8e29ed7fd1c851ab9fb34ea7b34edd6b78e7c14a9f83f549a61aeaa1d8e1d5ab

Analysis

max time kernel
150s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 00:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8e29ed7fd1c851ab9fb34ea7b34edd6b78e7c14a9f83f549a61aeaa1d8e1d5ab.exe
Size

468KB
MD5

8332452da4b38dd3500ef200f2bc30e0
SHA1

918a9fb5d8ecd07ae64593fdce21dbf656dcf681
SHA256

8e29ed7fd1c851ab9fb34ea7b34edd6b78e7c14a9f83f549a61aeaa1d8e1d5ab
SHA512

f361a53b35f75bda10ae6e39836b764e888639c98a7cd75f0a562bc5c40536223c49d02de31284285fdece7ecf74fb84df5ac8d1fe27a18606ca75b56013e954
SSDEEP

3072:4belogxaIU57tbYZPzcfmbfD/n2DnsIHKQmyeQVqAZ5Kkki3uCult:4b4oCc7tCP4fmbfraswZ5D73uC

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2096	Unicorn-18473.exe
2632	Unicorn-29556.exe
2152	Unicorn-48341.exe
2756	Unicorn-59673.exe
2684	Unicorn-14001.exe
2312	Unicorn-13041.exe
2696	Unicorn-59620.exe
3036	Unicorn-47456.exe
2884	Unicorn-58504.exe
2344	Unicorn-61348.exe
1760	Unicorn-558.exe
2844	Unicorn-41307.exe
540	Unicorn-59023.exe
3012	Unicorn-59288.exe
2592	Unicorn-12225.exe
2956	Unicorn-48835.exe
1956	Unicorn-51367.exe
2188	Unicorn-40527.exe
2180	Unicorn-21237.exe
2076	Unicorn-23397.exe
2436	Unicorn-25839.exe
2044	Unicorn-14180.exe
752	Unicorn-999.exe
756	Unicorn-16411.exe
1984	Unicorn-11092.exe
1132	Unicorn-54196.exe
1672	Unicorn-8861.exe
2036	Unicorn-28727.exe
1488	Unicorn-32650.exe
2456	Unicorn-7194.exe
2296	Unicorn-44462.exe
1740	Unicorn-17695.exe
2032	Unicorn-3047.exe
1564	Unicorn-32669.exe
1044	Unicorn-16716.exe
2216	Unicorn-36582.exe
2068	Unicorn-36582.exe
2716	Unicorn-33523.exe
2768	Unicorn-32563.exe
2760	Unicorn-47215.exe
2548	Unicorn-47791.exe
2812	Unicorn-20293.exe
1624	Unicorn-427.exe
2596	Unicorn-38575.exe
3032	Unicorn-967.exe
2504	Unicorn-14434.exe
2264	Unicorn-24817.exe
2400	Unicorn-29701.exe
2836	Unicorn-35429.exe
568	Unicorn-11600.exe
3016	Unicorn-46743.exe
3028	Unicorn-1071.exe
1312	Unicorn-62719.exe
1948	Unicorn-60690.exe
2880	Unicorn-56589.exe
1952	Unicorn-37253.exe
1248	Unicorn-42853.exe
2064	Unicorn-913.exe
824	Unicorn-36020.exe
1752	Unicorn-9293.exe
2156	Unicorn-15423.exe
1076	Unicorn-48802.exe
1480	Unicorn-53291.exe
2276	Unicorn-2507.exe

Loads dropped DLL 64 IoCs

pid	Process
2108	8e29ed7fd1c851ab9fb34ea7b34edd6b78e7c14a9f83f549a61aeaa1d8e1d5ab.exe
2108	8e29ed7fd1c851ab9fb34ea7b34edd6b78e7c14a9f83f549a61aeaa1d8e1d5ab.exe
2108	8e29ed7fd1c851ab9fb34ea7b34edd6b78e7c14a9f83f549a61aeaa1d8e1d5ab.exe
2096	Unicorn-18473.exe
2108	8e29ed7fd1c851ab9fb34ea7b34edd6b78e7c14a9f83f549a61aeaa1d8e1d5ab.exe
2096	Unicorn-18473.exe
2632	Unicorn-29556.exe
2096	Unicorn-18473.exe
2096	Unicorn-18473.exe
2152	Unicorn-48341.exe
2152	Unicorn-48341.exe
2632	Unicorn-29556.exe
2108	8e29ed7fd1c851ab9fb34ea7b34edd6b78e7c14a9f83f549a61aeaa1d8e1d5ab.exe
2108	8e29ed7fd1c851ab9fb34ea7b34edd6b78e7c14a9f83f549a61aeaa1d8e1d5ab.exe
2684	Unicorn-14001.exe
2684	Unicorn-14001.exe
2152	Unicorn-48341.exe
2152	Unicorn-48341.exe
2756	Unicorn-59673.exe
2756	Unicorn-59673.exe
2096	Unicorn-18473.exe
2096	Unicorn-18473.exe
2696	Unicorn-59620.exe
2696	Unicorn-59620.exe
2312	Unicorn-13041.exe
2632	Unicorn-29556.exe
2632	Unicorn-29556.exe
2108	8e29ed7fd1c851ab9fb34ea7b34edd6b78e7c14a9f83f549a61aeaa1d8e1d5ab.exe
2108	8e29ed7fd1c851ab9fb34ea7b34edd6b78e7c14a9f83f549a61aeaa1d8e1d5ab.exe
2312	Unicorn-13041.exe
3036	Unicorn-47456.exe
2684	Unicorn-14001.exe
3036	Unicorn-47456.exe
2684	Unicorn-14001.exe
2344	Unicorn-61348.exe
2344	Unicorn-61348.exe
2756	Unicorn-59673.exe
2756	Unicorn-59673.exe
2884	Unicorn-58504.exe
2884	Unicorn-58504.exe
2152	Unicorn-48341.exe
2152	Unicorn-48341.exe
1760	Unicorn-558.exe
1760	Unicorn-558.exe
2844	Unicorn-41307.exe
2844	Unicorn-41307.exe
2096	Unicorn-18473.exe
2096	Unicorn-18473.exe
2696	Unicorn-59620.exe
2696	Unicorn-59620.exe
3012	Unicorn-59288.exe
3012	Unicorn-59288.exe
2312	Unicorn-13041.exe
2592	Unicorn-12225.exe
2312	Unicorn-13041.exe
2592	Unicorn-12225.exe
540	Unicorn-59023.exe
540	Unicorn-59023.exe
2632	Unicorn-29556.exe
2632	Unicorn-29556.exe
2108	8e29ed7fd1c851ab9fb34ea7b34edd6b78e7c14a9f83f549a61aeaa1d8e1d5ab.exe
2108	8e29ed7fd1c851ab9fb34ea7b34edd6b78e7c14a9f83f549a61aeaa1d8e1d5ab.exe
2956	Unicorn-48835.exe
2956	Unicorn-48835.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1936	2836	WerFault.exe	78

