0e63f80060b88ea37e1dd2381b9ce7f6a4a763bd5586c89753ae31917eababd8

Analysis

max time kernel
120s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 04:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9b59bd76c95a2d181b78ed9ca2d12600N.exe
Size

468KB
MD5

9b59bd76c95a2d181b78ed9ca2d12600
SHA1

78150da5c8e525837d677ad9ead7289eeecd8e68
SHA256

0e63f80060b88ea37e1dd2381b9ce7f6a4a763bd5586c89753ae31917eababd8
SHA512

f53977345247d9332283da3178682eb71108cb08aa63f44bbfebc502db67e57b2ed75f3da6dc091e96192778c63231ab516b1373d62d042a79ab9be5385c3101
SSDEEP

3072:/bCBovIwU35/tbYUPgt58fF/ExRa6IXXOmHowrBEJ02w3fRue2lU:/bIoIJ/tHPM58f82+7J0rvRue

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2552	Unicorn-45517.exe
2768	Unicorn-1926.exe
2852	Unicorn-836.exe
2756	Unicorn-18507.exe
2944	Unicorn-63273.exe
2060	Unicorn-21918.exe
2680	Unicorn-7558.exe
2052	Unicorn-15276.exe
2028	Unicorn-60564.exe
2568	Unicorn-50554.exe
1904	Unicorn-29920.exe
3052	Unicorn-3657.exe
2624	Unicorn-3922.exe
2992	Unicorn-3922.exe
3064	Unicorn-33095.exe
1028	Unicorn-22942.exe
320	Unicorn-51099.exe
2184	Unicorn-37415.exe
2452	Unicorn-12530.exe
2476	Unicorn-35106.exe
1896	Unicorn-47721.exe
1996	Unicorn-1172.exe
2156	Unicorn-34264.exe
1788	Unicorn-4929.exe
928	Unicorn-41033.exe
2464	Unicorn-49963.exe
2544	Unicorn-20498.exe
1960	Unicorn-29800.exe
2032	Unicorn-49449.exe
2200	Unicorn-18945.exe
1164	Unicorn-37576.exe
1956	Unicorn-56735.exe
1308	Unicorn-34774.exe
2608	Unicorn-28259.exe
1748	Unicorn-34390.exe
2332	Unicorn-16828.exe
2296	Unicorn-36502.exe
2940	Unicorn-18805.exe
2792	Unicorn-18687.exe
2252	Unicorn-15458.exe
2664	Unicorn-5858.exe
2656	Unicorn-29725.exe
1608	Unicorn-39811.exe
2712	Unicorn-11115.exe
2316	Unicorn-11115.exe
2040	Unicorn-31837.exe
2908	Unicorn-50020.exe
2372	Unicorn-63284.exe
2192	Unicorn-31104.exe
3020	Unicorn-34442.exe
1048	Unicorn-33216.exe
2708	Unicorn-290.exe
2700	Unicorn-47022.exe
2676	Unicorn-49822.exe
1628	Unicorn-55568.exe
1260	Unicorn-54499.exe
2500	Unicorn-27975.exe
2428	Unicorn-41711.exe
1612	Unicorn-42304.exe
2188	Unicorn-44700.exe
2496	Unicorn-1245.exe
2468	Unicorn-19156.exe
1808	Unicorn-39022.exe
1140	Unicorn-35196.exe

