b1137ad02c0659373ef91f9d27ecf98dd2ff44e6f76b3727dc839030e6220b91

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 02:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1137ad02c0659373ef91f9d27ecf98dd2ff44e6f76b3727dc839030e6220b91N.exe
Size

468KB
MD5

29940520cd231c5d29dd047e8c879160
SHA1

9a4c084c6c9a99b51f5882a52170c969d723578b
SHA256

b1137ad02c0659373ef91f9d27ecf98dd2ff44e6f76b3727dc839030e6220b91
SHA512

8f70e49b73ff95bc06062ce710bf5c9edf366a49589f4ba40748af067c99af5a3ac7c69d8db014aa640908c65951a62c1b7c9b803e6c7ba947cf10c764907c87
SSDEEP

3072:ZnCpovIwUkt/5bYAPgc5Of8np5RhNIXIlmHoxS6leIWwOvju77lN:ZnAoIQ/5LPV5Of82qZeILQju7

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2156	Unicorn-40751.exe
2792	Unicorn-681.exe
2100	Unicorn-27001.exe
2324	Unicorn-5959.exe
2604	Unicorn-49327.exe
2612	Unicorn-1709.exe
2568	Unicorn-63062.exe
2392	Unicorn-30156.exe
1488	Unicorn-7196.exe
2808	Unicorn-63404.exe
768	Unicorn-9003.exe
2656	Unicorn-42517.exe
2132	Unicorn-55708.exe
1232	Unicorn-27575.exe
2352	Unicorn-46321.exe
2212	Unicorn-36752.exe
3040	Unicorn-14904.exe
1720	Unicorn-14639.exe
1580	Unicorn-47639.exe
1864	Unicorn-1967.exe
1364	Unicorn-1967.exe
744	Unicorn-19647.exe
1284	Unicorn-30582.exe
2400	Unicorn-59056.exe
2460	Unicorn-51940.exe
2128	Unicorn-38024.exe
2036	Unicorn-41791.exe
2252	Unicorn-40110.exe
1764	Unicorn-16958.exe
992	Unicorn-30318.exe
2060	Unicorn-44599.exe
880	Unicorn-3188.exe
2520	Unicorn-36165.exe
1672	Unicorn-27604.exe
1556	Unicorn-27604.exe
2684	Unicorn-5978.exe
2964	Unicorn-5962.exe
2680	Unicorn-12092.exe
2780	Unicorn-45341.exe
2580	Unicorn-58532.exe
2632	Unicorn-60561.exe
2188	Unicorn-40960.exe
1860	Unicorn-40960.exe
2628	Unicorn-10748.exe
2168	Unicorn-56996.exe
2308	Unicorn-11324.exe
2888	Unicorn-32992.exe
2544	Unicorn-45510.exe
980	Unicorn-57139.exe
1184	Unicorn-24623.exe
1628	Unicorn-56117.exe
2928	Unicorn-47187.exe
2956	Unicorn-47669.exe
1036	Unicorn-27803.exe
1948	Unicorn-34467.exe
1736	Unicorn-48437.exe
1512	Unicorn-46553.exe
732	Unicorn-12090.exe
2472	Unicorn-12090.exe
2512	Unicorn-8664.exe
1644	Unicorn-14264.exe
896	Unicorn-14264.exe
1332	Unicorn-56984.exe
2000	Unicorn-57752.exe

Loads dropped DLL 64 IoCs

pid	Process
2740	b1137ad02c0659373ef91f9d27ecf98dd2ff44e6f76b3727dc839030e6220b91N.exe
2740	b1137ad02c0659373ef91f9d27ecf98dd2ff44e6f76b3727dc839030e6220b91N.exe
2156	Unicorn-40751.exe
2156	Unicorn-40751.exe
2740	b1137ad02c0659373ef91f9d27ecf98dd2ff44e6f76b3727dc839030e6220b91N.exe
2740	b1137ad02c0659373ef91f9d27ecf98dd2ff44e6f76b3727dc839030e6220b91N.exe
2100	Unicorn-27001.exe
2100	Unicorn-27001.exe
2156	Unicorn-40751.exe
2792	Unicorn-681.exe
2740	b1137ad02c0659373ef91f9d27ecf98dd2ff44e6f76b3727dc839030e6220b91N.exe
2156	Unicorn-40751.exe
2740	b1137ad02c0659373ef91f9d27ecf98dd2ff44e6f76b3727dc839030e6220b91N.exe
2792	Unicorn-681.exe
2604	Unicorn-49327.exe
2604	Unicorn-49327.exe
2156	Unicorn-40751.exe
2156	Unicorn-40751.exe
2568	Unicorn-63062.exe
2568	Unicorn-63062.exe
2740	b1137ad02c0659373ef91f9d27ecf98dd2ff44e6f76b3727dc839030e6220b91N.exe
2740	b1137ad02c0659373ef91f9d27ecf98dd2ff44e6f76b3727dc839030e6220b91N.exe
2612	Unicorn-1709.exe
2612	Unicorn-1709.exe
2100	Unicorn-27001.exe
2100	Unicorn-27001.exe
1820	WerFault.exe
1820	WerFault.exe
1820	WerFault.exe
1820	WerFault.exe
1820	WerFault.exe
2324	Unicorn-5959.exe
2324	Unicorn-5959.exe
2792	Unicorn-681.exe
2792	Unicorn-681.exe
1488	Unicorn-7196.exe
1488	Unicorn-7196.exe
2156	Unicorn-40751.exe
2656	Unicorn-42517.exe
2156	Unicorn-40751.exe
2656	Unicorn-42517.exe
2612	Unicorn-1709.exe
2612	Unicorn-1709.exe
768	Unicorn-9003.exe
2808	Unicorn-63404.exe
2808	Unicorn-63404.exe
768	Unicorn-9003.exe
2568	Unicorn-63062.exe
2740	b1137ad02c0659373ef91f9d27ecf98dd2ff44e6f76b3727dc839030e6220b91N.exe
2740	b1137ad02c0659373ef91f9d27ecf98dd2ff44e6f76b3727dc839030e6220b91N.exe
2568	Unicorn-63062.exe
2132	Unicorn-55708.exe
2132	Unicorn-55708.exe
2100	Unicorn-27001.exe
2100	Unicorn-27001.exe
1232	Unicorn-27575.exe
1232	Unicorn-27575.exe
2792	Unicorn-681.exe
2792	Unicorn-681.exe
2352	Unicorn-46321.exe
2352	Unicorn-46321.exe
2324	Unicorn-5959.exe
2324	Unicorn-5959.exe
1720	Unicorn-14639.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1820	2392	WerFault.exe	37