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16411.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8052.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37253.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20595.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45546.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29701.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47846.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1312.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10766.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36313.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11092.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6065.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26733.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4972.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41081.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59911.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21237.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18500.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44038.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49327.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62612.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62612.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1846.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9122.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49327.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62871.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49736.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22212.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24623.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39450.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1312.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32650.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63661.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35854.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36776.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64882.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47215.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57907.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10007.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18598.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32791.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1312.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11112.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38575.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14488.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56322.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34753.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19191.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10530.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24645.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8861.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57054.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40956.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13157.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48849.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-558.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10852.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14001.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18968.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2108	8e29ed7fd1c851ab9fb34ea7b34edd6b78e7c14a9f83f549a61aeaa1d8e1d5ab.exe
2096	Unicorn-18473.exe
2152	Unicorn-48341.exe
2632	Unicorn-29556.exe
2684	Unicorn-14001.exe
2756	Unicorn-59673.exe
2696	Unicorn-59620.exe
2312	Unicorn-13041.exe
3036	Unicorn-47456.exe
2344	Unicorn-61348.exe
2884	Unicorn-58504.exe
1760	Unicorn-558.exe
2844	Unicorn-41307.exe
3012	Unicorn-59288.exe
2592	Unicorn-12225.exe
540	Unicorn-59023.exe
2956	Unicorn-48835.exe
1956	Unicorn-51367.exe
2180	Unicorn-21237.exe
2188	Unicorn-40527.exe
2076	Unicorn-23397.exe
2436	Unicorn-25839.exe
752	Unicorn-999.exe
2044	Unicorn-14180.exe
1984	Unicorn-11092.exe
756	Unicorn-16411.exe
1132	Unicorn-54196.exe
2036	Unicorn-28727.exe
1488	Unicorn-32650.exe
2456	Unicorn-7194.exe
2296	Unicorn-44462.exe
1672	Unicorn-8861.exe
1740	Unicorn-17695.exe
2032	Unicorn-3047.exe
1564	Unicorn-32669.exe
2216	Unicorn-36582.exe
2068	Unicorn-36582.exe
1044	Unicorn-16716.exe
2716	Unicorn-33523.exe
2768	Unicorn-32563.exe
2760	Unicorn-47215.exe
1624	Unicorn-427.exe
2548	Unicorn-47791.exe
2812	Unicorn-20293.exe
2596	Unicorn-38575.exe
3032	Unicorn-967.exe
2504	Unicorn-14434.exe
2264	Unicorn-24817.exe
2400	Unicorn-29701.exe
2836	Unicorn-35429.exe
568	Unicorn-11600.exe
3016	Unicorn-46743.exe
3028	Unicorn-1071.exe
1948	Unicorn-60690.exe
2880	Unicorn-56589.exe