Loads dropped DLL 64 IoCs

pid	Process
1656	9b59bd76c95a2d181b78ed9ca2d12600N.exe
1656	9b59bd76c95a2d181b78ed9ca2d12600N.exe
2552	Unicorn-45517.exe
1656	9b59bd76c95a2d181b78ed9ca2d12600N.exe
2552	Unicorn-45517.exe
1656	9b59bd76c95a2d181b78ed9ca2d12600N.exe
2768	Unicorn-1926.exe
2768	Unicorn-1926.exe
2552	Unicorn-45517.exe
2852	Unicorn-836.exe
2852	Unicorn-836.exe
2552	Unicorn-45517.exe
1656	9b59bd76c95a2d181b78ed9ca2d12600N.exe
1656	9b59bd76c95a2d181b78ed9ca2d12600N.exe
2756	Unicorn-18507.exe
2756	Unicorn-18507.exe
2768	Unicorn-1926.exe
2768	Unicorn-1926.exe
2944	Unicorn-63273.exe
2944	Unicorn-63273.exe
2852	Unicorn-836.exe
2852	Unicorn-836.exe
1656	9b59bd76c95a2d181b78ed9ca2d12600N.exe
1656	9b59bd76c95a2d181b78ed9ca2d12600N.exe
2060	Unicorn-21918.exe
2680	Unicorn-7558.exe
2680	Unicorn-7558.exe
2060	Unicorn-21918.exe
2552	Unicorn-45517.exe
2552	Unicorn-45517.exe
2052	Unicorn-15276.exe
2052	Unicorn-15276.exe
2756	Unicorn-18507.exe
2756	Unicorn-18507.exe
2028	Unicorn-60564.exe
2028	Unicorn-60564.exe
2768	Unicorn-1926.exe
2768	Unicorn-1926.exe
2568	Unicorn-50554.exe
2568	Unicorn-50554.exe
2944	Unicorn-63273.exe
2944	Unicorn-63273.exe
2992	Unicorn-3922.exe
2992	Unicorn-3922.exe
2060	Unicorn-21918.exe
3052	Unicorn-3657.exe
2060	Unicorn-21918.exe
3052	Unicorn-3657.exe
1656	9b59bd76c95a2d181b78ed9ca2d12600N.exe
1656	9b59bd76c95a2d181b78ed9ca2d12600N.exe
2624	Unicorn-3922.exe
3064	Unicorn-33095.exe
2624	Unicorn-3922.exe
3064	Unicorn-33095.exe
2852	Unicorn-836.exe
2852	Unicorn-836.exe
2680	Unicorn-7558.exe
2680	Unicorn-7558.exe
2552	Unicorn-45517.exe
2552	Unicorn-45517.exe
1028	Unicorn-22942.exe
1028	Unicorn-22942.exe
2052	Unicorn-15276.exe
2052	Unicorn-15276.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5096	1140	WerFault.exe	92
4372	4636	WerFault.exe	368

