	aba2c86c0950e7cd8b3af059a2f00ca0N.exe	32
PID 2792 wrote to memory of 2552	2792	aba2c86c0950e7cd8b3af059a2f00ca0N.exe	32
PID 2740 wrote to memory of 2572	2740	Unicorn-10981.exe	33
PID 2740 wrote to memory of 2572	2740	Unicorn-10981.exe	33
PID 2740 wrote to memory of 2572	2740	Unicorn-10981.exe	33
PID 2740 wrote to memory of 2572	2740	Unicorn-10981.exe	33
PID 2636 wrote to memory of 2984	2636	Unicorn-57603.exe	34
PID 2636 wrote to memory of 2984	2636	Unicorn-57603.exe	34
PID 2636 wrote to memory of 2984	2636	Unicorn-57603.exe	34
PID 2636 wrote to memory of 2984	2636	Unicorn-57603.exe	34
PID 2552 wrote to memory of 1552	2552	Unicorn-7452.exe	35
PID 2552 wrote to memory of 1552	2552	Unicorn-7452.exe	35
PID 2552 wrote to memory of 1552	2552	Unicorn-7452.exe	35
PID 2552 wrote to memory of 1552	2552	Unicorn-7452.exe	35
PID 2792 wrote to memory of 2080	2792	aba2c86c0950e7cd8b3af059a2f00ca0N.exe	36
PID 2792 wrote to memory of 2080	2792	aba2c86c0950e7cd8b3af059a2f00ca0N.exe	36
PID 2792 wrote to memory of 2080	2792	aba2c86c0950e7cd8b3af059a2f00ca0N.exe	36
PID 2792 wrote to memory of 2080	2792	aba2c86c0950e7cd8b3af059a2f00ca0N.exe	36
PID 2572 wrote to memory of 2872	2572	Unicorn-9715.exe	37
PID 2572 wrote to memory of 2872	2572	Unicorn-9715.exe	37
PID 2572 wrote to memory of 2872	2572	Unicorn-9715.exe	37
PID 2572 wrote to memory of 2872	2572	Unicorn-9715.exe	37
PID 2984 wrote to memory of 844	2984	Unicorn-55195.exe	38
PID 2984 wrote to memory of 844	2984	Unicorn-55195.exe	38
PID 2984 wrote to memory of 844	2984	Unicorn-55195.exe	38
PID 2984 wrote to memory of 844	2984	Unicorn-55195.exe	38
PID 2740 wrote to memory of 2204	2740	Unicorn-10981.exe	39
PID 2740 wrote to memory of 2204	2740	Unicorn-10981.exe	39
PID 2740 wrote to memory of 2204	2740	Unicorn-10981.exe	39
PID 2740 wrote to memory of 2204	2740	Unicorn-10981.exe	39
PID 1552 wrote to memory of 2832	1552	Unicorn-8620.exe	41
PID 1552 wrote to memory of 2832	1552	Unicorn-8620.exe	41
PID 1552 wrote to memory of 2832	1552	Unicorn-8620.exe	41
PID 1552 wrote to memory of 2832	1552	Unicorn-8620.exe	41
PID 2636 wrote to memory of 2512	2636	Unicorn-57603.exe	40
PID 2636 wrote to memory of 2512	2636	Unicorn-57603.exe	40
PID 2636 wrote to memory of 2512	2636	Unicorn-57603.exe	40
PID 2636 wrote to memory of 2512	2636	Unicorn-57603.exe	40
PID 2552 wrote to memory of 1752	2552	Unicorn-7452.exe	42
PID 2552 wrote to memory of 1752	2552	Unicorn-7452.exe	42
PID 2552 wrote to memory of 1752	2552	Unicorn-7452.exe	42
PID 2552 wrote to memory of 1752	2552	Unicorn-7452.exe	42
PID 2080 wrote to memory of 2188	2080	Unicorn-51499.exe	43
PID 2080 wrote to memory of 2188	2080	Unicorn-51499.exe	43
PID 2080 wrote to memory of 2188	2080	Unicorn-51499.exe	43
PID 2080 wrote to memory of 2188	2080	Unicorn-51499.exe	43
PID 2792 wrote to memory of 1504	2792	aba2c86c0950e7cd8b3af059a2f00ca0N.exe	44
PID 2792 wrote to memory of 1504	2792	aba2c86c0950e7cd8b3af059a2f00ca0N.exe	44
PID 2792 wrote to memory of 1504	2792	aba2c86c0950e7cd8b3af059a2f00ca0N.exe	44
PID 2792 wrote to memory of 1504	2792	aba2c86c0950e7cd8b3af059a2f00ca0N.exe	44
PID 2872 wrote to memory of 1088	2872	Unicorn-23883.exe	45
PID 2872 wrote to memory of 1088	2872	Unicorn-23883.exe	45
PID 2872 wrote to memory of 1088	2872	Unicorn-23883.exe	45
PID 2872 wrote to memory of 1088	2872	Unicorn-23883.exe	45