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61897.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62959.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22442.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22110.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3989.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15254.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45341.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40632.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45800.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13944.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36752.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31419.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30479.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30156.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56996.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44831.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14904.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6983.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17387.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26871.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23681.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34676.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62494.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39047.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55753.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32907.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44831.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11329.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24522.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63869.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56498.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27001.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8664.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19779.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39882.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9572.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50191.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1709.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3968.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1189.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9854.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40110.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44955.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7420.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6983.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55208.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65163.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13944.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2740	b1137ad02c0659373ef91f9d27ecf98dd2ff44e6f76b3727dc839030e6220b91N.exe
2156	Unicorn-40751.exe
2100	Unicorn-27001.exe
2792	Unicorn-681.exe
2604	Unicorn-49327.exe
2568	Unicorn-63062.exe
2324	Unicorn-5959.exe
2612	Unicorn-1709.exe
2392	Unicorn-30156.exe
1488	Unicorn-7196.exe
768	Unicorn-9003.exe
2808	Unicorn-63404.exe
2132	Unicorn-55708.exe
2656	Unicorn-42517.exe
1232	Unicorn-27575.exe
2352	Unicorn-46321.exe
2212	Unicorn-36752.exe
3040	Unicorn-14904.exe
1720	Unicorn-14639.exe
1580	Unicorn-47639.exe
1864	Unicorn-1967.exe
1364	Unicorn-1967.exe
744	Unicorn-19647.exe
2400	Unicorn-59056.exe
1284	Unicorn-30582.exe
2460	Unicorn-51940.exe
2128	Unicorn-38024.exe
2036	Unicorn-41791.exe
2252	Unicorn-40110.exe
1764	Unicorn-16958.exe
992	Unicorn-30318.exe
2060	Unicorn-44599.exe
880	Unicorn-3188.exe
1672	Unicorn-27604.exe
1556	Unicorn-27604.exe
2680	Unicorn-12092.exe
2964	Unicorn-5962.exe
2780	Unicorn-45341.exe
2684	Unicorn-5978.exe
2580	Unicorn-58532.exe
2632	Unicorn-60561.exe
1860	Unicorn-40960.exe
2188	Unicorn-40960.exe
2628	Unicorn-10748.exe
2308	Unicorn-11324.exe
2168	Unicorn-56996.exe
2888	Unicorn-32992.exe
2544	Unicorn-45510.exe
980	Unicorn-57139.exe
1184	Unicorn-24623.exe
2928	Unicorn-47187.exe
1628	Unicorn-56117.exe
1036	Unicorn-27803.exe
1948	Unicorn-34467.exe
2956	Unicorn-47669.exe
1736	Unicorn-48437.exe
1512	Unicorn-46553.exe
732	Unicorn-12090.exe
2472	Unicorn-12090.exe
2512	Unicorn-8664.exe
1644	Unicorn-14264.exe
896	Unicorn-14264.exe
1332	Unicorn-56984.exe
2000	Unicorn-57752.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2156	2740	b1137ad02c0659373ef91f9d27ecf98dd2ff44e6f76b3727dc839030e6220b91N.exe	30