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7253.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9966.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4383.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33539.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65104.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13644.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17621.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-987.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4979.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63273.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8216.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50852.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46781.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6445.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51987.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59321.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51099.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63558.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37443.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60178.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37772.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56391.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37843.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9b59bd76c95a2d181b78ed9ca2d12600N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47022.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51236.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23718.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14328.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37343.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46652.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47721.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29997.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65088.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34070.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51165.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4674.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37843.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20659.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42268.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61381.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42304.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49095.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49989.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20918.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45517.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8321.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20591.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3444.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56990.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9665.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63284.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50492.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54153.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34677.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-836.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39593.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29997.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13165.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1656	9b59bd76c95a2d181b78ed9ca2d12600N.exe
2552	Unicorn-45517.exe
2768	Unicorn-1926.exe
2852	Unicorn-836.exe
2756	Unicorn-18507.exe
2944	Unicorn-63273.exe
2680	Unicorn-7558.exe
2060	Unicorn-21918.exe
2052	Unicorn-15276.exe
2028	Unicorn-60564.exe
2568	Unicorn-50554.exe
2992	Unicorn-3922.exe
3064	Unicorn-33095.exe
1904	Unicorn-29920.exe
3052	Unicorn-3657.exe
2624	Unicorn-3922.exe
1028	Unicorn-22942.exe
320	Unicorn-51099.exe
2184	Unicorn-37415.exe
2452	Unicorn-12530.exe
2476	Unicorn-35106.exe
1996	Unicorn-1172.exe
1896	Unicorn-47721.exe
2464	Unicorn-49963.exe
928	Unicorn-41033.exe
2544	Unicorn-20498.exe
1960	Unicorn-29800.exe
2032	Unicorn-49449.exe
1788	Unicorn-4929.exe
2156	Unicorn-34264.exe
2200	Unicorn-18945.exe
1164	Unicorn-37576.exe
1956	Unicorn-56735.exe
1308	Unicorn-34774.exe
1748	Unicorn-34390.exe
2608	Unicorn-28259.exe
2332	Unicorn-16828.exe
2296	Unicorn-36502.exe
2792	Unicorn-18687.exe
2252	Unicorn-15458.exe
2940	Unicorn-18805.exe
2664	Unicorn-5858.exe
2656	Unicorn-29725.exe
2712	Unicorn-11115.exe
2316	Unicorn-11115.exe
2908	Unicorn-50020.exe
2372	Unicorn-63284.exe
2040	Unicorn-31837.exe
1608	Unicorn-39811.exe
2192	Unicorn-31104.exe
1048	Unicorn-33216.exe
3020	Unicorn-34442.exe
2708	Unicorn-290.exe
2700	Unicorn-47022.exe
2676	Unicorn-49822.exe
1628	Unicorn-55568.exe
1260	Unicorn-54499.exe
2428	Unicorn-41711.exe
2500	Unicorn-27975.exe
1612	Unicorn-42304.exe
2188	Unicorn-44700.exe
2496	Unicorn-1245.exe
2468	Unicorn-19156.exe
1140	Unicorn-35196.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2552	1656	9b59bd76c95a2d181b78ed9ca2d12600N.exe	29
PID 1656 wrote to memory of 2552	1656	9b59bd76c95a2d181b78ed9ca2d12600N.exe	29
PID 1656 wrote to memory of 2552	1656	9b59bd76c95a2d181b78ed9ca2d12600N.exe	29
PID 1656 wrote to memory of 2552	1656	9b59bd76c95a2d181b78ed9ca2d12600N.exe	29
PID 2552 wrote to memory of 2768	2552	Unicorn-45517.exe	30
PID 2552 wrote to memory of 2768	2552	Unicorn-45517.exe	30
PID 2552 wrote to memory of 2768	2552	Unicorn-45517.exe	30
PID 2552 wrote to memory of 2768	2552	Unicorn-45517.exe	30
PID 1656 wrote to memory of 2852	1656	9b59bd76c95a2d181b78ed9ca2d12600N.exe	31
PID 1656 wrote to memory of 2852	1656	9b59bd76c95a2d181b78ed9ca2d12600N.exe	31
PID 1656 wrote to memory of 2852	1656	9b59bd76c95a2d181b78ed9ca2d12600N.exe	31
PID 1656 wrote to memory of 2852	1656	9b59bd76c95a2d181b78ed9ca2d12600N.exe	31
PID 2768 wrote to memory of 2756	2768	Unicorn-1926.exe	32
PID 2768 wrote to memory of 2756	2768	Unicorn-1926.exe	32
PID 2768 wrote to memory of 2756	2768	Unicorn-1926.exe	32
PID 2768 wrote to memory of 2756	2768	Unicorn-1926.exe	32
PID 2852 wrote to memory of 2944	2852	Unicorn-836.exe	34
PID 2852 wrote to memory of 2944	2852	Unicorn-836.exe	34
PID 2852 wrote to memory of 2944	2852	Unicorn-836.exe	34
PID 2852 wrote to memory of 2944	2852	Unicorn-836.exe	34
PID 2552 wrote to memory of 2060	2552	Unicorn-45517.exe	33
PID 2552 wrote to memory of 2060	2552	Unicorn-45517.exe	33
PID 2552 wrote to memory of 2060	2552	Unicorn-45517.exe	33
PID 2552 wrote to memory of 2060	2552	Unicorn-45517.exe	33
PID 1656 wrote to memory of 2680	1656	9b59bd76c95a2d181b78ed9ca2d12600N.exe	35
PID 1656 wrote to memory of 2680	1656	9b59bd76c95a2d181b78ed9ca2d12600N.exe	35
PID 1656 wrote to memory of 2680	1656	9b59bd76c95a2d181b78ed9ca2d12600N.exe	35
PID 1656 wrote to memory of 2680	1656	9b59bd76c95a2d181b78ed9ca2d12600N.exe	35
PID 2756 wrote to memory of 2052	2756	Unicorn-18507.exe	36
PID 2756 wrote to memory of 2052	2756	Unicorn-18507.exe	36
PID 2756 wrote to memory of 2052	2756	Unicorn-18507.exe	36
PID 2756 wrote to memory of 2052	2756	Unicorn-18507.exe	36
PID 2768 wrote to memory of 2028	2768	Unicorn-1926.exe	37
PID 2768 wrote to memory of 2028	2768	Unicorn-1926.exe	37
PID 2768 wrote to memory of 2028	2768	Unicorn-1926.exe	37
PID 2768 wrote to memory of 2028	2768	Unicorn-1926.exe	37
PID 2944 wrote to memory of 2568	2944	Unicorn-63273.exe	38
PID 2944 wrote to memory of 2568	2944	Unicorn-63273.exe	38
PID 2944 wrote to memory of 2568	2944	Unicorn-63273.exe	38
PID 2944 wrote to memory of 2568	2944	Unicorn-63273.exe	38
PID 2852 wrote to memory of 1904	2852	Unicorn-836.exe	39
PID 2852 wrote to memory of 1904	2852	Unicorn-836.exe	39
PID 2852 wrote to memory of 1904	2852	Unicorn-836.exe	39
PID 2852 wrote to memory of 1904	2852	Unicorn-836.exe	39
PID 1656 wrote to memory of 3052	1656	9b59bd76c95a2d181b78ed9ca2d12600N.exe	40
PID 1656 wrote to memory of 3052	1656	9b59bd76c95a2d181b78ed9ca2d12600N.exe	40
PID 1656 wrote to memory of 3052	1656	9b59bd76c95a2d181b78ed9ca2d12600N.exe	40
PID 1656 wrote to memory of 3052	1656	9b59bd76c95a2d181b78ed9ca2d12600N.exe	40
PID 2680 wrote to memory of 2624	2680	Unicorn-7558.exe	42
PID 2680 wrote to memory of 2624	2680	Unicorn-7558.exe	42
PID 2680 wrote to memory of 2624	2680	Unicorn-7558.exe	42
PID 2680 wrote to memory of 2624	2680	Unicorn-7558.exe	42
PID 2060 wrote to memory of 2992	2060	Unicorn-21918.exe	41
PID 2060 wrote to memory of 2992	2060	Unicorn-21918.exe	41
PID 2060 wrote to memory of 2992	2060	Unicorn-21918.exe	41
PID 2060 wrote to memory of 2992	2060	Unicorn-21918.exe	41
PID 2552 wrote to memory of 3064	2552	Unicorn-45517.exe	43
PID 2552 wrote to memory of 3064	2552	Unicorn-45517.exe	43
PID 2552 wrote to memory of 3064	2552	Unicorn-45517.exe	43
PID 2552 wrote to memory of 3064	2552	Unicorn-45517.exe	43
PID 2052 wrote to memory of 1028	2052	Unicorn-15276.exe	44
PID 2052 wrote to memory of 1028	2052	Unicorn-15276.exe	44
PID 2052 wrote to memory of 1028	2052	Unicorn-15276.exe	44
PID 2052 wrote to memory of 1028	2052	Unicorn-15276.exe	44