C:\Users\Admin\AppData\Local\Temp\aba2c86c0950e7cd8b3af059a2f00ca0N.exe
"C:\Users\Admin\AppData\Local\Temp\aba2c86c0950e7cd8b3af059a2f00ca0N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57603.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57603.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10981.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10981.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9715.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23883.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23110.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58805.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35448.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27498.exe
        9⤵
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14789.exe
        9⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41325.exe
        9⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53532.exe
        9⤵
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47569.exe
        9⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54734.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4664.exe
        8⤵
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28524.exe
        8⤵
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11877.exe
        8⤵
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55688.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7227.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33838.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26424.exe
        8⤵
        
        PID:236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18328.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40111.exe
        8⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12533.exe
        8⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31194.exe
        8⤵
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2094.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37929.exe
        7⤵
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23453.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14730.exe
        7⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50740.exe
        7⤵
        
        PID:4720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49028.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21917.exe
        7⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17438.exe
        7⤵
        
        PID:4940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2094.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37929.exe
        6⤵
        
        PID:2824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37310.exe
        6⤵
        
        PID:3088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62190.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58488.exe
        6⤵
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50268.exe
        6⤵
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51485.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37866.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55609.exe
        7⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18328.exe
        7⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40111.exe
        7⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12533.exe
        7⤵
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37210.exe
        7⤵
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36044.exe
        6⤵
        
        PID:944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32063.exe
        6⤵
        
        PID:1216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45976.exe
        6⤵
        
        PID:3148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12228.exe
        6⤵
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41422.exe
        6⤵
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6262.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63697.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53790.exe
        6⤵
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4963.exe
        6⤵
        
        PID:3388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45614.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39905.exe
        5⤵
        
        PID:2712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25542.exe
        5⤵
        
        PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40781.exe
        5⤵
        
        PID:4104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52008.exe
        5⤵
        
        PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28521.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21823.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45536.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33087.exe
        7⤵
        Executes dropped EXE
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26424.exe
        8⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6306.exe
        8⤵
        
        PID:908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53227.exe
        8⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        8⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53896.exe
        7⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32063.exe
        7⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45976.exe
        7⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55290.exe
        7⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41422.exe
        7⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6262.exe
        7⤵
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53486.exe
        6⤵
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7896.exe
        6⤵
        
        PID:2448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3780.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36691.exe
        6⤵
        
        PID:3548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58488.exe
        6⤵
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50268.exe
        6⤵
        
        PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49407.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2457.exe
        6⤵
        
        PID:2088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7382.exe
        6⤵
        
        PID:3376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26974.exe
        6⤵
        
        PID:4076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-650.exe
        6⤵
        
        PID:4924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27361.exe
        5⤵
        
        PID:2092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29276.exe
        5⤵
        
        PID:1592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18317.exe
        5⤵
        
        PID:1840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7639.exe
        5⤵
        
        PID:3520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47876.exe
        5⤵
        
        PID:5056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30684.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3906.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26424.exe
        6⤵
        
        PID:1480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64443.exe
        6⤵
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34040.exe
        6⤵
        