1248	Unicorn-42853.exe
1952	Unicorn-37253.exe
1312	Unicorn-62719.exe
824	Unicorn-36020.exe
2156	Unicorn-15423.exe
1752	Unicorn-9293.exe
1076	Unicorn-48802.exe
2064	Unicorn-913.exe
1480	Unicorn-53291.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2096	2108	8e29ed7fd1c851ab9fb34ea7b34edd6b78e7c14a9f83f549a61aeaa1d8e1d5ab.exe	30
PID 2108 wrote to memory of 2096	2108	8e29ed7fd1c851ab9fb34ea7b34edd6b78e7c14a9f83f549a61aeaa1d8e1d5ab.exe	30
PID 2108 wrote to memory of 2096	2108	8e29ed7fd1c851ab9fb34ea7b34edd6b78e7c14a9f83f549a61aeaa1d8e1d5ab.exe	30
PID 2108 wrote to memory of 2096	2108	8e29ed7fd1c851ab9fb34ea7b34edd6b78e7c14a9f83f549a61aeaa1d8e1d5ab.exe	30
PID 2108 wrote to memory of 2152	2108	8e29ed7fd1c851ab9fb34ea7b34edd6b78e7c14a9f83f549a61aeaa1d8e1d5ab.exe	31
PID 2108 wrote to memory of 2152	2108	8e29ed7fd1c851ab9fb34ea7b34edd6b78e7c14a9f83f549a61aeaa1d8e1d5ab.exe	31
PID 2108 wrote to memory of 2152	2108	8e29ed7fd1c851ab9fb34ea7b34edd6b78e7c14a9f83f549a61aeaa1d8e1d5ab.exe	31
PID 2108 wrote to memory of 2152	2108	8e29ed7fd1c851ab9fb34ea7b34edd6b78e7c14a9f83f549a61aeaa1d8e1d5ab.exe	31
PID 2096 wrote to memory of 2632	2096	Unicorn-18473.exe	32
PID 2096 wrote to memory of 2632	2096	Unicorn-18473.exe	32
PID 2096 wrote to memory of 2632	2096	Unicorn-18473.exe	32
PID 2096 wrote to memory of 2632	2096	Unicorn-18473.exe	32
PID 2096 wrote to memory of 2756	2096	Unicorn-18473.exe	34
PID 2096 wrote to memory of 2756	2096	Unicorn-18473.exe	34
PID 2096 wrote to memory of 2756	2096	Unicorn-18473.exe	34
PID 2096 wrote to memory of 2756	2096	Unicorn-18473.exe	34
PID 2152 wrote to memory of 2684	2152	Unicorn-48341.exe	35
PID 2152 wrote to memory of 2684	2152	Unicorn-48341.exe	35
PID 2152 wrote to memory of 2684	2152	Unicorn-48341.exe	35
PID 2152 wrote to memory of 2684	2152	Unicorn-48341.exe	35
PID 2632 wrote to memory of 2312	2632	Unicorn-29556.exe	33
PID 2632 wrote to memory of 2312	2632	Unicorn-29556.exe	33
PID 2632 wrote to memory of 2312	2632	Unicorn-29556.exe	33
PID 2632 wrote to memory of 2312	2632	Unicorn-29556.exe	33
PID 2108 wrote to memory of 2696	2108	8e29ed7fd1c851ab9fb34ea7b34edd6b78e7c14a9f83f549a61aeaa1d8e1d5ab.exe	36
PID 2108 wrote to memory of 2696	2108	8e29ed7fd1c851ab9fb34ea7b34edd6b78e7c14a9f83f549a61aeaa1d8e1d5ab.exe	36
PID 2108 wrote to memory of 2696	2108	8e29ed7fd1c851ab9fb34ea7b34edd6b78e7c14a9f83f549a61aeaa1d8e1d5ab.exe	36
PID 2108 wrote to memory of 2696	2108	8e29ed7fd1c851ab9fb34ea7b34edd6b78e7c14a9f83f549a61aeaa1d8e1d5ab.exe	36
PID 2684 wrote to memory of 3036	2684	Unicorn-14001.exe	37
PID 2684 wrote to memory of 3036	2684	Unicorn-14001.exe	37
PID 2684 wrote to memory of 3036	2684	Unicorn-14001.exe	37
PID 2684 wrote to memory of 3036	2684	Unicorn-14001.exe	37
PID 2152 wrote to memory of 2884	2152	Unicorn-48341.exe	38
PID 2152 wrote to memory of 2884	2152	Unicorn-48341.exe	38
PID 2152 wrote to memory of 2884	2152	Unicorn-48341.exe	38
PID 2152 wrote to memory of 2884	2152	Unicorn-48341.exe	38
PID 2756 wrote to memory of 2344	2756	Unicorn-59673.exe	39
PID 2756 wrote to memory of 2344	2756	Unicorn-59673.exe	39
PID 2756 wrote to memory of 2344	2756	Unicorn-59673.exe	39
PID 2756 wrote to memory of 2344	2756	Unicorn-59673.exe	39
PID 2096 wrote to memory of 1760	2096	Unicorn-18473.exe	40
PID 2096 wrote to memory of 1760	2096	Unicorn-18473.exe	40
PID 2096 wrote to memory of 1760	2096	Unicorn-18473.exe	40
PID 2096 wrote to memory of 1760	2096	Unicorn-18473.exe	40
PID 2696 wrote to memory of 2844	2696	Unicorn-59620.exe	41
PID 2696 wrote to memory of 2844	2696	Unicorn-59620.exe	41
PID 2696 wrote to memory of 2844	2696	Unicorn-59620.exe	41
PID 2696 wrote to memory of 2844	2696	Unicorn-59620.exe	41
PID 2632 wrote to memory of 2592	2632	Unicorn-29556.exe	43
PID 2632 wrote to memory of 2592	2632	Unicorn-29556.exe	43
PID 2632 wrote to memory of 2592	2632	Unicorn-29556.exe	43
PID 2632 wrote to memory of 2592	2632	Unicorn-29556.exe	43
PID 2108 wrote to memory of 540	2108	8e29ed7fd1c851ab9fb34ea7b34edd6b78e7c14a9f83f549a61aeaa1d8e1d5ab.exe	44
PID 2108 wrote to memory of 540	2108	8e29ed7fd1c851ab9fb34ea7b34edd6b78e7c14a9f83f549a61aeaa1d8e1d5ab.exe	44
PID 2108 wrote to memory of 540	2108	8e29ed7fd1c851ab9fb34ea7b34edd6b78e7c14a9f83f549a61aeaa1d8e1d5ab.exe	44
PID 2108 wrote to memory of 540	2108	8e29ed7fd1c851ab9fb34ea7b34edd6b78e7c14a9f83f549a61aeaa1d8e1d5ab.exe	44
PID 2312 wrote to memory of 3012	2312	Unicorn-13041.exe	42
PID 2312 wrote to memory of 3012	2312	Unicorn-13041.exe	42
PID 2312 wrote to memory of 3012	2312	Unicorn-13041.exe	42
PID 2312 wrote to memory of 3012	2312	Unicorn-13041.exe	42
PID 3036 wrote to memory of 2956	3036	Unicorn-47456.exe	45
PID 3036 wrote to memory of 2956	3036	Unicorn-47456.exe	45
PID 3036 wrote to memory of 2956	3036	Unicorn-47456.exe	45
PID 3036 wrote to memory of 2956	3036	Unicorn-47456.exe	45