C:\Users\Admin\AppData\Local\Temp\9b59bd76c95a2d181b78ed9ca2d12600N.exe
"C:\Users\Admin\AppData\Local\Temp\9b59bd76c95a2d181b78ed9ca2d12600N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1926.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1926.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18507.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15276.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22942.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37576.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1245.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43282.exe
        8⤵
        
        PID:560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59901.exe
        8⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58910.exe
        8⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37843.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19156.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60178.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52382.exe
        8⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55592.exe
        8⤵
        
        PID:1184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39863.exe
        8⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44813.exe
        7⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65186.exe
        7⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20918.exe
        7⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10202.exe
        7⤵
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56735.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42304.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49863.exe
        8⤵
        
        PID:656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51045.exe
        8⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37055.exe
        8⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42205.exe
        8⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56460.exe
        8⤵
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29997.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64780.exe
        7⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17478.exe
        7⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6165.exe
        7⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39924.exe
        7⤵
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44700.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63371.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3380.exe
        7⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45121.exe
        7⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53625.exe
        7⤵
        
        PID:1732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62883.exe
        6⤵
        
        PID:748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56521.exe
        6⤵
        
        PID:3416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4383.exe
        6⤵
        
        PID:3580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22044.exe
        6⤵
        
        PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51099.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34774.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57522.exe
        7⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56262.exe
        8⤵
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45586.exe
        8⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60366.exe
        8⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41660.exe
        8⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14998.exe
        7⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59321.exe
        7⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49895.exe
        7⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54379.exe
        7⤵
        
        PID:4816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37547.exe
        6⤵
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1655.exe
        6⤵
        
        PID:1696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43129.exe
        6⤵
        
        PID:3584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3444.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54909.exe
        6⤵
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28259.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39593.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54153.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-580.exe
        6⤵
        
        PID:3348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-170.exe
        6⤵
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47726.exe
        6⤵
        
        PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11855.exe
        5⤵
        
        PID:820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65088.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49989.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58864.exe
        5⤵
        
        PID:3688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43346.exe
        5⤵
        
        PID:4852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60564.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37415.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34390.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5540.exe
        7⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64780.exe
        7⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53399.exe
        7⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63863.exe
        7⤵
        
        PID:4416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13033.exe
        6⤵
        
        PID:2076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2351.exe
        6⤵
        
        PID:540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6445.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36922.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4979.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16828.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54499.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7253.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45586.exe
        7⤵
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23718.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56391.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11245.exe
        6⤵
        
        PID:2736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46781.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57572.exe
        6⤵
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-514.exe
        6⤵
        
        PID:4688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41711.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49095.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3764.exe
        6⤵
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9966.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63837.exe
        6⤵
        
        PID:4172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7451.exe
        6⤵
        
        PID:4248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25224.exe
        5⤵
        
        PID:1160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58965.exe
        5⤵
        
        PID:1108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4344.exe
        5⤵
        
        PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33378.exe
        5⤵
        
        PID:4804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12530.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36502.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8321.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24249.exe
        7⤵
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45586.exe
        7⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23718.exe
        7⤵
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30756.exe
        7⤵
        
        PID:4588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14998.exe
        6⤵
        
        PID:1312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59321.exe
        6⤵
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49895.exe
        6⤵
        
        PID:3216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15851.exe
        6⤵
        
        PID:3356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63251.exe
        5⤵
        
        PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32298.exe
        5⤵
        
        PID:2108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43129.exe
        5⤵
        