PID 2740 wrote to memory of 2156	2740	b1137ad02c0659373ef91f9d27ecf98dd2ff44e6f76b3727dc839030e6220b91N.exe	30
PID 2740 wrote to memory of 2156	2740	b1137ad02c0659373ef91f9d27ecf98dd2ff44e6f76b3727dc839030e6220b91N.exe	30
PID 2740 wrote to memory of 2156	2740	b1137ad02c0659373ef91f9d27ecf98dd2ff44e6f76b3727dc839030e6220b91N.exe	30
PID 2156 wrote to memory of 2792	2156	Unicorn-40751.exe	31
PID 2156 wrote to memory of 2792	2156	Unicorn-40751.exe	31
PID 2156 wrote to memory of 2792	2156	Unicorn-40751.exe	31
PID 2156 wrote to memory of 2792	2156	Unicorn-40751.exe	31
PID 2740 wrote to memory of 2100	2740	b1137ad02c0659373ef91f9d27ecf98dd2ff44e6f76b3727dc839030e6220b91N.exe	32
PID 2740 wrote to memory of 2100	2740	b1137ad02c0659373ef91f9d27ecf98dd2ff44e6f76b3727dc839030e6220b91N.exe	32
PID 2740 wrote to memory of 2100	2740	b1137ad02c0659373ef91f9d27ecf98dd2ff44e6f76b3727dc839030e6220b91N.exe	32
PID 2740 wrote to memory of 2100	2740	b1137ad02c0659373ef91f9d27ecf98dd2ff44e6f76b3727dc839030e6220b91N.exe	32
PID 2100 wrote to memory of 2324	2100	Unicorn-27001.exe	33
PID 2100 wrote to memory of 2324	2100	Unicorn-27001.exe	33
PID 2100 wrote to memory of 2324	2100	Unicorn-27001.exe	33
PID 2100 wrote to memory of 2324	2100	Unicorn-27001.exe	33
PID 2156 wrote to memory of 2604	2156	Unicorn-40751.exe	34
PID 2156 wrote to memory of 2604	2156	Unicorn-40751.exe	34
PID 2156 wrote to memory of 2604	2156	Unicorn-40751.exe	34
PID 2156 wrote to memory of 2604	2156	Unicorn-40751.exe	34
PID 2740 wrote to memory of 2568	2740	b1137ad02c0659373ef91f9d27ecf98dd2ff44e6f76b3727dc839030e6220b91N.exe	36
PID 2740 wrote to memory of 2568	2740	b1137ad02c0659373ef91f9d27ecf98dd2ff44e6f76b3727dc839030e6220b91N.exe	36
PID 2740 wrote to memory of 2568	2740	b1137ad02c0659373ef91f9d27ecf98dd2ff44e6f76b3727dc839030e6220b91N.exe	36
PID 2740 wrote to memory of 2568	2740	b1137ad02c0659373ef91f9d27ecf98dd2ff44e6f76b3727dc839030e6220b91N.exe	36
PID 2792 wrote to memory of 2612	2792	Unicorn-681.exe	35
PID 2792 wrote to memory of 2612	2792	Unicorn-681.exe	35
PID 2792 wrote to memory of 2612	2792	Unicorn-681.exe	35
PID 2792 wrote to memory of 2612	2792	Unicorn-681.exe	35
PID 2604 wrote to memory of 2392	2604	Unicorn-49327.exe	37
PID 2604 wrote to memory of 2392	2604	Unicorn-49327.exe	37
PID 2604 wrote to memory of 2392	2604	Unicorn-49327.exe	37
PID 2604 wrote to memory of 2392	2604	Unicorn-49327.exe	37
PID 2156 wrote to memory of 1488	2156	Unicorn-40751.exe	38
PID 2156 wrote to memory of 1488	2156	Unicorn-40751.exe	38
PID 2156 wrote to memory of 1488	2156	Unicorn-40751.exe	38
PID 2156 wrote to memory of 1488	2156	Unicorn-40751.exe	38
PID 2568 wrote to memory of 2808	2568	Unicorn-63062.exe	39
PID 2568 wrote to memory of 2808	2568	Unicorn-63062.exe	39
PID 2568 wrote to memory of 2808	2568	Unicorn-63062.exe	39
PID 2568 wrote to memory of 2808	2568	Unicorn-63062.exe	39
PID 2740 wrote to memory of 768	2740	b1137ad02c0659373ef91f9d27ecf98dd2ff44e6f76b3727dc839030e6220b91N.exe	40
PID 2740 wrote to memory of 768	2740	b1137ad02c0659373ef91f9d27ecf98dd2ff44e6f76b3727dc839030e6220b91N.exe	40
PID 2740 wrote to memory of 768	2740	b1137ad02c0659373ef91f9d27ecf98dd2ff44e6f76b3727dc839030e6220b91N.exe	40
PID 2740 wrote to memory of 768	2740	b1137ad02c0659373ef91f9d27ecf98dd2ff44e6f76b3727dc839030e6220b91N.exe	40
PID 2612 wrote to memory of 2656	2612	Unicorn-1709.exe	41
PID 2612 wrote to memory of 2656	2612	Unicorn-1709.exe	41
PID 2612 wrote to memory of 2656	2612	Unicorn-1709.exe	41
PID 2612 wrote to memory of 2656	2612	Unicorn-1709.exe	41
PID 2100 wrote to memory of 2132	2100	Unicorn-27001.exe	42
PID 2100 wrote to memory of 2132	2100	Unicorn-27001.exe	42
PID 2100 wrote to memory of 2132	2100	Unicorn-27001.exe	42
PID 2100 wrote to memory of 2132	2100	Unicorn-27001.exe	42
PID 2392 wrote to memory of 1820	2392	Unicorn-30156.exe	43
PID 2392 wrote to memory of 1820	2392	Unicorn-30156.exe	43
PID 2392 wrote to memory of 1820	2392	Unicorn-30156.exe	43
PID 2392 wrote to memory of 1820	2392	Unicorn-30156.exe	43
PID 2792 wrote to memory of 1232	2792	Unicorn-681.exe	45
PID 2792 wrote to memory of 1232	2792	Unicorn-681.exe	45
PID 2792 wrote to memory of 1232	2792	Unicorn-681.exe	45
PID 2792 wrote to memory of 1232	2792	Unicorn-681.exe	45
PID 2324 wrote to memory of 2352	2324	Unicorn-5959.exe	44
PID 2324 wrote to memory of 2352	2324	Unicorn-5959.exe	44
PID 2324 wrote to memory of 2352	2324	Unicorn-5959.exe	44
PID 2324 wrote to memory of 2352	2324	Unicorn-5959.exe	44