        PID:3112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6018.exe
        6⤵
        
        PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53896.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12171.exe
        5⤵
        
        PID:2508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38799.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24762.exe
        5⤵
        
        PID:4876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51026.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15316.exe
        5⤵
        
        PID:4624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30508.exe
      4⤵
      PID:1060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20603.exe
      4⤵
      PID:2840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18847.exe
      4⤵
      PID:2480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3174.exe
      4⤵
      PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21010.exe
      4⤵
      PID:5016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55195.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55195.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23691.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30318.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19501.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15711.exe
        7⤵
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53896.exe
        6⤵
        
        PID:1132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32063.exe
        6⤵
        
        PID:584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45976.exe
        6⤵
        
        PID:3156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3868.exe
        6⤵
        
        PID:3616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39201.exe
        6⤵
        
        PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19152.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28816.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50991.exe
        7⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55109.exe
        7⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47667.exe
        7⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1086.exe
        7⤵
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5732.exe
        7⤵
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46299.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31962.exe
        6⤵
        
        PID:1656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46543.exe
        6⤵
        
        PID:2992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50582.exe
        6⤵
        
        PID:4132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9137.exe
        6⤵
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37735.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14026.exe
        6⤵
        
        PID:860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49717.exe
        6⤵
        
        PID:3260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55208.exe
        6⤵
        
        PID:3360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1580.exe
        6⤵
        
        PID:3932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57609.exe
        6⤵
        
        PID:4488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25251.exe
        5⤵
        
        PID:1040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3506.exe
        5⤵
        
        PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23453.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58778.exe
        5⤵
        
        PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2038.exe
        5⤵
        
        PID:4952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2668.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29060.exe
        5⤵
        
        PID:2788
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 240
        6⤵
        Program crash
        
        PID:2260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60248.exe
        5⤵
        
        PID:1836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32063.exe
        5⤵
        
        PID:2900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39989.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41712.exe
        5⤵
        
        PID:3104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23070.exe
        5⤵
        
        PID:4672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13090.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59086.exe
      4⤵
      PID:1972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37564.exe
      4⤵
      PID:3648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28331.exe
      4⤵
      PID:3980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58488.exe
      4⤵
      PID:4412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50268.exe
      4⤵
      PID:4868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17477.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17477.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57702.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46034.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15126.exe
        6⤵
        
        PID:2692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26203.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21117.exe
        6⤵
        
        PID:1944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16503.exe
        6⤵
        
        PID:3476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47346.exe
        6⤵
        
        PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4716.exe
        5⤵
        
        PID:2408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6983.exe
        5⤵
        
        PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7631.exe
        5⤵
        
        PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25331.exe
        5⤵
        
        PID:3440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30810.exe
        5⤵
        
        PID:5104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12136.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39749.exe
      4⤵
      PID:2972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48570.exe
      4⤵
      PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23453.exe
      4⤵
      PID:4036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58778.exe
      4⤵
      PID:3196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1540.exe
      4⤵
      PID:4728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53654.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53654.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50767.exe
      4⤵
      PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59698.exe
      4⤵
      PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63452.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48654.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58248.exe
      4⤵
      PID:3108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6005.exe
      4⤵
      PID:4688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44634.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44634.exe
    3⤵
    PID:2648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60014.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60014.exe
    3⤵
    PID:2428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11587.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11587.exe
    3⤵
    PID:3588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23866.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23866.exe
    3⤵
    PID:3408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32179.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32179.exe
    3⤵
    PID:4804
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7452.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7452.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8620.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8620.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23115.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6197.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19501.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1369.exe
        7⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57830.exe
        7⤵
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13857.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11731.exe
        7⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57958.exe
        7⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54734.exe
        7⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31856.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44861.exe
        6⤵
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50205.exe
        6⤵
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44867.exe
        6⤵
        
        PID:3892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7373.exe
        6⤵
        
        PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35104.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27498.exe
        6⤵
        
        PID:1072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33595.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48654.exe
        6⤵
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6224.exe
        6⤵
        
        PID:1452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39253.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35888.exe
        5⤵
        