        PID:3592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41230.exe
        5⤵
        
        PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe
        5⤵
        
        PID:4472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18805.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52312.exe
        5⤵
        
        PID:524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55161.exe
        6⤵
        
        PID:1824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54153.exe
        6⤵
        
        PID:624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3787.exe
        6⤵
        
        PID:3296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28360.exe
        6⤵
        
        PID:3888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56453.exe
        6⤵
        
        PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57792.exe
        5⤵
        
        PID:808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46660.exe
        5⤵
        
        PID:1404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37126.exe
        5⤵
        
        PID:3784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55167.exe
        5⤵
        
        PID:4020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7981.exe
        5⤵
        
        PID:4256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe
      4⤵
      PID:2160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53055.exe
        5⤵
        
        PID:2276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54036.exe
        5⤵
        
        PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50279.exe
        5⤵
        
        PID:3832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54955.exe
        5⤵
        
        PID:4616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47900.exe
      4⤵
      PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57051.exe
      4⤵
      PID:3408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65455.exe
      4⤵
      PID:3648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60716.exe
      4⤵
      PID:4712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21918.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21918.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1172.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34442.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16651.exe
        7⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42268.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        6⤵
        
        PID:2136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40655.exe
        6⤵
        
        PID:3192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13439.exe
        6⤵
        
        PID:3108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31197.exe
        6⤵
        
        PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33216.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33148.exe
        6⤵
        
        PID:2132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18563.exe
        6⤵
        
        PID:2064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37264.exe
        6⤵
        
        PID:3612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14399.exe
        6⤵
        
        PID:3928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25124.exe
        6⤵
        
        PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42970.exe
        5⤵
        
        PID:2956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28564.exe
        5⤵
        
        PID:2744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1791.exe
        5⤵
        
        PID:3640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3807.exe
        5⤵
        
        PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
        5⤵
        
        PID:4976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34264.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-91.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-91.exe
        5⤵
        
        PID:1648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41443.exe
        5⤵
        
        PID:2140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4674.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19979.exe
        5⤵
        
        PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37843.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13644.exe
      4⤵
      PID:2584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37994.exe
      4⤵
      PID:2280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20591.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18480.exe
      4⤵
      PID:3840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-706.exe
      4⤵
      PID:4968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33095.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33095.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:3064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20498.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31837.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1082.exe
        6⤵
        
        PID:2072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27167.exe
        6⤵
        
        PID:2364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59901.exe
        6⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20918.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42574.exe
        6⤵
        
        PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15617.exe
        5⤵
        
        PID:1768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13165.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51236.exe
        5⤵
        
        PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24694.exe
        5⤵
        
        PID:3868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5708.exe
        5⤵
        
        PID:4948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31104.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52223.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5108.exe
      4⤵
      PID:1652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7166.exe
      4⤵
      PID:2344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39212.exe
      4⤵
      PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59748.exe
      4⤵
      PID:4664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18945.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18945.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-290.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23738.exe
        5⤵
        
        PID:1640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47285.exe
        5⤵
        
        PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45588.exe
        5⤵
        
        PID:3976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22090.exe
        5⤵
        
        PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38155.exe
      4⤵
      PID:2272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59321.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29584.exe
      4⤵
      PID:3564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21514.exe
      4⤵
      PID:4696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47022.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47022.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4632.exe
      4⤵
      PID:584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59321.exe
      4⤵
      PID:3492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29584.exe
      4⤵
      PID:3528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58674.exe
      4⤵
      PID:4848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16276.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16276.exe
    3⤵
    PID:1600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59495.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59495.exe
    3⤵
    PID:2212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3573.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3573.exe
    3⤵
    PID:3944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7204.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7204.exe
    3⤵
    PID:3896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4340
- C:\Users\Admin\AppData\Local\Temp\Unicorn-836.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-836.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63273.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63273.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50554.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35106.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18687.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49664.exe
        7⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45586.exe
        7⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61710.exe
        7⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41660.exe
        7⤵
        
        PID:4748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29997.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61381.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17478.exe
        6⤵
        
        PID:3844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30242.exe
        6⤵
        
        PID:2424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65229.exe
        6⤵
        
        PID:4752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5858.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32956.exe
        6⤵
        
        PID:2256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25107.exe
        6⤵
        
        PID:2804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4591.exe
        6⤵
        
        PID:3628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2038.exe
        6⤵
        
        PID:1736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25124.exe
        6⤵
        
        PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13644.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8216.exe
        5⤵
        
        PID:2436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20591.exe
        5⤵
        
        PID:3800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25777.exe
        5⤵
        
        PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46652.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47721.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39022.exe
        5⤵
        Executes dropped EXE
        
