cd1175eebeb9900d5507b9888005bd3376271774f7fee2aa4d7d1cfa8109b2a2

Analysis

max time kernel
115s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 06:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

262ed6fb9bf305882fe81b0912e632e0N.exe
Size

468KB
MD5

262ed6fb9bf305882fe81b0912e632e0
SHA1

14e7b8fa6c226b1de463ea935a14b4f2fbf66da4
SHA256

cd1175eebeb9900d5507b9888005bd3376271774f7fee2aa4d7d1cfa8109b2a2
SHA512

ee46f562e8b36ea5be4d3ed1e127ab8327c370a199bb8999ab4c34c07f22f0ae6d37ccd68380a728140903b25b7352ad4bb070e74a890f029936f0b0d8255651
SSDEEP

3072:3gAKoKIaIU57tbYEPzcjbfD/ECLCsIp91mHeOVY4/XEe6Ruup2lE:3gNo9c7t7P4jbfv0dE/XrKuup

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
888	Unicorn-54521.exe
2776	Unicorn-24763.exe
2876	Unicorn-29510.exe
2972	Unicorn-31234.exe
2656	Unicorn-64482.exe
2808	Unicorn-44617.exe
2648	Unicorn-17511.exe
3056	Unicorn-10616.exe
1972	Unicorn-26111.exe
2516	Unicorn-53953.exe
1648	Unicorn-45785.exe
2536	Unicorn-53678.exe
2016	Unicorn-46863.exe
848	Unicorn-33127.exe
640	Unicorn-3335.exe
552	Unicorn-47835.exe
3004	Unicorn-11633.exe
2208	Unicorn-32952.exe
572	Unicorn-973.exe
2320	Unicorn-34104.exe
1396	Unicorn-31150.exe
1800	Unicorn-9791.exe
2532	Unicorn-9791.exe
456	Unicorn-206.exe
1740	Unicorn-39043.exe
1540	Unicorn-58909.exe
1436	Unicorn-1047.exe
2308	Unicorn-34026.exe
612	Unicorn-39427.exe
2604	Unicorn-59293.exe
3028	Unicorn-1762.exe
780	Unicorn-60274.exe
896	Unicorn-39256.exe
1560	Unicorn-59122.exe
1604	Unicorn-53376.exe
1028	Unicorn-10113.exe
2724	Unicorn-36465.exe
2860	Unicorn-37607.exe
2736	Unicorn-13486.exe
2976	Unicorn-59158.exe
1808	Unicorn-53751.exe
2744	Unicorn-58582.exe
2688	Unicorn-29055.exe
2820	Unicorn-16868.exe
2660	Unicorn-8809.exe
2144	Unicorn-60611.exe
1108	Unicorn-14939.exe
2372	Unicorn-47996.exe
940	Unicorn-28130.exe
1244	Unicorn-64471.exe
1956	Unicorn-54841.exe
1868	Unicorn-48894.exe
1588	Unicorn-2115.exe
2996	Unicorn-56989.exe
2104	Unicorn-31825.exe
2260	Unicorn-52849.exe
1400	Unicorn-28339.exe
1692	Unicorn-3642.exe
1100	Unicorn-25193.exe
1976	Unicorn-43544.exe
1360	Unicorn-59111.exe
2284	Unicorn-17238.exe
1264	Unicorn-14052.exe
1760	Unicorn-59532.exe