        PID:2308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59086.exe
        5⤵
        
        PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11057.exe
        5⤵
        
        PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52068.exe
        5⤵
        
        PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58488.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50268.exe
        5⤵
        
        PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4396.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24026.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1369.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47654.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11091.exe
        6⤵
        
        PID:4012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25331.exe
        6⤵
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30810.exe
        6⤵
        
        PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46081.exe
        5⤵
        
        PID:2944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53221.exe
        5⤵
        
        PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19722.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44867.exe
        5⤵
        
        PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41422.exe
        5⤵
        
        PID:4448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42784.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6885.exe
      4⤵
      PID:2808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37138.exe
      4⤵
      PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40519.exe
      4⤵
      PID:3936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50760.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29453.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19585.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19585.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55647.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8348.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13402.exe
        5⤵
        
        PID:1064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26173.exe
        5⤵
        
        PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36691.exe
        5⤵
        
        PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33314.exe
        5⤵
        
        PID:4820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-761.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33308.exe
      4⤵
      PID:1964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45804.exe
      4⤵
      PID:2412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56009.exe
      4⤵
      PID:3452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31622.exe
      4⤵
      PID:4380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49133.exe
      4⤵
      PID:4900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49901.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49901.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34763.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7896.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29074.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44867.exe
      4⤵
      PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41422.exe
      4⤵
      PID:4440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6262.exe
      4⤵
      PID:4996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35183.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35183.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26424.exe
      4⤵
      PID:2136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18328.exe
      4⤵
      PID:1696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40111.exe
      4⤵
      PID:3120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20893.exe
      4⤵
      PID:3448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64865.exe
      4⤵
      PID:4536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64831.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64831.exe
    3⤵
    PID:2468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12728.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12728.exe
    3⤵
    PID:2016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37841.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37841.exe
    3⤵
    PID:3132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39712.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39712.exe
    3⤵
    PID:2856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6238.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6238.exe
    3⤵
    PID:4976
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39451.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39451.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47479.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20627.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19573.exe
        5⤵
        
        PID:2492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39939.exe
        5⤵
        
        PID:1768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36691.exe
        5⤵
        
        PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58488.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50268.exe
        5⤵
        
        PID:4872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49578.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46699.exe
        5⤵
        
        PID:2604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55773.exe
        5⤵
        
        PID:3232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42789.exe
        5⤵
        
        PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14889.exe
        5⤵
        
        PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55789.exe
        5⤵
        
        PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13761.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54233.exe
      4⤵
      PID:3428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47351.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26345.exe
      4⤵
      PID:5024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35781.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35781.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3906.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21390.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26424.exe
        6⤵
        
        PID:524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23507.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44340.exe
        6⤵
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25331.exe
        6⤵
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30810.exe
        6⤵
        
        PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19027.exe
        5⤵
        
        PID:1032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12464.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13190.exe
        5⤵
        
        PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5397.exe
        5⤵
        
        PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39469.exe
        5⤵
        
        PID:4756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48717.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10860.exe
        5⤵
        
        PID:796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64527.exe
        6⤵
        
        PID:4828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39485.exe
        5⤵
        
        PID:1096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14662.exe
        6⤵
        
        PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40365.exe
        5⤵
        
        PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        5⤵
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40986.exe
        5⤵
        
        PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37320.exe
      4⤵
      PID:856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42558.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38525.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28331.exe
      4⤵
      PID:3984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58488.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50268.exe
      4⤵
      PID:4812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4237.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4237.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39174.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39174.exe
    3⤵
    PID:2320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37138.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37138.exe
    3⤵
    PID:956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1782.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1782.exe
    3⤵
    PID:1728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48057.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48057.exe
    3⤵
    PID:3596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18369.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18369.exe
    3⤵
    PID:4240
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41983.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41983.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4526.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4526.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20648.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36941.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29053.exe
        5⤵
        
        PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9024.exe
        5⤵
        
        PID:3644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64454.exe
        5⤵
        