        PID:1808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37343.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63781.exe
        6⤵
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63558.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59321.exe
        5⤵
        
        PID:3484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25826.exe
        5⤵
        
        PID:4056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44481.exe
        5⤵
        
        PID:4864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35196.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1140
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 240
        5⤵
        Program crash
        
        PID:5096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17621.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34700.exe
      4⤵
      PID:4024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21448.exe
      4⤵
      PID:3668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26725.exe
      4⤵
      PID:4460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29920.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29920.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15458.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5540.exe
        5⤵
        
        PID:1568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26757.exe
        5⤵
        
        PID:3228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62064.exe
        5⤵
        
        PID:3264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31197.exe
        5⤵
        
        PID:4376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11008.exe
      4⤵
      PID:2404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8216.exe
      4⤵
      PID:2732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63317.exe
      4⤵
      PID:3404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40506.exe
      4⤵
      PID:3376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20659.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29800.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29800.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11115.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48576.exe
        5⤵
        
        PID:2012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54153.exe
        5⤵
        
        PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-580.exe
        5⤵
        
        PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56299.exe
        5⤵
        
        PID:1816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34677.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29997.exe
      4⤵
      PID:2320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64780.exe
      4⤵
      PID:2560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65034.exe
      4⤵
      PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33539.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-475.exe
      4⤵
      PID:4872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50020.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50020.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4395.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62354.exe
      4⤵
      PID:4580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50492.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50492.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42429.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42429.exe
    3⤵
    PID:2244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25104.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25104.exe
    3⤵
    PID:3912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12539.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12539.exe
    3⤵
    PID:3940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30124.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30124.exe
    3⤵
    PID:4156
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7558.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7558.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49963.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11115.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51404.exe
        6⤵
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40867.exe
        6⤵
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4674.exe
        6⤵
        
        PID:3812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29584.exe
        6⤵
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9665.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51165.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63572.exe
        5⤵
        
        PID:2460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37126.exe
        5⤵
        
        PID:3792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47308.exe
        5⤵
        
        PID:3092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39146.exe
        5⤵
        
        PID:4768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63284.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65104.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54153.exe
        5⤵
        
        PID:2308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3787.exe
        5⤵
        
        PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14328.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5027.exe
        5⤵
        
        PID:4792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26768.exe
      4⤵
      PID:328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8216.exe
      4⤵
      PID:2844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-987.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14858.exe
      4⤵
      PID:3748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51987.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49449.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49449.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54325.exe
      4⤵
      PID:2840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48576.exe
        5⤵
        
        PID:2504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54153.exe
        5⤵
        
        PID:1436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-580.exe
        5⤵
        
        PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-170.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42568.exe
        5⤵
        
        PID:5088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45134.exe
      4⤵
      PID:1000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8216.exe
      4⤵
      PID:2784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63317.exe
      4⤵
      PID:3380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14858.exe
      4⤵
      PID:3624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54208.exe
      4⤵
      PID:4900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49822.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49822.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4632.exe
      4⤵
      PID:1052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59321.exe
      4⤵
      PID:3448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25826.exe
      4⤵
      PID:3084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56990.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8804.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8804.exe
    3⤵
    PID:2288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61980.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61980.exe
    3⤵
    PID:2996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8038.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8038.exe
    3⤵
    PID:3932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34070.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34070.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35459.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35459.exe
    3⤵
    PID:4152
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3657.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3657.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:3052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4929.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4929.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55568.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10109.exe
        5⤵
        
        PID:3364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
        5⤵
        
        PID:3712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1626.exe
        5⤵
        
        PID:4548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8216.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20591.exe
      4⤵
      PID:3776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6695.exe
      4⤵
      PID:1716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19232.exe
      4⤵
      PID:4636
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 188
        5⤵
        Program crash
        
        PID:4372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27975.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27975.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37443.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23528.exe
      4⤵
      PID:3600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44030.exe
      4⤵
      PID:4072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63044.exe
      4⤵
      PID:4832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51891.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51891.exe
    3⤵
    PID:2096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51236.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51236.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4383.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4383.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2019.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2019.exe
    3⤵
    PID:4568
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41033.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41033.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29725.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29725.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5540.exe
      4⤵
      PID:2088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64780.exe
      4⤵
      PID:1060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56522.exe
      4⤵
      PID:3708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47726.exe
      4⤵
      PID:4432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18352.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18352.exe
    3⤵
    PID:2328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19071.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19071.exe
    3⤵
    PID:2660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6445.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6445.exe
    3⤵
    PID:3256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3290.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3290.exe
    3⤵
    PID:3076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37843.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37843.exe
    3⤵
    PID:4884
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39811.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39811.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14517.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14517.exe
    3⤵
    PID:4204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29188.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29188.exe
    3⤵
    PID:5116
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18925.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18925.exe
  2⤵
  PID:2204
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37772.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37772.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2056
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48014.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48014.exe
  2⤵
  PID:3828
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49566.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49566.exe
  2⤵
  PID:3964
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23117.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23117.exe
  2⤵
  PID:4308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-21918.exe