Loads dropped DLL 64 IoCs

pid	Process
2124	262ed6fb9bf305882fe81b0912e632e0N.exe
2124	262ed6fb9bf305882fe81b0912e632e0N.exe
888	Unicorn-54521.exe
888	Unicorn-54521.exe
2124	262ed6fb9bf305882fe81b0912e632e0N.exe
2124	262ed6fb9bf305882fe81b0912e632e0N.exe
2776	Unicorn-24763.exe
2776	Unicorn-24763.exe
2876	Unicorn-29510.exe
2876	Unicorn-29510.exe
888	Unicorn-54521.exe
888	Unicorn-54521.exe
2124	262ed6fb9bf305882fe81b0912e632e0N.exe
2124	262ed6fb9bf305882fe81b0912e632e0N.exe
2972	Unicorn-31234.exe
2972	Unicorn-31234.exe
2776	Unicorn-24763.exe
2776	Unicorn-24763.exe
2656	Unicorn-64482.exe
2656	Unicorn-64482.exe
2808	Unicorn-44617.exe
2808	Unicorn-44617.exe
2648	Unicorn-17511.exe
2648	Unicorn-17511.exe
888	Unicorn-54521.exe
2876	Unicorn-29510.exe
888	Unicorn-54521.exe
2876	Unicorn-29510.exe
2124	262ed6fb9bf305882fe81b0912e632e0N.exe
2124	262ed6fb9bf305882fe81b0912e632e0N.exe
3056	Unicorn-10616.exe
3056	Unicorn-10616.exe
2972	Unicorn-31234.exe
2972	Unicorn-31234.exe
1972	Unicorn-26111.exe
1972	Unicorn-26111.exe
2776	Unicorn-24763.exe
2776	Unicorn-24763.exe
2536	Unicorn-53678.exe
2536	Unicorn-53678.exe
2648	Unicorn-17511.exe
2648	Unicorn-17511.exe
2516	Unicorn-53953.exe
2016	Unicorn-46863.exe
2516	Unicorn-53953.exe
2016	Unicorn-46863.exe
888	Unicorn-54521.exe
888	Unicorn-54521.exe
2656	Unicorn-64482.exe
2656	Unicorn-64482.exe
640	Unicorn-3335.exe
1648	Unicorn-45785.exe
640	Unicorn-3335.exe
1648	Unicorn-45785.exe
2124	262ed6fb9bf305882fe81b0912e632e0N.exe
2124	262ed6fb9bf305882fe81b0912e632e0N.exe
2808	Unicorn-44617.exe
848	Unicorn-33127.exe
2808	Unicorn-44617.exe
848	Unicorn-33127.exe
2876	Unicorn-29510.exe
2876	Unicorn-29510.exe
552	Unicorn-47835.exe
552	Unicorn-47835.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28639.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18199.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2375.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40116.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14052.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64482.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13967.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5521.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55251.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46784.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59593.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54365.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2113.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31825.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5893.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6355.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34026.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60611.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18466.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58131.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42902.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45198.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44496.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22741.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25193.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38663.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15736.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12104.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64401.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41472.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8727.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13656.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17044.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7791.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13921.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54657.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54841.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7420.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13921.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9149.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45785.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21155.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24065.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46614.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17658.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37305.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34350.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50273.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14939.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4991.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-662.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36017.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48315.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11190.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8136.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6962.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51764.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31672.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46784.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2124	262ed6fb9bf305882fe81b0912e632e0N.exe
888	Unicorn-54521.exe
2776	Unicorn-24763.exe
2876	Unicorn-29510.exe
2972	Unicorn-31234.exe
2656	Unicorn-64482.exe