C:\Users\Admin\AppData\Local\Temp\b1137ad02c0659373ef91f9d27ecf98dd2ff44e6f76b3727dc839030e6220b91N.exe
"C:\Users\Admin\AppData\Local\Temp\b1137ad02c0659373ef91f9d27ecf98dd2ff44e6f76b3727dc839030e6220b91N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40751.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40751.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-681.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-681.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1709.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42517.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14904.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14264.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55300.exe
        8⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6983.exe
        8⤵
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
        8⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39333.exe
        8⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5464.exe
        7⤵
        
        PID:280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35349.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39194.exe
        7⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61897.exe
        7⤵
        
        PID:5988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40960.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60293.exe
        7⤵
        
        PID:1408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
        8⤵
        
        PID:788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42673.exe
        8⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31010.exe
        8⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57266.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29483.exe
        7⤵
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48388.exe
        7⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34676.exe
        7⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54163.exe
        6⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29196.exe
        7⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15886.exe
        6⤵
        
        PID:3076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20218.exe
        6⤵
        
        PID:3120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50191.exe
        6⤵
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31010.exe
        6⤵
        
        PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47639.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44599.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12090.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15456.exe
        8⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24522.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59298.exe
        8⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4495.exe
        8⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57266.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29483.exe
        7⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32737.exe
        7⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6852.exe
        7⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21155.exe
        6⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3968.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15748.exe
        7⤵
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34188.exe
        7⤵
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62959.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11329.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26683.exe
        6⤵
        
        PID:3628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48464.exe
        6⤵
        
        PID:4740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31010.exe
        6⤵
        
        PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36165.exe
        5⤵
        Executes dropped EXE
        
        PID:2520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14275.exe
        6⤵
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
        7⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6983.exe
        7⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30479.exe
        7⤵
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3400.exe
        6⤵
        
        PID:1852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29483.exe
        6⤵
        
        PID:3744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23588.exe
        6⤵
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30287.exe
        6⤵
        
        PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44955.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6131.exe
        6⤵
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16263.exe
        7⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3987.exe
        7⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42133.exe
        7⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29560.exe
        6⤵
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22442.exe
        6⤵
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39882.exe
        6⤵
        
        PID:4292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44831.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30714.exe
        5⤵
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60001.exe
        6⤵
        
        PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55528.exe
        5⤵
        
        PID:3512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35988.exe
        5⤵
        
        PID:4112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35497.exe
        5⤵
        
        PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35031.exe
        5⤵
        
        PID:5956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27575.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38024.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45510.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56324.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29483.exe
        7⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7790.exe
        7⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54747.exe
        7⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9572.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48162.exe
        6⤵
        
        PID:4088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38773.exe
        6⤵
        
        PID:4248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55730.exe
        6⤵
        
        PID:4696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8.exe
        6⤵
        
        PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57139.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11594.exe
        6⤵
        
        PID:1916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15748.exe
        6⤵
        
        PID:3816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42523.exe
        6⤵
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30926.exe
        6⤵
        
        PID:5784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5464.exe
        5⤵
        
        PID:2220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35349.exe
        5⤵
        
        PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14922.exe
        5⤵
        
        PID:4660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7530.exe
        5⤵
        
        PID:5248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41791.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24623.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19779.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43671.exe
        7⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        6⤵
        
        PID:3864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30107.exe
        6⤵
        
        PID:4220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39194.exe
        6⤵
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61897.exe
        6⤵
        
        PID:6024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40427.exe
        5⤵
        
        PID:2340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10688.exe
        6⤵
        
        PID:1568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29483.exe
        6⤵
        
        PID:3652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23588.exe
        6⤵
        
        PID:4724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39333.exe
        6⤵
        
        PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47340.exe
        5⤵
        
        PID:2796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35349.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55208.exe
        5⤵
        
        PID:4284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51742.exe
        5⤵
        
        PID:5600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47187.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
        5⤵
        
        PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6983.exe
        5⤵
        
        PID:2320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39882.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44831.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51666.exe
      4⤵
      PID:1844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27214.exe
      4⤵
      PID:3940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18722.exe
      4⤵
      PID:4936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4144.exe
      4⤵
      PID:5480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49327.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49327.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30156.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2392
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 200
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:1820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7420.exe
      4⤵
      PID:2356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58113.exe
        5⤵
        
        PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40276.exe
        5⤵
        
        PID:5732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15191.exe
      4⤵
      PID:3492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35457.exe
      4⤵
      PID:3592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39962.exe
      4⤵
      PID:2992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61897.exe
      4⤵
      PID:5916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7196.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7196.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36752.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45341.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23160.exe
        6⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13124.exe
        7⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19172.exe
        7⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58530.exe
        7⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55753.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57266.exe
        6⤵
        
        PID:2364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29483.exe
        6⤵
        
        PID:3848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65409.exe
        6⤵
        
        PID:4792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34676.exe
        6⤵
        
        PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53896.exe
        5⤵
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11594.exe
        6⤵
        
        PID:888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15748.exe
        6⤵
        
        PID:3780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26871.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15517.exe
        6⤵
        
        PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5464.exe
        5⤵
        
        PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35349.exe
        5⤵
        
        PID:3640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24071.exe
        5⤵
        
        PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13944.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40960.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45220.exe
        5⤵
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49427.exe
        6⤵
        
        PID:4408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12185.exe
        6⤵
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64167.exe
        6⤵
        
        PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42336.exe
        5⤵
        
        PID:1564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6983.exe
        5⤵
        
        PID:3156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6585.exe
        5⤵
        
        PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61897.exe
        5⤵
        
        PID:5972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41944.exe
      4⤵
      PID:2180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11955.exe
        5⤵
        
        PID:2476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19410.exe
        5⤵
        
        PID:5124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21506.exe
      4⤵
      PID:3048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4183.exe
      4⤵
      PID:1004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50191.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39863.exe
      4⤵
      PID:5224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14639.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14639.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30318.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48437.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9326.exe
        6⤵
        
        PID:3596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44123.exe
        6⤵
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56498.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44831.exe
        6⤵
        
        PID:6140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57266.exe
        5⤵
        
        PID:2064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29483.exe
        5⤵
        
        PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55730.exe
        5⤵
        
        PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54747.exe
        5⤵
        
        PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46553.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60293.exe
        5⤵
        
        PID:2144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40728.exe
        6⤵
        
        PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29560.exe
        5⤵
        
        PID:3192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23018.exe
        5⤵
        
        PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
        5⤵
        
        PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7044.exe
        5⤵
        
        PID:5632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54163.exe
      4⤵
      PID:1508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11594.exe
        5⤵
        
        PID:1664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15748.exe
        5⤵
        
        PID:3824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35179.exe
        5⤵
        
        PID:4264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39217.exe
        5⤵
        
        PID:5232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11329.exe
      4⤵
      PID:332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26683.exe
      4⤵
      PID:3872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23187.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7382.exe
      4⤵
      PID:5328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3188.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3188.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12090.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61061.exe
        5⤵
        
        PID:2080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12176.exe
        6⤵
        
        PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53593.exe
        5⤵
        
        PID:3252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6983.exe
        5⤵
        
        PID:3140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6585.exe
        5⤵
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61897.exe
        5⤵
        
        PID:5964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60781.exe
      4⤵
      PID:2884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55529.exe
        5⤵
        
        PID:5748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59350.exe
      4⤵
      PID:3772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20881.exe
      4⤵
      PID:4504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48266.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8664.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8664.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42191.exe
      4⤵
      PID:3608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44123.exe
      4⤵
      PID:3936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6585.exe
      4⤵
      PID:4376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61897.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3194.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3194.exe
    3⤵
    PID:2172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5683.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5683.exe
    3⤵
    PID:3972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4046.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4046.exe
    3⤵
    PID:4748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40632.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40632.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4580
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27001.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27001.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5959.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5959.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46321.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40110.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56117.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
        7⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6983.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
        7⤵
        
        PID:468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6852.exe
        7⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57266.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29483.exe
        6⤵
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55730.exe
        6⤵
        
        PID:4700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54747.exe
        6⤵
        
        PID:5428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27803.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11594.exe
        6⤵
        
        PID:2192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15748.exe
        6⤵
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35179.exe
        6⤵
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61367.exe
        6⤵
        
        PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5464.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35349.exe
        5⤵
        
        PID:3688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65000.exe
        5⤵
        
        PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17917.exe
        5⤵
        
        PID:5288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47669.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9326.exe
        6⤵
        
        PID:3536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44123.exe
        6⤵
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56498.exe
        6⤵
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44831.exe
        6⤵
        
        PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57266.exe
        5⤵
        
        PID:2456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29483.exe
        5⤵
        
        PID:3844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48388.exe
        5⤵
        
        PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6852.exe
        5⤵
        
        PID:5268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34467.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31663.exe
        5⤵
        
        PID:760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58785.exe
        5⤵
        
        PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3989.exe
        5⤵
        
        PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51212.exe
        5⤵
        
        PID:5548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2664.exe
      4⤵
      PID:2960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10148.exe
      4⤵
      PID:3884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24601.exe
      4⤵
      PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9479.exe
      4⤵
      PID:5472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55708.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55708.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59056.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12092.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56984.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40799.exe
        7⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29812.exe
        8⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45419.exe
        8⤵
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27998.exe
        7⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6983.exe
        7⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
        7⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49944.exe
        7⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40427.exe
        6⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40779.exe
        7⤵
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23681.exe
        7⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23390.exe
        7⤵
        
        PID:4584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43296.exe
        6⤵
        
        PID:3168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28308.exe
        6⤵
        
        PID:3212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1189.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13944.exe
        6⤵
        
        PID:5704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3294.exe
        5⤵
        
        PID:2428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31419.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58785.exe
        6⤵
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3989.exe
        6⤵
        
        PID:5040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39145.exe
        6⤵
        
        PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5464.exe
        5⤵
        
        PID:2876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35349.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14922.exe
        5⤵
        
        PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13944.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58532.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8224.exe
        5⤵
        
        PID:1788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49426.exe
        6⤵
        
        PID:3216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38258.exe
        6⤵
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65163.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61367.exe
        6⤵
        
        PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17131.exe
        5⤵
        
        PID:2444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22110.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45800.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61897.exe
        5⤵
        
        PID:5892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16593.exe
      4⤵
      PID:2804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
        5⤵
        
        PID:1264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6983.exe
        5⤵
        
        PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
        5⤵
        
        PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6852.exe
        5⤵
        
        PID:5304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34714.exe
      4⤵
      PID:2108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53185.exe
      4⤵
      PID:3088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1719.exe
      4⤵
      PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18332.exe
      4⤵
      PID:5132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51940.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51940.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14264.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7921.exe
        5⤵
        
        PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11175.exe
        5⤵
        
        PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65136.exe
        5⤵
        
        PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4495.exe
        5⤵
        
        PID:5188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5464.exe
      4⤵
      PID:2196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35349.exe
      4⤵
      PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63869.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13944.exe
      4⤵
      PID:5672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60561.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60561.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43054.exe
      4⤵
      PID:3016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16289.exe
        5⤵
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17023.exe
        5⤵
        
        PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9844.exe
        5⤵
        
        PID:5616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61128.exe
      4⤵
      PID:3556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38258.exe
      4⤵
      PID:1604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65163.exe
      4⤵
      PID:4472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61367.exe
      4⤵
      PID:6080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22022.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22022.exe
    3⤵
    PID:2088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40014.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40014.exe
    3⤵
    PID:3792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30638.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30638.exe
    3⤵
    PID:4240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34729.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34729.exe
    3⤵
    PID:5000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35031.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35031.exe
    3⤵
    PID:6000
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63062.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63062.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63404.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63404.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1967.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11324.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27286.exe
        6⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37958.exe
        7⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21589.exe
        6⤵
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22442.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39882.exe
        6⤵
        
        PID:4320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44831.exe
        6⤵
        
        PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7420.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47632.exe
        6⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9411.exe
        7⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41291.exe
        7⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33279.exe
        7⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15748.exe
        6⤵
        
        PID:3712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30758.exe
        6⤵
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47998.exe
        6⤵
        
        PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5464.exe
        5⤵
        
        PID:864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35349.exe
        5⤵
        
        PID:3768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56744.exe
        5⤵
        
        PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55854.exe
        5⤵
        
        PID:5372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32992.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28391.exe
        5⤵
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15456.exe
        6⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24522.exe
        6⤵
        
        PID:4120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59298.exe
        6⤵
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4495.exe
        6⤵
        
        PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56068.exe
        5⤵
        
        PID:2812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6983.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
        5⤵
        
        PID:4128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34676.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24922.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26683.exe
        5⤵
        
        PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30675.exe
        5⤵
        
        PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61924.exe
        5⤵
        
        PID:5256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11329.exe
      4⤵
      PID:2012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26683.exe
      4⤵
      PID:3888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23187.exe
      4⤵
      PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7382.exe
      4⤵
      PID:5280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19647.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19647.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27604.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7648.exe
        5⤵
        
        PID:572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27532.exe
        6⤵
        
        PID:2524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59350.exe
        6⤵
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38773.exe
        6⤵
        
        PID:4276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55730.exe
        6⤵
        
        PID:4764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54747.exe
        6⤵
        
        PID:5392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41268.exe
        5⤵
        
        PID:620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65215.exe
        5⤵
        
        PID:3804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4346.exe
        5⤵
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15254.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4612.exe
      4⤵
      PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46677.exe
        5⤵
        
        PID:320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57836.exe
        5⤵
        
        PID:3976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32907.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64395.exe
        5⤵
        
        PID:4856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61367.exe
        5⤵
        
        PID:6096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50194.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11899.exe
      4⤵
      PID:3964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30107.exe
      4⤵
      PID:4228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39194.exe
      4⤵
      PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61897.exe
      4⤵
      PID:5980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5962.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5962.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57752.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
        5⤵
        
        PID:2432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6983.exe
        5⤵
        
        PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
        5⤵
        
        PID:5084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39333.exe
        5⤵
        
        PID:5148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57266.exe
      4⤵
      PID:1972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29483.exe
      4⤵
      PID:3764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32737.exe
      4⤵
      PID:4848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30479.exe
      4⤵
      PID:5464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54389.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54389.exe
    3⤵
    PID:1188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15456.exe
      4⤵
      PID:3564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24522.exe
      4⤵
      PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59298.exe
      4⤵
      PID:4576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4473.exe
      4⤵
      PID:6012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14335.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14335.exe
    3⤵
    PID:1376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10148.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10148.exe
    3⤵
    PID:3524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65530.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65530.exe
    3⤵
    PID:4712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9479.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9479.exe
    3⤵
    PID:5568
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9003.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9003.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1967.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1967.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10748.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63725.exe
        5⤵
        
        PID:2296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35435.exe
        6⤵
        
        PID:2552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15748.exe
        6⤵
        
        PID:3856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1132.exe
        6⤵
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39145.exe
        6⤵
        
        PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20203.exe
        5⤵
        
        PID:2644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29483.exe
        5⤵
        
        PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39047.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30479.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19184.exe
      4⤵
      PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58082.exe
        5⤵
        
        PID:5544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15191.exe
      4⤵
      PID:3504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35457.exe
      4⤵
      PID:3200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39962.exe
      4⤵
      PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61897.exe
      4⤵
      PID:5908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56996.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56996.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27286.exe
      4⤵
      PID:2140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29812.exe
        5⤵
        
        PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60878.exe
        5⤵
        
        PID:4324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21589.exe
      4⤵
      PID:2692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6983.exe
      4⤵
      PID:3084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
      4⤵
      PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6852.exe
      4⤵
      PID:5296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39380.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39380.exe
    3⤵
    PID:2784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35243.exe
      4⤵
      PID:2448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15748.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50011.exe
      4⤵
      PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17387.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61843.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61843.exe
    3⤵
    PID:2836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4713.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4713.exe
    3⤵
    PID:2072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45725.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45725.exe
    3⤵
    PID:4984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12997.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12997.exe
    3⤵
    PID:5164
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30582.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30582.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27604.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27604.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
      4⤵
      PID:2616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62494.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14442.exe
        6⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19172.exe
        6⤵
        