        PID:4528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47451.exe
      4⤵
      PID:1596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23410.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26983.exe
      4⤵
      PID:3416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24174.exe
      4⤵
      PID:3640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30810.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62536.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62536.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9734.exe
      4⤵
      PID:1912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13812.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19722.exe
      4⤵
      PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3066.exe
      4⤵
      PID:3672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41422.exe
      4⤵
      PID:4340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6262.exe
      4⤵
      PID:4948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29369.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29369.exe
    3⤵
    PID:2776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13761.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13761.exe
    3⤵
    PID:2744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60652.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60652.exe
    3⤵
    PID:3288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23453.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23453.exe
    3⤵
    PID:4028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46116.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46116.exe
    3⤵
    PID:4112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47808.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47808.exe
    3⤵
    PID:4292
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28268.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28268.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36844.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36844.exe
    3⤵
    PID:1680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26424.exe
      4⤵
      PID:2396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18328.exe
      4⤵
      PID:2500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40111.exe
      4⤵
      PID:3172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11704.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15818.exe
      4⤵
      PID:4364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6558.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6558.exe
    3⤵
    PID:1328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37243.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37243.exe
    3⤵
    PID:2588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47190.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47190.exe
    3⤵
    PID:3788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44867.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44867.exe
    3⤵
    PID:1484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41422.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41422.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6262.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6262.exe
    3⤵
    PID:4904
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59292.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59292.exe
  2⤵
  PID:2800
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26255.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26255.exe
  2⤵
  PID:2036
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20539.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20539.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3768
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18531.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18531.exe
  2⤵
  PID:3620
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35822.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35822.exe
  2⤵
  PID:4316
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21398.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21398.exe
  2⤵
  PID:4744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-23115.exe

Filesize
468KB

MD5
b827be7407cf9459648c485b02801af5

SHA1
829924d68a68061d02f1f7e9a02e399a4558df4a

SHA256
7efb4815b27c69671671cbc1e2eac7f6a9b7d6cb9130e9e74d96cdfaf14b6e68

SHA512
6557469a90e3da1b28d190590879e6fe946c288d12f140657d0fc70c5199288c4a7f953e44aeb019a46708155a7f5eee195382c962e90c99c93cc1db0872dfc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23691.exe

Filesize
468KB

MD5
211533abf93a8d7668e5f72e83a71289

SHA1
38583e6cf32156a3b41215273e8850ac40da51e7

SHA256
34ea37f549b619e8c4c8ad4fc773b6d33ecb17eb39a50ea7c0f97e90fe613164

SHA512
e5ced7a8fa8eec356bc33b8bf405a54e127b39498a75ac8459aca88470ac589a9aa08e53f663ba084eda71d72f2b545a08490c6f411d9279ace9b8509783bc2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28521.exe

Filesize
468KB

MD5
7a1d6c11bd16c51d67b64ef26e2d34df

SHA1
85153629e173ddd6c6e2dbde54c1ba2981619ec8

SHA256
81619085c8a0f7694f5aee583bda52cb69e82e902a178a71dbdc30a392ec282f

SHA512
bd61e8bdb4cc889ff7534283437b57dc70bffc15107c179710cc79e64b83ea7664810ec79f4df9e96a647d3a388a7ddb6f7bbe27321831372b7a53bc40081ab2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37320.exe

Filesize
468KB

MD5
03d496787a43c83530e2720249a961c6

SHA1
672811ebc26e13439639b8bcd13f819bfb2b9188

SHA256
1437bd360cb44965bb9bdae14d8da552d79d1ed5b575a3c0510532659ef26388

SHA512
a45abe1d809cbbcf286b56b68a7b32e7065ff6746376fbef734c29665ae4dd423b64346c4c593a4da595518845685775e417acc76194fbad1f3e8334fdd1a1e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41983.exe

Filesize
468KB

MD5
fd8abd0e055ea01736915466b0805b77

SHA1
78b6ec3d02a8ed7c211a0c7639d838369fbf0eb8

SHA256
7853ecdce0339c1fbb5f259b9114de4eaf15a509276c8e6c606202575661ccdd

SHA512
cc5905f8186b237ee8619e4274c2a69d22a1682fe624e3c0460fe495d1268e3601751e6aa6676473a2e90459aa92a86c84f520ae3c2f5438d82d25c7a48e7546