2808	Unicorn-44617.exe
2648	Unicorn-17511.exe
3056	Unicorn-10616.exe
1972	Unicorn-26111.exe
2516	Unicorn-53953.exe
1648	Unicorn-45785.exe
2536	Unicorn-53678.exe
2016	Unicorn-46863.exe
640	Unicorn-3335.exe
848	Unicorn-33127.exe
552	Unicorn-47835.exe
3004	Unicorn-11633.exe
2208	Unicorn-32952.exe
572	Unicorn-973.exe
2320	Unicorn-34104.exe
1396	Unicorn-31150.exe
1800	Unicorn-9791.exe
2532	Unicorn-9791.exe
456	Unicorn-206.exe
1436	Unicorn-1047.exe
1740	Unicorn-39043.exe
1540	Unicorn-58909.exe
612	Unicorn-39427.exe
2308	Unicorn-34026.exe
2604	Unicorn-59293.exe
3028	Unicorn-1762.exe
780	Unicorn-60274.exe
896	Unicorn-39256.exe
1560	Unicorn-59122.exe
1604	Unicorn-53376.exe
2724	Unicorn-36465.exe
1028	Unicorn-10113.exe
2860	Unicorn-37607.exe
1808	Unicorn-53751.exe
2736	Unicorn-13486.exe
2976	Unicorn-59158.exe
2688	Unicorn-29055.exe
2744	Unicorn-58582.exe
2660	Unicorn-8809.exe
1108	Unicorn-14939.exe
2144	Unicorn-60611.exe
940	Unicorn-28130.exe
2372	Unicorn-47996.exe
2820	Unicorn-16868.exe
1244	Unicorn-64471.exe
1956	Unicorn-54841.exe
1868	Unicorn-48894.exe
1588	Unicorn-2115.exe
2996	Unicorn-56989.exe
2104	Unicorn-31825.exe
2260	Unicorn-52849.exe
1400	Unicorn-28339.exe
1692	Unicorn-3642.exe
1100	Unicorn-25193.exe
1976	Unicorn-43544.exe
1360	Unicorn-59111.exe
2284	Unicorn-17238.exe
2056	Unicorn-53824.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 888	2124	262ed6fb9bf305882fe81b0912e632e0N.exe	29
PID 2124 wrote to memory of 888	2124	262ed6fb9bf305882fe81b0912e632e0N.exe	29
PID 2124 wrote to memory of 888	2124	262ed6fb9bf305882fe81b0912e632e0N.exe	29
PID 2124 wrote to memory of 888	2124	262ed6fb9bf305882fe81b0912e632e0N.exe	29
PID 888 wrote to memory of 2776	888	Unicorn-54521.exe	30
PID 888 wrote to memory of 2776	888	Unicorn-54521.exe	30
PID 888 wrote to memory of 2776	888	Unicorn-54521.exe	30
PID 888 wrote to memory of 2776	888	Unicorn-54521.exe	30
PID 2124 wrote to memory of 2876	2124	262ed6fb9bf305882fe81b0912e632e0N.exe	31
PID 2124 wrote to memory of 2876	2124	262ed6fb9bf305882fe81b0912e632e0N.exe	31
PID 2124 wrote to memory of 2876	2124	262ed6fb9bf305882fe81b0912e632e0N.exe	31
PID 2124 wrote to memory of 2876	2124	262ed6fb9bf305882fe81b0912e632e0N.exe	31
PID 2776 wrote to memory of 2972	2776	Unicorn-24763.exe	32
PID 2776 wrote to memory of 2972	2776	Unicorn-24763.exe	32
PID 2776 wrote to memory of 2972	2776	Unicorn-24763.exe	32
PID 2776 wrote to memory of 2972	2776	Unicorn-24763.exe	32
PID 2876 wrote to memory of 2656	2876	Unicorn-29510.exe	33
PID 2876 wrote to memory of 2656	2876	Unicorn-29510.exe	33
PID 2876 wrote to memory of 2656	2876	Unicorn-29510.exe	33
PID 2876 wrote to memory of 2656	2876	Unicorn-29510.exe	33
PID 888 wrote to memory of 2808	888	Unicorn-54521.exe	34
PID 888 wrote to memory of 2808	888	Unicorn-54521.exe	34
PID 888 wrote to memory of 2808	888	Unicorn-54521.exe	34
PID 888 wrote to memory of 2808	888	Unicorn-54521.exe	34
PID 2124 wrote to memory of 2648	2124	262ed6fb9bf305882fe81b0912e632e0N.exe	35
PID 2124 wrote to memory of 2648	2124	262ed6fb9bf305882fe81b0912e632e0N.exe	35
PID 2124 wrote to memory of 2648	2124	262ed6fb9bf305882fe81b0912e632e0N.exe	35
PID 2124 wrote to memory of 2648	2124	262ed6fb9bf305882fe81b0912e632e0N.exe	35
PID 2972 wrote to memory of 3056	2972	Unicorn-31234.exe	36
PID 2972 wrote to memory of 3056	2972	Unicorn-31234.exe	36
PID 2972 wrote to memory of 3056	2972	Unicorn-31234.exe	36
PID 2972 wrote to memory of 3056	2972	Unicorn-31234.exe	36
PID 2776 wrote to memory of 1972	2776	Unicorn-24763.exe	37
PID 2776 wrote to memory of 1972	2776	Unicorn-24763.exe	37
PID 2776 wrote to memory of 1972	2776	Unicorn-24763.exe	37
PID 2776 wrote to memory of 1972	2776	Unicorn-24763.exe	37
PID 2656 wrote to memory of 2516	2656	Unicorn-64482.exe	38
PID 2656 wrote to memory of 2516	2656	Unicorn-64482.exe	38
PID 2656 wrote to memory of 2516	2656	Unicorn-64482.exe	38
PID 2656 wrote to memory of 2516	2656	Unicorn-64482.exe	38
PID 2808 wrote to memory of 1648	2808	Unicorn-44617.exe	39
PID 2808 wrote to memory of 1648	2808	Unicorn-44617.exe	39
PID 2808 wrote to memory of 1648	2808	Unicorn-44617.exe	39
PID 2808 wrote to memory of 1648	2808	Unicorn-44617.exe	39
PID 2648 wrote to memory of 2536	2648	Unicorn-17511.exe	40
PID 2648 wrote to memory of 2536	2648	Unicorn-17511.exe	40
PID 2648 wrote to memory of 2536	2648	Unicorn-17511.exe	40
PID 2648 wrote to memory of 2536	2648	Unicorn-17511.exe	40
PID 888 wrote to memory of 2016	888	Unicorn-54521.exe	41
PID 888 wrote to memory of 2016	888	Unicorn-54521.exe	41
PID 888 wrote to memory of 2016	888	Unicorn-54521.exe	41
PID 888 wrote to memory of 2016	888	Unicorn-54521.exe	41
PID 2876 wrote to memory of 848	2876	Unicorn-29510.exe	42
PID 2876 wrote to memory of 848	2876	Unicorn-29510.exe	42
PID 2876 wrote to memory of 848	2876	Unicorn-29510.exe	42
PID 2876 wrote to memory of 848	2876	Unicorn-29510.exe	42
PID 2124 wrote to memory of 640	2124	262ed6fb9bf305882fe81b0912e632e0N.exe	43
PID 2124 wrote to memory of 640	2124	262ed6fb9bf305882fe81b0912e632e0N.exe	43
PID 2124 wrote to memory of 640	2124	262ed6fb9bf305882fe81b0912e632e0N.exe	43
PID 2124 wrote to memory of 640	2124	262ed6fb9bf305882fe81b0912e632e0N.exe	43
PID 3056 wrote to memory of 552	3056	Unicorn-10616.exe	44
PID 3056 wrote to memory of 552	3056	Unicorn-10616.exe	44
PID 3056 wrote to memory of 552	3056	Unicorn-10616.exe	44
PID 3056 wrote to memory of 552	3056	Unicorn-10616.exe	44