        PID:4256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58530.exe
        6⤵
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4495.exe
        6⤵
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29483.exe
        5⤵
        
        PID:3696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55876.exe
        5⤵
        
        PID:4668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30479.exe
        5⤵
        
        PID:5584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24045.exe
      4⤵
      PID:996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6034.exe
      4⤵
      PID:3948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20881.exe
      4⤵
      PID:4496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63726.exe
      4⤵
      PID:2056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52241.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52241.exe
    3⤵
    PID:2368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6676.exe
      4⤵
      PID:356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55791.exe
      4⤵
      PID:5052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26053.exe
      4⤵
      PID:5264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35325.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35325.exe
    3⤵
    PID:2848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40259.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40259.exe
    3⤵
    PID:2208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1189.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1189.exe
    3⤵
    PID:5076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13944.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13944.exe
    3⤵
    PID:5660
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5978.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5978.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41473.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41473.exe
    3⤵
    PID:2248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16152.exe
      4⤵
      PID:3104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62384.exe
      4⤵
      PID:3188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3989.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15517.exe
      4⤵
      PID:5352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17131.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17131.exe
    3⤵
    PID:2408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24276.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24276.exe
    3⤵
    PID:3944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23346.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23346.exe
    3⤵
    PID:4300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61897.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61897.exe
    3⤵
    PID:6016
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20758.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20758.exe
  2⤵
  PID:2952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41310.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41310.exe
    3⤵
    PID:2584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35349.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35349.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55208.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55208.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22797.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22797.exe
    3⤵
    PID:5216
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30362.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30362.exe
  2⤵
  PID:1856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12351.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12351.exe
    3⤵
    PID:3244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23681.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23681.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7930.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7930.exe
    3⤵
    PID:1828
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46422.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46422.exe
  2⤵
  PID:1728
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47584.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47584.exe
  2⤵
  PID:3992
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16855.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16855.exe
  2⤵
  PID:4976
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60233.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60233.exe
  2⤵
  PID:5172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-27001.exe

Filesize
468KB

MD5
719a8e80dabfb845d827c3522dc984c6

SHA1
e9ea34ad17cb8237fdef8d9cddc766213403dee7

SHA256
53b955a7604083f1cee7b2ec84d20129d409b9e5334063eacdf4d26ea65db1ea

SHA512
48d09b8a77196b6d872adf3508aa01aa6971686dab6d06dcb53581a6bfe5feba5efa5abfdad58ecf6d1dd82ca0338c2ba7a6d7ec230b30569e042e0e5f2cc4de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30156.exe

Filesize
468KB

MD5
63e765f2344fe3091c9bd84d70f00873

SHA1
892daa89399baa56174914bcbabc48efd9aef4da

SHA256
4289daf461333895f7dc95e44f52597bc132cb964c81902e4d9dffb1168094f1

SHA512
5f296c4ae572e64b76214753833d95dc1dd68d89af96cb1d762e58c087902b29baeeffe8a9dfa608ba169e0af4793edbc843295d7b570e8232ecdf500f69a76a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36752.exe

Filesize
468KB

MD5
211e1beed433377bc827edf7c707588f

SHA1
5b4d1f36e9cee47e7703df00f41f0dd1e6f85017

SHA256
241161dad96a75ac7861aa6c1e1af85ec33f15515ca9b02964f883ad921beb3e

SHA512
0cf9c326c123af121ab1c2f3439d2a556d92982b689b5310487604374eb34fb71b9ccfbe0a6a8a562dd607738374d328cdb02bfd62985a1702674c65a17b1718

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55708.exe

Filesize
468KB

MD5
2052b154b69114922f7679292e90ea7c

SHA1
0f494a3de2bf4ec9b301a5e1cbccc10093281188

SHA256
bee1ad78b02c80b9d3b5c4a3413ed4c74152927c5c93efa128c579e20a6d9e9a

SHA512
1575b09a260503060bc8efb9c8d6f3e175fff9ef2b249e60575e9aedfddd599a6db2c93a893e3e3b85492938f2a1c1fb7d4036c50645d7437d14447e11828ce3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5959.exe

Filesize
468KB

MD5
ed180501ed594193026e0bec0bef5461

SHA1
4497c856181e2843799824e4e3c4247b42caa30d

SHA256
9bd5235f48247c1f13771f84564a7ec3b7243b07c9030603dc6ddc034cc64f7f

SHA512
669fcba2ac2f9514983e1631c8bf30ff3de1e876b0d164902e0b802d1976805de22469d13f824448c37ede42a685b270226ff15c1ee48459c52d2e59dfd9782f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63062.exe

Filesize
468KB

MD5
dfe4255a2bf4d27df2c264caacd47cce

SHA1
c0a674ddaff923e60f16b1d9db6c2c71d5c6691c

SHA256
3bfe6bee7cbeab5d9cd0e58b6b6293594fe7512f02d68888bf7286a3ddc6d841

SHA512
4f5f08b3c2adf3c185b1fd625d5fcea884fa9d385bb964b1b0bd50b57b241011aae5375bf0ae29b5349f5cebe2ebfc0ef6a3e389fbd51b338849f3fe4887b64b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-681.exe

Filesize
468KB

MD5
53fd73b8e9a564d5ca2364c72da65875

SHA1
4c332b3e339b484a87703e99499c25598a9aa6c2

SHA256
fe72853f07b9fb91c4a351f0b52a48dee159f912eda5cad236308fac217f7cfa

SHA512
4f9db0a04340449a5e3c54696af9bec0c7d1fb124730d17a04b14db92fca5a0196bbc9464ae307291174219a7371f6714a0784e4681b0fab01a615b213592fc5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14639.exe