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-10981.exe

Filesize
468KB

MD5
d14abd732f677bf8ebf043a8e71eeab6

SHA1
97a9ce57c10b921666769afb5247edba6a573267

SHA256
5ef11dc755bdb74bd3855f67462f03a4347686abc7b675bc3e4a997ad0c3d981

SHA512
7afd031841f38d699e5c9119219d9f47a51ceaee9c625c859bc88c67abe6927aec23a897e839732598503722b13bba29992f7f1ca123b55d687657f06951d315

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17477.exe

Filesize
468KB

MD5
5a089c9b8499765fcf87882903e45614

SHA1
fdb1ae41fd6419c3e1f13f4dd732cdfea8a57973

SHA256
8ead1fffc88660d7fc1277f020ad426e30f4f30298ff0d14692c0c257c2433ae

SHA512
9a623f534d46c602546d718dc7e0335aa51bef03ac18b16750249eda632003ca46475b899607572bb5dcb3b31521b6f64b07e1b4b8d1270b6c012376ee138d15

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19585.exe

Filesize
468KB

MD5
08f01fe0204a8f929118671cff33f111

SHA1
2dabb5c2178b6a36ff202a2b4f87d14f05481ad5

SHA256
5aedf0f5da47791589abafd75c319fba233e7658ef36367f0127f56600575b75

SHA512
3a61d8654d6925fb069124d2681d741b2737b186492ef74bb92c9201618e62e21dbbf56f34797e4874d8c695ddeeb960b5bde8ebc5286d326eac0d004d1fe22b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23110.exe

Filesize
468KB

MD5
ba10639d166e8784804f668963eacfe0

SHA1
8ec6accffc6f076eba1a329eeea3e32b9ee78916

SHA256
cfd202549801e3f014d5836689198573979c2f13ada9b4ba70fa463b1bd9aa7b

SHA512
2a131a40c9d33c563eac552bed26d717e135fdae57287622351c87619109b025a3dc85d6ac525af5310b1042c19be40728b805013dc13c31fc0353bf9d0034eb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23883.exe

Filesize
468KB

MD5
84d546585d1aeea071860cddb3269d25

SHA1
75ffe7e614961c2593ff444025ef17669955c229

SHA256
1d732501cbe05b54a9b6cfe1eb58484e2721e33c2ae07a08250b83570a384d36

SHA512
be2b886c1d419d4ce9a1c38f0afeda86a499d5755f391b2c23187980a8d02813cf2edcfb4de28ff4e2efaddb032d3d79ac695430bdf1460d38df9128da40370f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-2668.exe

Filesize
468KB

MD5
2b55288eacb76b8d249c504a62fff140

SHA1
7c5f24300fd92c1e76940575eee0098fe20e8c88

SHA256
879445448c936605331aabd78c608b12f157f5bc467a4799cdebe449c4256d05

SHA512
b71973540cb3173a5fbc3fa3c7500388a66fead634da435ccd05cac8225dbdf0d0c690f6e7b8eed94d57a605abe9d43a72b4237d2b98446a22f7a472b2a1208a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-30318.exe

Filesize
468KB

MD5
11e104646c43685ad4e4ec9729067566

SHA1
7ac5bf71a976bf02153d19a2fa39d9a1ca6148f4

SHA256
5abe40bc47f81d93d96a717518f41a1fcd6eac18803e7075cceb197f3392724b

SHA512
8ab7eb9c2cc4dcb6c3799125448a18296a320568cd901640e5f4fe51b50f3d57ce3bfdb49bd3eef78fabb1908d8b9d6e3096c0add2c75aa227cb0f20d7de0fbc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-39451.exe