C:\Users\Admin\AppData\Local\Temp\262ed6fb9bf305882fe81b0912e632e0N.exe
"C:\Users\Admin\AppData\Local\Temp\262ed6fb9bf305882fe81b0912e632e0N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54521.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54521.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24763.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24763.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31234.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10616.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47835.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60274.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46614.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57258.exe
        8⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18199.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50273.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23402.exe
        7⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2182.exe
        7⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28639.exe
        7⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54365.exe
        7⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48315.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39256.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61276.exe
        7⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13967.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15544.exe
        7⤵
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38420.exe
        7⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49287.exe
        7⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47087.exe
        6⤵
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8727.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13780.exe
        6⤵
        
        PID:3948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15929.exe
        6⤵
        
        PID:3752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45198.exe
        6⤵
        
        PID:4476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31672.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11633.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59122.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13921.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37437.exe
        7⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48065.exe
        7⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48251.exe
        7⤵
        
        PID:4108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3476.exe
        6⤵
        
        PID:472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44890.exe
        6⤵
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21409.exe
        6⤵
        
        PID:3612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21884.exe
        6⤵
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50017.exe
        6⤵
        
        PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53376.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8235.exe
        6⤵
        
        PID:1748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-599.exe
        6⤵
        
        PID:2624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15544.exe
        6⤵
        
        PID:3704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7344.exe
        6⤵
        
        PID:3380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-662.exe
        6⤵
        
        PID:4552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41472.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23622.exe
        5⤵
        
        PID:2512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11534.exe
        5⤵
        
        PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29170.exe
        5⤵
        
        PID:3416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49899.exe
        5⤵
        
        PID:3908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21449.exe
        5⤵
        
        PID:5052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26111.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32952.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37607.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13921.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37437.exe
        7⤵
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44496.exe
        7⤵
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17804.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46784.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22260.exe
        6⤵
        
        PID:3840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64216.exe
        6⤵
        
        PID:4080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49663.exe
        6⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58538.exe
        6⤵
        