Filesize
468KB

MD5
e8708c860297009acb7923f897bdf160

SHA1
211768a35b8de61b9a8bced4fe4cee87aea261d9

SHA256
475b7f6243032e68cb2f26f10c925d8dd3a926bc38c746591024013d9a2fbb78

SHA512
7fdf979d0369bb167c381ea6870f7aaee042f547fb857e5c68c4c44c0515bf831e493547fda33b58e18439c96dca88c926efa92608a36dfb0d2c0ba9af885712

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37415.exe

Filesize
468KB

MD5
522f91c6e36e95b87bc24da7df00f362

SHA1
55b90ffb93bee86db0105a536bdece0908231a5f

SHA256
57156815937a09a62fe9b63f9ed769981418da8934af7c78480f8f7bb29f3236

SHA512
6ae9fe935ea67c9b80405fae74aa836d2f5b3a40a914fcfbbf8dd4cbb7ea5eda5804fb7c83dab9006c41d3920f8542776e8e55579fdbecee27c55cc88722684a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50554.exe

Filesize
468KB

MD5
36261680e3dc83e58fb6b69b331ca83d

SHA1
5793843cbe923a05aba4219e7d73a5e20b7df4d3

SHA256
f8244343f158a4097541b10dce509bf5459be3725db1a1f353bd67bebffdb32d

SHA512
12c115a7b6105ed2b828b4309b1e3a0ae84e8c03e4a82c4d69808c9d702558e08a65fd5818c1cbde499cd1ae4eaa9c59a7d56a03c3296df3169a2202f0a9e412

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63273.exe

Filesize
468KB

MD5
7a85a5d4ecd159fe332d6c6c2e97b535

SHA1
e69f75990daee949650c345f04bb1e7d0e79bc22

SHA256
c744d4fff29c0c7ae0c3b96fef53e0e46fc00ce50d4973dcc969fa50786f8f31

SHA512
21180c73cfcd6ff7136993f2aaf57da0830241a7ef9bfec5779e6b10aa03a277a5140864055cee0678da3b8ac5bb78813fbd6a5f941e1b578a99a6ad441dce06

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15276.exe

Filesize
468KB

MD5
d7392c9da5f7d6d818fb5499971b7426

SHA1
4c18abb8315d153734bd928af1d0a98ade03edc1

SHA256
0ad36206e4c3a51a55bfa11a23f8465ba207798fd1133e1d26836c5527fe4d94

SHA512
64668bb433e67e1019e6d00ddf54b3ed8d85e860c24b5543df4ff37c211a740300bff05711e7ba4db0ca6d9c080a09c6a0cb22fadecccddb6df2c4536e98f74d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18507.exe

Filesize
468KB

MD5
025955dd1aacba70e3b669eac1ec2cb5

SHA1
5537a55891fbc333102ec2f1337d136faf3ce75f

SHA256
68240681242d6c4f93e81ee0a39ee7bee2893abe70a4597b358021ac0f304d05

SHA512
0c85bbc7792350dabed06e98c9674b12b551d02f6b279620a1280f608fa6c93b722c1814b23c82b5269e015250494016f458dfbf4e610f57dd2fc0a635253bcf

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1926.exe

Filesize
468KB

MD5
ae4b1934f115071705a8cafae829319b

SHA1
a892f4bfeb8cff24d13a8882a8bb81f150a1ec02

SHA256
afe5b0a2a2503b5c527f8f46369a5bde48a61f65ce836f959aee13814ee27014

SHA512
feb4d8163b76c5bacf9e5f64ad8967077d8cd4cf7e1cea1cc985720128a8ec384105370ac949538fd744dfed2dd8786e6d75eb12959d0fcd14147abde0dfd41f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22942.exe

Filesize
468KB

MD5
577d19f94dfa242e9d65d75b784fef4e

SHA1
0aa4ad90834f52d674b79572cb74ccaefe5907e2

SHA256
41f88c2b995bf16a760a7e17caaf2189be095349c9f2588378d4c96352eda86d

SHA512
968d47289ec63a2f8ae08f2960448a073deae8506b4e531df30b2d7b9cdb7c0ba75b7cebe8419b18e7a3eab0b2224c86da34265f0e8b3d66b6d7f75598ad280f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29920.exe