Filesize
468KB

MD5
197ba3276112473258913c47434bb44f

SHA1
f873f40d39240f97e87cc51fa14b4223cf0596db

SHA256
0b4ea43bd8866da7227f9f7f147f80552b948bcdf765fbe89660d55e195f9469

SHA512
fbaa8dc61333c1f2b3b8136bfc4dbbbba1f22706d7b17cb0a0bb6a3d024a5e1e6318eb5e9f5d802ae4770a80a0bec095c8febcfa1fce68eb4a8b6c1c301b1745

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51485.exe

Filesize
468KB

MD5
590e79bb0f9ba92b1f156d51218f2e5d

SHA1
635a70d3066dff5d73482f80ea8a938db23a8a15

SHA256
78babdb377aa6451597e09b59660878374e7bc95ed10c352c0d80ed785304a6a

SHA512
ff16355dde3f470f3d62ae1ba413dceae687cfbadca130f2f7d605c622f9505b3200811d9d2cf1005f0a81bd56114828d5fa25becaf9cd2f798b951d538348d4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe

Filesize
468KB

MD5
f810cb3e04909b1aae2df67d7d7a19ce

SHA1
9dbc4e859764e438dcebff7f72fe427b8aa6bf44

SHA256
6d2c128c7bfe0bac1f5ec8a92f2b114d19b541ecd5bdda94548e607cfd604ab2

SHA512
b5a421a4177ea950747467ec01cded965550e8f33cd1b8f9abf3cd197dc1e955add5199719626b31a86eebfbf496f68dd2930f4229c56df0cd4d8718083d0bc6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55195.exe

Filesize
468KB

MD5
fc390c7ada3b6fe93667a3bd76bcb8c2

SHA1
7aeb796420cb0f133a40b2015ef0d0473b8fe56d

SHA256
c132d5f612a55c330fabd5e73fd17cc4ec8183f0718c2310587ccda0a029d194

SHA512
ec9ad9fbe29febe0fca68a4f2aed2951764bef75321ba45bbda52d3e3620851a7aebe3da425d5bd6e215ebaa2fb1362363fdde6f33a166b4e0a871d7c38382ae

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57603.exe

Filesize
468KB

MD5
2869ced963263a57b6ba28483bf005f4

SHA1
49ac063dc9eb673e2954aabc3ad89c12061b3785

SHA256
dd93c45a53d4add02f08928f6762ed4932e32ce6d0a2eee79b25d433dc39590a

SHA512
6101c26d58c5007dc305325b6bd655389d439394329ee230b7646fe428e17babcfb4a9892013e223787465882b71e6d79430b6aa4d3cb729181c73ae061d69b5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-7452.exe

Filesize
468KB

MD5
93b2a6879d46567bf2e3fcc182b45fae

SHA1
38e0f297d61cef3356734c41780fb54a776dc6ce

SHA256
dafc56da0a7c39291644a4414388620243b91d10b547c63c4a44586a547ae202

SHA512
fd81d86436d865996c8fe87c30fc6518a3cadb7fbb73dee9b2cb4422fd49907b8cf7090915c97608e39df5c109a30832a1f535e0cac7f5febad9239961da474f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8620.exe

Filesize
468KB

MD5
35d37c601d4ee7b879c5f47112798fea

SHA1
1178e5c065a8ad59c507f168bf458c8d7f6eb990

SHA256
83a81305502d8e767199e6e1eb4e46892d93c63a634bb5241bf8258cec2f273e

SHA512
ff7ac8ea7eb5d98caa21773673528ad8bda17faf759d7a77bd0745e48f4d3a776abc1c1c77322a03fb602aba60d778140e5cfbd5b852ff50f195a0258de4f80a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9715.exe

Filesize
468KB

MD5
8f71b541a9104637ad973f283a28d6d8

SHA1
e1f7d5a6286b76c9c81c865d3632cbcfc12b458e

SHA256
6a467be4d81667af52bd6458bfaee673c918519648a77ca04a9dc06f345eecc0

SHA512
47d187c54151dd89c97b3e51031a94fd5db06ad8cc823df21e1c133cd14782b9cd76f16f6de8ca119025b3860f2e6dd788ebb9b4f67ce833cdd1d5e33ddce730

Download Submit