Filesize
468KB

MD5
8216ae20cc3b7e4a33edc78f98dd2e8b

SHA1
6b97d2aed4b2aa8c4d8c3b9e7cdab87ccee499fd

SHA256
5eaf547ac016d8d447a7f7f3789f54d9ec97dbdf52bdd16c6814022c87006932

SHA512
56d928f0dd0b424d0a55f487d519837b383f7dfb7698050dd71d38c5fd66dc1ad04f0d2972e5fb1fb224b074345347ba9bde6de82f4a96461fae61214cc2f584

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1709.exe

Filesize
468KB

MD5
92746303cb860402409387434cb1cea3

SHA1
f5d282667a11b640f517641f030e60263d1678cc

SHA256
6f16ce1ad169fd57685447bbd45275ccd32a7400d410e594c1a953d29621b84a

SHA512
dff402f3c53438638669b377557a64d337fe2d6f80edd038cbfd56ff4a392a0079b8d6d92e93130dc3653adbcb3d593d2b32faaea813d2ef6adcf9c962c22099

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27575.exe

Filesize
468KB

MD5
82b7602f79b5c3cfe78fc02af9c1039d

SHA1
2bf2fc1a5523fb375ff307f4373a66207f79cca8

SHA256
2eaa5aa88cedc2449412973bc9798a9f6ec7455ba68fd3240d6751c3989c04a4

SHA512
4c4da39c519c44c88b61939e275804ff2c1593e23c75739003be594f80f4e842a241dc7fefb85589619a83533c88052e0d2640da78ece4f6b1582c5df9b81605

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40751.exe

Filesize
468KB

MD5
4b2dbd0ca0c390c46ed3c679926b34d8

SHA1
681fae3c762bb37b55b7bcbec070daac7b9491ec

SHA256
6593ecc99a4113b4ae159768f713d66c532056f7ccac8cb8d67d91ed51475990

SHA512
12a7264299b0234c9689dba0117d9848172c3ba2bf57a384c3e5fb7e7aaeba8f1a7c2a4ebedf2a5aa39e6408e8e63ce0ee3784d97f409d74bc4a4e19387b1ef1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42517.exe

Filesize
468KB

MD5
50bfcf36a2c8033c04170e9a2e1ad32e

SHA1
dd5a7064fdf314c2c263593d34af477776109195

SHA256
25a7ddaf9d333fd4d3696b5af11d1a12bacbfe9b9d40e82e9e6c57973fff8655

SHA512
b3f2da7193330392f618a39bbc076eb99cc5b03d58bdd4c1daa332330bc16223442b3c7d59b9b8c73fb05f4720f6eac27ed5417807cb496fe5aead7d1ef06188

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46321.exe

Filesize
468KB

MD5
823f8f3165e91c522a2d9fd01a61293c

SHA1
793066828b4f05b6d559fa87d6bb0c384cf8f36a

SHA256
e63534a24cf354c4939746a2278acf79908c5b459dfd3839ca518fa10fa4f25b

SHA512
d867b343b15d3fbc90d589744daf467e13a713f08358c095a68784d69f46df08c3cfc58be3cd4b3f94f6342ed87b3ca9e5cb80f4734525eb099454d60be86c72

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49327.exe

Filesize
468KB

MD5
c2c289d1163cce971cfac8a7cbd40e69

SHA1
cf8838c111ba6f11d8e29585fd3a1615ee13cd68

SHA256
5c426b4b7a2135529f232a6c0073f9e03a3f9d36d663db4b5123dddce81b5f4f

SHA512
fff8b75ebac1769a34e89c686ed7def2ddafb97d5bf90b5658044f02611b72ad06fa63a746d5fa489e1b5a423340edce9b185d98894ffa04b7f864dcc5329a3b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63404.exe

Filesize
468KB

MD5
643b8a6dcc70cd8903ca3724a7f2c8c2

SHA1
f8f1f34a76fbbda299a7ba2290f1fa1552e29f4c

SHA256
c1369535eb054a39414239aae86c491a79d59ebcae76da88b00d117e87abe0ff

SHA512
b760a1e17996576374a58695fb8e9b4eadb2f9f23a06a6b15f47513ac554afffc856d83010b8ffae6f209ff3328eaf5a25ef80d1928360c5320866ca6a221046

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-7196.exe

Filesize
468KB

MD5
993d7f418e08f9c4c082c6f74d8b36d9

SHA1
dd1ca5d266e673343e85ff7c5b2dc2e6305682c0

SHA256
e09cb36cbae181582e29d604551c3337834bc6441d90388a3efa3459a8cd0f93

SHA512
afee2496fd83608c5fd14f94e35c288b2c667fa25cbdf169aa108a08830e56456eb8623276255c3284536151d813351148f06b406a969dc40fe55ce099dffedc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9003.exe

Filesize
468KB

MD5
abd1f37315d1b03ac006ad2f67f7bfa0

SHA1
51cd0355415a5201bbcc1fc07daae11445285d25

SHA256
635dc35cb300dd476365fed89f29d7d6557656033985f3c4a0d6525fb98c73cd

SHA512
b6b0f5ce19d8486796af6372574a5d1b484423e8fc2f286475d5254323f79dfc46aa9a820677bd76228f5824d1842f3223dfff37b361013d7a7f9fa6b2a48225

Download Submit