Filesize
468KB

MD5
045d5bc607fbf9a4639432f4ffc1649d

SHA1
44fc278bf6c1c398bb7f6c96b309f59404ae2f85

SHA256
f762fa2388b6ffdd1afe8c546304b9b88ab6dcbc31a3243e8686981ed0e2bcf2

SHA512
eb64dbc2a4f3382960b4039720449920b8462a62545d5f6f0b4e738632c4c2e5495994cca555a912d1537d033e1520555ea97305c9b0a3fa51c1534f4cf26dbf

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33095.exe

Filesize
468KB

MD5
99fbc5de9af636c385298441051f7a24

SHA1
b1d0e22edb633effe068dc7b5d0c6282f3f5b34a

SHA256
677377aad3abe795c4a089ba48810136563b7e7bfed6bb6c60e0a645156ac5d7

SHA512
5841649663d1d7480a35b446332d117b1d42b15c31cdc3694a90f65a58595dc6f9d7c654e26c1031b27f2809d3b00ac4239701356e9ce32cbbc695d783b8a33d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3657.exe

Filesize
468KB

MD5
7c1313a03465c83a78352c6481c44a60

SHA1
34495880d3a298ee2b78e15f9c71dd86e252e5c1

SHA256
1a16fccf4969bb3d41f44fb8137768a6714a496fef8adbf1787b8da95d881b8d

SHA512
9928bbbcd4688985cc1cf5eb6bdf3b4d58b13582810acb706bf2e44514aaf3b398a7f7db85a8d015ef3029ac68d8359ce9a641292f9fd0376d32bbc82a358a9e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe

Filesize
468KB

MD5
0a6ff7cfacf2b8ea561ae78da7ae07f2

SHA1
70ab2bfc64f03a56e753e6aa88649cd26891a818

SHA256
728b2964f6ef1e1b6042f5e33ddb60259e6a4b166634c8d27372dbce77e33a3b

SHA512
0f3708070474e428989d270a95662916551b9203a91d7d37b19cec25a1d5febc438b7d83603974ca7fdd917992529e88a1b4b0a856eb30d8c5f7bceafd7a046b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe

Filesize
468KB

MD5
c4cbec2eb9d0fee7bc4d0589e3dc675f

SHA1
d438aaf70c23c5bd1296af924f60fed73bc58e3a

SHA256
601be205e5c8b9e218642cf0e4ae6f9cadf55d80127d1f5e33222d5e07bb485f

SHA512
fffcea9130106acbe2e7b8aaeda3dde3591a96d5669ff2c75bcafa28301442f01e03433dcb8b160bfe5346df32f5e5f1d36533a78e1e36cdf40fa9fbfa6ef6da

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51099.exe

Filesize
468KB

MD5
8a8cce259524fbc823f88ed0b5eca626

SHA1
e4fc97e4d223b4462936cb596a6b49e58b6fe7d6

SHA256
cd886494b966931dfab714c416c6ab916daab1ae5e9ec4122285eff55571c9af

SHA512
b5643e68b8f9e2133ca52cc219b10cfd2e471c41c696121ef280b536ee27393a9fe6b26afa0c33bfb7e9cae96ab36ec80516ed22979c4c3db7a43fe4f6cd35c2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60564.exe

Filesize
468KB

MD5
b9eaa882e6bb2f4260aea8a13c17c94a

SHA1
03e74ca0ee8bb03f77e4755886d81806d819959e

SHA256
9a01f5ef921aac7536592d506e0fee49978560edfe6dec0a394f8ad569882c83

SHA512
dc2567200934eeabadd602bf0119b88e0a33f0df668d447f63e70e000b86e1c4bde5867be4e03592395f9126edd12ad3055fce6bb5ca4fa11590b13b10fec7bc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-7558.exe

Filesize
468KB

MD5
84365bcd7c5aa0440b4659e88fbb1f5c

SHA1
b4ac04033702ff1479fdf7bae98a801d07173bba

SHA256
e5b99ea1cd92197e0ca58360e20dab761f9b7320e0b704c321022422045af6d6

SHA512
bcff9c1d006ff72896f15db6a0aeb83c883524a16179ab29a15383800d97b4a8bf5563d9abfba8c3d9fedad413afd0db59960a7d8554c023a26cacea6e9c74f6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-836.exe

Filesize
468KB

MD5
684284f3e671715e0c0c8a97ba058e50

SHA1
737079197a719b8ca1c50f3db8098fc099475c2d

SHA256
743840e63c85d7fddef68d90d5500fef9049751becc7ca0a21e097afa5a7310a

SHA512
d80b656231e0918614aa817216d438b0bbf7830bb37eea959746b377f1a24cfe876252c0da851b9641d6bfeaaece0394366cdcedea4873094b7fd10b032d73e8

Download Submit