C:\Users\Admin\AppData\Local\Temp\8e29ed7fd1c851ab9fb34ea7b34edd6b78e7c14a9f83f549a61aeaa1d8e1d5ab.exe
"C:\Users\Admin\AppData\Local\Temp\8e29ed7fd1c851ab9fb34ea7b34edd6b78e7c14a9f83f549a61aeaa1d8e1d5ab.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18473.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18473.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29556.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29556.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13041.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59288.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54196.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53291.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5706.exe
        8⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20972.exe
        8⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64882.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36313.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52180.exe
        7⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4142.exe
        7⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
        7⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24939.exe
        7⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16892.exe
        7⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43300.exe
        7⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27805.exe
        6⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20595.exe
        7⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33520.exe
        7⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16467.exe
        7⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
        7⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13157.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60788.exe
        7⤵
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28178.exe
        7⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-951.exe
        6⤵
        
        PID:2888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7311.exe
        6⤵
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30216.exe
        6⤵
        
        PID:3612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57054.exe
        6⤵
        
        PID:3088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32821.exe
        6⤵
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41081.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49059.exe
        6⤵
        
        PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8861.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62719.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22827.exe
        7⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36520.exe
        7⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15817.exe
        7⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19392.exe
        6⤵
        
        PID:876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22904.exe
        6⤵
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7322.exe
        6⤵
        
        PID:3584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49327.exe
        6⤵
        
        PID:2392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8329.exe
        6⤵
        
        PID:4156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62871.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52218.exe
        6⤵
        
        PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56589.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49736.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2820.exe
        6⤵
        
        PID:2092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10852.exe
        6⤵
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4644.exe
        6⤵
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35564.exe
        6⤵
        
        PID:4776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39216.exe
        6⤵
        
        PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50970.exe
        5⤵
        
        PID:2240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17992.exe
        5⤵
        
        PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56351.exe
        5⤵
        
        PID:3460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49857.exe
        5⤵
        
        PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28443.exe
        5⤵
        
        PID:4116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59764.exe
        5⤵
        
        PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32795.exe
        5⤵
        
        PID:5460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12225.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28727.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34753.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7611.exe
        6⤵
        
        PID:2532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60463.exe
        6⤵
        
        PID:3260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
        6⤵
        
        PID:3432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52436.exe
        6⤵
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60788.exe
        6⤵
        
        PID:4476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28178.exe
        6⤵
        
        PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42697.exe
        5⤵
        
        PID:2636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36744.exe
        5⤵
        
        PID:2520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10007.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10530.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20411.exe
        5⤵
        
        PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56322.exe
        5⤵
        
        PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1312.exe
        5⤵
        
        PID:5128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7194.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60690.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31369.exe
        5⤵
        
        PID:1136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8623.exe
        5⤵
        
        PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16014.exe
        5⤵
        
        PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1789.exe
        5⤵
        
        PID:3564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25040.exe
        5⤵
        
        PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47769.exe
        5⤵
        
        PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55342.exe
        5⤵
        
        PID:5972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-913.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24623.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40204.exe
        5⤵
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49312.exe
        5⤵
        
        PID:5640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10411.exe
      4⤵
      PID:1384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30826.exe
      4⤵
      PID:3192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
      4⤵
      PID:3216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42208.exe
      4⤵
      PID:4320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36182.exe
      4⤵
      PID:4700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59673.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59673.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61348.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40527.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2507.exe
        6⤵
        Executes dropped EXE
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18053.exe
        7⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65128.exe
        7⤵
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23859.exe
        7⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2096.exe
        7⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11786.exe
        7⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11112.exe
        7⤵
        
        PID:4656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-378.exe
        6⤵
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-791.exe
        6⤵
        
        PID:3272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8052.exe
        6⤵
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19887.exe
        6⤵
        
        PID:4952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56322.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1312.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42853.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44011.exe
        6⤵
        
        PID:936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18705.exe
        6⤵
        
        PID:3656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10852.exe
        6⤵
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6337.exe
        6⤵
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62082.exe
        6⤵
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58860.exe
        6⤵
        
        PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45105.exe
        5⤵
        
        PID:2704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14488.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7349.exe
        5⤵
        
        PID:3484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32791.exe
        5⤵
        
        PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33778.exe
        5⤵
        
        PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55563.exe
        5⤵
        
        PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42165.exe
        5⤵
        
        PID:5568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21237.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36582.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20595.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53248.exe
        6⤵
        
        PID:1648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22212.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
        6⤵
        
        PID:3284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32290.exe
        6⤵
        
        PID:4292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60788.exe
        6⤵
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28178.exe
        6⤵
        
        PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51532.exe
        5⤵
        
        PID:2016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58478.exe
        6⤵
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7421.exe
        6⤵
        
        PID:3832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21109.exe
        6⤵
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57534.exe
        6⤵
        
        PID:5140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16141.exe
        6⤵
        
        PID:5920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11922.exe
        5⤵
        
        PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19191.exe
        5⤵
        
        PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10236.exe
        5⤵
        
        PID:4032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59255.exe
        5⤵
        
        PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54840.exe
        5⤵
        
        PID:5252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29416.exe
        5⤵
        
        PID:5784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32563.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41980.exe
        5⤵
        
        PID:3000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12109.exe
        6⤵
        
        PID:2916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
        6⤵
        
        PID:1460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21703.exe
        6⤵
        
        PID:3548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
        6⤵
        
        PID:3332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13157.exe
        6⤵
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45546.exe
        6⤵
        
        PID:4176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23517.exe
        6⤵
        
        PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63157.exe
        5⤵
        
        PID:840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55107.exe
        5⤵
        
        PID:2164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10108.exe
        5⤵
        
        PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49857.exe
        5⤵
        
        PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20474.exe
        5⤵
        
        PID:4188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42434.exe
        5⤵
        
        PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34192.exe
        5⤵
        
        PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36020.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38342.exe
        5⤵
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59144.exe
        5⤵
        
        PID:4600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30447.exe
        5⤵
        
        PID:4868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10411.exe
      4⤵
      PID:1964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44038.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6065.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34744.exe
      4⤵
      PID:4664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41275.exe
      4⤵
      PID:4748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49048.exe
      4⤵
      PID:5580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-558.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-558.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14180.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32669.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44011.exe
        6⤵
        
        PID:2252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45031.exe
        6⤵
        
        PID:3440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10852.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58937.exe
        6⤵
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48849.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54528.exe
        6⤵
        
        PID:5992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51532.exe
        5⤵
        
        PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11922.exe
        5⤵
        
        PID:2872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19191.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15526.exe
        5⤵
        
        PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19887.exe
        5⤵
        
        PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56322.exe
        5⤵
        
        PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1312.exe
        5⤵
        
        PID:4916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16716.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47965.exe
        5⤵
        
        PID:2628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7611.exe
        5⤵
        
        PID:2652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12523.exe
        5⤵
        
        PID:3396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
        5⤵
        
        PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25463.exe
        5⤵
        
        PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62612.exe
        5⤵
        
        PID:3676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6647.exe
        5⤵
        
        PID:6128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56433.exe
      4⤵
      PID:2588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33969.exe
      4⤵
      PID:2484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14331.exe
      4⤵
      PID:1528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57054.exe
      4⤵
      PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63739.exe
      4⤵
      PID:4256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41081.exe
      4⤵
      PID:4996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1312.exe
      4⤵
      PID:6104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16411.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16411.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47791.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7081.exe
        5⤵
        
        PID:1316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53248.exe
        5⤵
        
        PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32440.exe
        5⤵
        
        PID:3644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
        5⤵
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13157.exe
        5⤵
        
        PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45546.exe
        5⤵
        
        PID:4284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28178.exe
        5⤵
        
        PID:6072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1217.exe
      4⤵
      PID:560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11922.exe
      4⤵
      PID:1080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19191.exe
      4⤵
      PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10236.exe
      4⤵
      PID:4044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55370.exe
      4⤵
      PID:4836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12316.exe
      4⤵
      PID:4472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6647.exe
      4⤵
      PID:2452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14434.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14434.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60461.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60461.exe
    3⤵
    PID:2528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20634.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20634.exe
    3⤵
    PID:2052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65363.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65363.exe
    3⤵
    PID:3712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22991.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22991.exe
    3⤵
    PID:3628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44689.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44689.exe
    3⤵
    PID:4332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18899.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18899.exe
    3⤵
    PID:5052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53217.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53217.exe
    3⤵
    PID:5692
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48341.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48341.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14001.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14001.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47456.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48835.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17695.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42874.exe
        7⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55944.exe
        7⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10852.exe
        7⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40956.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11786.exe
        7⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11112.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1217.exe
        6⤵
        
        PID:2572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11922.exe
        6⤵
        
        PID:916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19191.exe
        6⤵
        
        PID:3980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10236.exe
        6⤵
        
        PID:3236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42432.exe
        6⤵
        
        PID:4792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12316.exe
        6⤵
        
        PID:4308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6647.exe
        6⤵
        
        PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3047.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15423.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21786.exe
        7⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18598.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64882.exe
        7⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36313.exe
        7⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64437.exe
        6⤵
        
        PID:1584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19191.exe
        6⤵
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10236.exe
        6⤵
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44544.exe
        6⤵
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62612.exe
        6⤵
        
        PID:4140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54394.exe
        6⤵
        
        PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9293.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24272.exe
        6⤵
        
        PID:4660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14802.exe
        6⤵
        
        PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18500.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34912.exe
        5⤵
        
        PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57054.exe
        5⤵
        
        PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63739.exe
        5⤵
        
        PID:4236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24645.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42165.exe
        5⤵
        
        PID:5556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51367.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38575.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64711.exe
        6⤵
        
        PID:2764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37569.exe
        6⤵
        
        PID:2580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26643.exe
        6⤵
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32791.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42005.exe
        6⤵
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60898.exe
        6⤵
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56330.exe
        6⤵
        
        PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25484.exe
        5⤵
        
        PID:2688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42577.exe
        5⤵
        
        PID:2816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18388.exe
        5⤵
        
        PID:3380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8052.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46673.exe
        5⤵
        
        PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62612.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6647.exe
        5⤵
        
        PID:6120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35429.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2836
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 220
        5⤵
        Program crash
        
        PID:1936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55163.exe
      4⤵
      PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55107.exe
      4⤵
      PID:2136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56351.exe
      4⤵
      PID:3524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49857.exe
      4⤵
      PID:3788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20474.exe
      4⤵
      PID:4196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46218.exe
      4⤵
      PID:5712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58504.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58504.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23397.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47215.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43973.exe
        6⤵
        
        PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58256.exe
        5⤵
        
        PID:2556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40694.exe
        5⤵
        
        PID:1320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24308.exe
        5⤵
        
        PID:2272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49327.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16222.exe
        5⤵
        
        PID:4164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47769.exe
        5⤵
        
        PID:5028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20176.exe
        5⤵
        
        PID:5624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-427.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4972.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63661.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10852.exe
        5⤵
        
        PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19357.exe
        5⤵
        
        PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60788.exe
        5⤵
        
        PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28178.exe
        5⤵
        
        PID:4624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1846.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28770.exe
      4⤵
      PID:2424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64194.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32791.exe
      4⤵
      PID:4016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18787.exe
      4⤵
      PID:5064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24796.exe
      4⤵
      PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52218.exe
      4⤵
      PID:6008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25839.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25839.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-967.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59566.exe
        5⤵
        
        PID:608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54734.exe
        5⤵
        
        PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
        5⤵
        
        PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32290.exe
        5⤵
        
        PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45546.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28178.exe
        5⤵
        
        PID:6088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1217.exe
      4⤵
      PID:2856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11922.exe
      4⤵
      PID:920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19191.exe
      4⤵
      PID:3944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44855.exe
      4⤵
      PID:3844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44544.exe
      4⤵
      PID:4692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62612.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54394.exe
      4⤵
      PID:5248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29701.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29701.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53731.exe
      4⤵
      PID:2256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60425.exe
      4⤵
      PID:236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10149.exe
      4⤵
      PID:2904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57992.exe
      4⤵
      PID:3764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35854.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11472.exe
      4⤵
      PID:1744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60918.exe
      4⤵
      PID:5416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25352.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25352.exe
    3⤵
    PID:972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54825.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54825.exe
    3⤵
    PID:1296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27174.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27174.exe
    3⤵
    PID:3360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28326.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28326.exe
    3⤵
    PID:4064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57510.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57510.exe
    3⤵
    PID:4452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26733.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26733.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62177.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62177.exe
    3⤵
    PID:5720
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59620.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59620.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41307.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41307.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-999.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11600.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12885.exe
        5⤵
        
        PID:1656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57907.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16014.exe
        5⤵
        
        PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49327.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36776.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46903.exe
        5⤵
        
        PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57553.exe
        5⤵
        
        PID:2360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46743.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7576.exe
        5⤵
        
        PID:2736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45031.exe
        5⤵
        
        PID:3492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10852.exe
        5⤵
        
        PID:3168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6337.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20164.exe
        5⤵
        
        PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13547.exe
        5⤵
        
        PID:2940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13034.exe
      4⤵
      PID:1012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7873.exe
        5⤵
        
        PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7374.exe
        5⤵
        
        PID:4432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51669.exe
        5⤵
        
        PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3516.exe
        5⤵
        
        PID:5444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14488.exe
      4⤵
      PID:2728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7349.exe
      4⤵
      PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32791.exe
      4⤵
      PID:3708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42005.exe
      4⤵
      PID:4224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59938.exe
      4⤵
      PID:4560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11092.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11092.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36582.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48802.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43351.exe
        6⤵
        
        PID:1616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34770.exe
        6⤵
        
        PID:3144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12076.exe
        6⤵
        
        PID:3820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52724.exe
        6⤵
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47980.exe
        6⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29976.exe
        6⤵
        
        PID:5656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52180.exe
        5⤵
        
        PID:2444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19191.exe
        5⤵
        
        PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10236.exe
        5⤵
        
        PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44544.exe
        5⤵
        
        PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62612.exe
        5⤵
        
        PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19776.exe
        5⤵
        
        PID:4104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39450.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54151.exe
        5⤵
        
        PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10526.exe
        5⤵
        
        PID:3912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59238.exe
        5⤵
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9302.exe
        5⤵
        
        PID:4856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42434.exe
        5⤵
        
        PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56419.exe
        5⤵
        
        PID:5980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48995.exe
      4⤵
      PID:704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65238.exe
      4⤵
      PID:692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30216.exe
      4⤵
      PID:3620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57054.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63739.exe
      4⤵
      PID:4248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51714.exe
      4⤵
      PID:4920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1312.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33523.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33523.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21083.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63724.exe
      4⤵
      PID:880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13326.exe
      4⤵
      PID:3904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18901.exe
      4⤵
      PID:3968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19881.exe
      4⤵
      PID:4800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60788.exe
      4⤵
      PID:4120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28178.exe
      4⤵
      PID:5000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5595.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5595.exe
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9122.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9122.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59528.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59528.exe
    3⤵
    PID:3952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10766.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10766.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40079.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40079.exe
    3⤵
    PID:4644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35746.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35746.exe
    3⤵
    PID:5056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5512.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5512.exe
    3⤵
    PID:6080
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59023.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59023.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32650.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32650.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20293.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47846.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11244.exe
        5⤵
        
        PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17131.exe
        5⤵
        
        PID:1100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
        5⤵
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13157.exe
        5⤵
        
        PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35304.exe
        5⤵
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27868.exe
        5⤵
        
        PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7047.exe
        5⤵
        
        PID:5600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50259.exe
      4⤵
      PID:3048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27475.exe
      4⤵
      PID:1668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10526.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28319.exe
      4⤵
      PID:3876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61610.exe
      4⤵
      PID:4676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41081.exe
      4⤵
      PID:5100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1312.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24817.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24817.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54530.exe
      4⤵
      PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28841.exe
      4⤵
      PID:2664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17131.exe
      4⤵
      PID:3076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
      4⤵
      PID:3304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13157.exe
      4⤵
      PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45546.exe
      4⤵
      PID:3456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28178.exe
      4⤵
      PID:6064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18968.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18968.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46854.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46854.exe
    3⤵
    PID:2964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9723.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9723.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57054.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57054.exe
    3⤵
    PID:3140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63894.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63894.exe
    3⤵
    PID:4932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3240.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3240.exe
    3⤵
    PID:4960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53259.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53259.exe
    3⤵
    PID:5212
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44462.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44462.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1071.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1071.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59911.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64836.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64836.exe
    3⤵
    PID:828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8623.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8623.exe
    3⤵
    PID:2476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16014.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16014.exe
    3⤵
    PID:3516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49327.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49327.exe
    3⤵
    PID:3268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24939.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24939.exe
    3⤵
    PID:4232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46903.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46903.exe
    3⤵
    PID:4924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57553.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57553.exe
    3⤵
    PID:5932
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37253.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37253.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1952
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61392.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61392.exe
  2⤵
  PID:3004
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34106.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34106.exe
  2⤵
  PID:2828
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55455.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55455.exe
  2⤵
  PID:3596
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27191.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27191.exe
  2⤵
  PID:3756
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57140.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57140.exe
  2⤵
  PID:4180
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13827.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13827.exe
  2⤵
  PID:2288
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28459.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28459.exe
  2⤵
  PID:5724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12225.exe

Filesize
468KB

MD5
ccdc05dafc9fc3088b252d801cca3226

SHA1
9f7a096d234ca100108e344f4931834c7cfa6589

SHA256
c5446c03298736e3be3761601e056cf0cafcd289bbbc7b6ef1cf74efef33b25f

SHA512
fb745f979c504b3cd0d0cc7fa892588f0007a51fd938ea2b59be12577311009f1c803b5835c812a95e94bfd1af15c6a9b96b4c3e0be466154449457f13f4493c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14001.exe

Filesize
468KB

MD5
bfdab9b1b89587141643da2a273b2b03

SHA1
75808ed40aa6de0a71439d023982cd2232aa00b4

SHA256
095edafa14d52558b27da5d4e736f81d1c37f0a95c32c49167066688af5e9717

SHA512
79bce3768c3de639251be2368d9975d538f6f854545b414663c74b978d9c83fcbd8c9bd5679a371fcf013879fdeee76d224f9af9977d2d659ce3c6e66c614c79

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21083.exe

Filesize
468KB

MD5
3d8b8861d9b2213a057a4f3e1c4d5c4a

SHA1
331f9f5d3e3353d336ebd91b4b898a27abd95273

SHA256
d95f60dbe523f52f2cabc9b8f8fd3f8ab03f320a157315779ccf4f0789e3c9dd

SHA512
a823fa215d72d08de422a25a4d0a65eaa5b0411afbc9b7b09a95340b94bbb83b41c6b67eac42fcec2d70c41fff7e760c8906e57e916939ca9a630b682c762c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44855.exe

Filesize
468KB

MD5
7d952f631b35b18a156917f17fc275f6

SHA1
9f6b152fa6dbc16774a9df90cd070bc5abef06b5

SHA256
aa7026ce18fd49762da3babfa29a6465c0fad23b7f4afd57179eea283027c306

SHA512
045b9e2ae3ec9b56e682f5e2cb86af4368275a41c1254b74de06150477d743481bcc2b6133c3be23a7544e2096005d8e2d755c6e0c7e6120c62692e3a081a0ae

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13041.exe

Filesize
468KB

MD5
09f3d483c2de1b42c3734450a6fa4f0b

SHA1
7c60d811b5dd0318759e032ba85fabe6e2a5f682

SHA256
536568cc5b8e5215b64d3fa1a14776086768374cb030d981b4349065735385c9

SHA512
4a44681f1e587937aff8119ad9026ee20b9584ced772f562f636e417038f601609f6b8ffbdb9ad5c7b86fa78d53fe73d459f4dcb53f24a6c8a02c031365510c0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18473.exe

Filesize
468KB

MD5
455a62aa8702ff67031eea07dd8897d0

SHA1
cd646757847e05483630ff33fb4d5a56507f360f

SHA256
980ed6a1d1ee6c59ba43043e6d9a99687ea084aa0a18e30152eb1c7784dcdc28

SHA512
066f3b0f16eec848cbaf5979ffd95d21171d2d980597034e6d96da1cd97a73b528bfb1cf54172d6470818b72f1d80ea4dfb788e334b05217edbd203f010ad846

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-21237.exe

Filesize
468KB

MD5
c1ec9ed3fc675cd8efe7d733322b5ea6

SHA1
12a815d8298f1240203f5de2717390dcded6517c

SHA256
72b2d31a102808aa21afa440062fa26e1cc8dc2cf081b0ad65265bae46b290fa

SHA512
68c965985e159849a0a46d0deb5ceca6fc3e58500b86c9701fec63b49ce21eea85f62284a17e64fdcc9e38ff0d1532177245a60cbbdd5ab1e066dda419c506bf

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29556.exe

Filesize
468KB

MD5
6d33dc63db917e74de2cf6ca4b4d255c

SHA1
5ddf63ccec12909a86d19b554dbf09f94d11e14a

SHA256
918ccd5a01bb7e00be666c5e419428a5c8b7c8dd5637c93c2b61a261b854b18a

SHA512
cc36ee913ed5ce19dd3356a02f86ecec3007ad28a51e7e48fc1604ada18ed39185e7e131fb1cc463f540791d86186f754fd1e612599131860c7bb1b1bf0c0194

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40527.exe

Filesize
468KB

MD5
a39721c9fabf61b89fdcfe115e665f6f

SHA1
5a5db10b869d5831a2cf4e4bfbfccf7e1c405615

SHA256
590d57b54a9f11557afb03263e6716e84dcc2234267df9bbb7c8223fb324afd6

SHA512
18cd49a1ccd7cd6cf6b1f1d5c8952ae97aa4948c4cc523702eaf6dc9d6ea8d0ad368dd2fb5ac0593c253378b50b478b3ecd4205021841a11e918be13671c1a14

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-41307.exe

Filesize
468KB

MD5
b39fea4cd1ebcbe4c992166082591db7

SHA1
5ab52a455d9ffeaee501c78711528399a4149df4

SHA256
e7e6d400c1bcf15fb32473a6839ba742935c017a560fd7790d802d1e0c2b0fad

SHA512
8c1697c3cc2ba845339c5be891b72cc468c0aa1212b4d7e43d9502e941cdb5c0436f72c79fe224290cadfc7b82bdf30b6d6c2cd500411b87667f2540883dc8b0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47456.exe

Filesize
468KB

MD5
5612a1dfd1dfb67f0b55cc39f60fee37

SHA1
ff823e45a71d16452e3dc672e55120395998a575

SHA256
5743ca842ce14cdf3dcb5b606d730df9e65017809add229d8738a291e3edd931

SHA512
b5f9ee63fecd58a1d03e504a3ac8981e7cecd4d10d21849a38e381d636a5b60c219c49df2e7a78f2fba3e351f6d75a25337eb08f933357df8a87ccd354a34af6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-48341.exe

Filesize
468KB

MD5
b52e00ce7fb052a722db9d6598f6a5a4

SHA1
0df0b60365aa756f966fa6e5c563d26ac7f737fa

SHA256
562d124c31af694eb6204d4425dbbd4ba58eb06c5124ada86abd0c3688570820

SHA512
c0b5a6c3a265e4543ab2c1db8e9afbe6f50cf89740fc0094a8018db0f3b355c2e06064a9e6f2f5bdac1849c1aa0c4e84a01b949f20172bc85d2605acf13a2d92

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-48835.exe

Filesize
468KB

MD5
31cce36348b75d180090b163b6ec430e

SHA1
5cbeb4110aed01dc3c2c1cf698349c51fb61e2d0

SHA256
e3bd27e27ad55ffd78bd7295a1c570473e7d25bab6ec04e2d3e2e29ff3c2fae2

SHA512
229b22e5d7a688aade8d2f646e692d49f8f35438a91261484a1454c2c6fb1397f55b49b13ce46ec5754101fda70c8ddee71fc13ea0a6019c3eb56b542babc75b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51367.exe

Filesize
468KB

MD5
49cca359a211c3cf6e5d1ff4a9072481

SHA1
092a6c0594475374b5b4ab9c99b93d83975b687d

SHA256
b9d2682294ffd20a2c72e9107f3ebce432a57adadfc79246ade4a517a7a5874f

SHA512
c8d56c3e8c8b86065ebb3287a061343428495f311cc0a6ab6d721e906af2b14d45b705cf8396e8fa40b8d529be5e4e069ffe4a23a2fd28ad0ac637c098bdf427

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-558.exe

Filesize
468KB

MD5
3b68113d4f7d0be061bcccaf54310c20

SHA1
88d1d206580ce55abba4434c2bf7e7c61cc80425

SHA256
4ee0fd87183bdbd94b4e2cd0a262aa809292614dafbc2aa1b79f30342b582201

SHA512
a9cbcb0afaa347faa419d43350923d64f2e2c5e3186db4f3a13319587568bc975b721a68f083fe1b63fc299daddb5f20c7c00030a24477307e07168852f621fb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58504.exe

Filesize
468KB

MD5
f1d1a0f32fe562289a22de6f3c29f242

SHA1
f4c7715a096aa0e7e1f06b72cb211defe83ebd40

SHA256
780c786128e34be61c73ea326773b34f41493a526fb6a03f1d241f2f3b003e98

SHA512
a0cd53a464d4a31c62f0ae6b09e3dd462e37e7c8c6b9e1c2daf5c68c4a69d050e2fc81716e33fc0ee92e2936bd71a310c30bb6995c5945790550aff2ec15a0c4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59023.exe

Filesize
468KB

MD5
9c6532ac6b84e6336ff4ebab57e9a249

SHA1
49ddb6ffb8c083153a1a35c2f5d2376ecc6edda2

SHA256
e01dbb5efa26b769d88a4b52a5c774ca6c70a4d9a912769affb6b9aafe1e9e09

SHA512
5c61cba798223f664ebc32010876754ed0d20024f06fcc720a84e0d81d01e00433e3a12698ab9cb270e8fa4c0f27ee2339bd57227531ff95f198f2214a0c82e3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59288.exe

Filesize
468KB

MD5
3efda5cc9c0bad52c9d895f581846439

SHA1
d8a0ab49056a06343e7fa9be85f8089637aa0cac

SHA256
cb169a8ba620dfb6f3b879fe0b0dcb63a78c6525c916db2decb55092894635b4

SHA512
10fd570d90fb0556039348c97600f45329d8c6a854809cbc9e5968437230cb7ab7580ed1a51db4acd697223f616e1df6b6c08c67d572bf90d648cb244b623e8d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59620.exe

Filesize
468KB

MD5
1610a6bf834922fb132ce41981f2cab7

SHA1
c794fc0a441a57f7dddedeb53b678ca147458027

SHA256
efc56c6136be29dfde54d51def98f003fcc76a9262ba821535675591a6f8d2f6

SHA512
8eb2f4b2f139371425d2ffae79c6cad1db553810d619b212e1bdf1aeabb80ad8186b157ddf83326787ef0ed0ecc977acd8b3b57c69af109888467a8a03265f30

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59673.exe

Filesize
468KB

MD5
8af1029c78bab473a49aa078eac04200

SHA1
959cba0648683d95d93c020c60c2624d9db9a324

SHA256
9d5c4a658dc16d85a7db21437dcd422e9e55f072d2fff2786de4f5365edd96d2

SHA512
0fa4fd64376d88d311529b975c5f6a4d05b7b151fd5ef223045ac6a8af71f6050787e3948b353adea78d4475e9be50a228b66d94c20d723c6ca0379bb75e18d8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61348.exe

Filesize
468KB

MD5
fbe2899fcc1972246e3bc677e87bdc55

SHA1
ed287bc1c1a1caf6691d481dc0c90fd954ad58b3

SHA256
beaba32e6888dda4430dacca8cc0959db80b404c659d76156bf97d94aed9264e

SHA512
80a275be6d7e43aba29b5f7bae58d7614eb4c3fbc7288898ea47881e46733994fb6283ca863d75a71a4f5a2b138e950e9379456d287b5f39bf6fa5180d17b9bf

Download Submit