        PID:3716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2115.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25972.exe
        6⤵
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46784.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28639.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54365.exe
        6⤵
        
        PID:3976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18585.exe
        6⤵
        
        PID:4140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10850.exe
        5⤵
        
        PID:548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11534.exe
        5⤵
        
        PID:2020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61746.exe
        5⤵
        
        PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41264.exe
        5⤵
        
        PID:752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62098.exe
        5⤵
        
        PID:5004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-973.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10113.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28339.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65303.exe
        7⤵
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9198.exe
        7⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28639.exe
        7⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54365.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23426.exe
        7⤵
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37653.exe
        6⤵
        
        PID:2408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52649.exe
        6⤵
        
        PID:1688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12104.exe
        6⤵
        
        PID:3444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5893.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26784.exe
        6⤵
        
        PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25193.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55338.exe
        6⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62077.exe
        6⤵
        
        PID:3372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12232.exe
        6⤵
        
        PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30779.exe
        5⤵
        
        PID:756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13656.exe
        5⤵
        
        PID:1328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25684.exe
        5⤵
        
        PID:3156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2113.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40116.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36465.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7420.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57309.exe
        5⤵
        
        PID:2268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25170.exe
        5⤵
        
        PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21085.exe
        5⤵
        
        PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8216.exe
        5⤵
        
        PID:4484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23295.exe
      4⤵
      PID:1592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44305.exe
      4⤵
      PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2828.exe
      4⤵
      PID:3264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26525.exe
      4⤵
      PID:5044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44617.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44617.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45785.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1047.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23866.exe
        6⤵
        
        PID:2684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9452.exe
        6⤵
        
        PID:1324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24096.exe
        6⤵
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47884.exe
        6⤵
        
        PID:3604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-662.exe
        6⤵
        
        PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31192.exe
        5⤵
        
        PID:2524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14334.exe
        5⤵
        
        PID:2328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28639.exe
        5⤵
        
        PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14331.exe
        5⤵
        
        PID:3912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61081.exe
        5⤵
        
        PID:4812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39427.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6962.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43386.exe
        5⤵
        
        PID:2204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4991.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9149.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19178.exe
        5⤵
        
        PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25383.exe
        5⤵
        
        PID:996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8809.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15204.exe
        5⤵
        
        PID:1600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57309.exe
        5⤵
        
        PID:1504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54657.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24065.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-662.exe
        5⤵
        
        PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60648.exe
        5⤵
        
        PID:4640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55204.exe
      4⤵
      PID:2952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21155.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19862.exe
      4⤵
      PID:3308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64746.exe
      4⤵
      PID:3904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45198.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50847.exe
      4⤵
      PID:4636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46863.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46863.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31825.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61276.exe
        6⤵
        
        PID:768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29487.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22645.exe
        6⤵
        
        PID:3992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64216.exe
        6⤵
        
        PID:4088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49663.exe
        6⤵
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12176.exe
        6⤵
        
        PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47087.exe
        5⤵
        
        PID:2140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18466.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12104.exe
        5⤵
        
        PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1352.exe
        5⤵
        
        PID:3768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46381.exe
        5⤵
        
        PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32855.exe
        5⤵
        
        PID:4844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60611.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51058.exe
        5⤵
        
        PID:2520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46784.exe
        5⤵
        
        PID:1572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28639.exe
        5⤵
        
        PID:3548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49823.exe
        5⤵
        
        PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2375.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38190.exe
        5⤵
        
        PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60112.exe
      4⤵
      PID:1444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20199.exe
      4⤵
      PID:2200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12744.exe
      4⤵
      PID:3664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62795.exe
      4⤵
      PID:944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62067.exe
      4⤵
      PID:4264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-206.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-206.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48894.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51764.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38663.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37305.exe
        5⤵
        
        PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-822.exe
        5⤵
        
        PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50847.exe
        5⤵
        
        PID:2160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59721.exe
        5⤵
        
        PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17783.exe
      4⤵
      PID:1620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27702.exe
      4⤵
      PID:1428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21409.exe
      4⤵
      PID:3656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15399.exe
      4⤵
      PID:3808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49663.exe
      4⤵
      PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12176.exe
      4⤵
      PID:4572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52849.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52849.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12326.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12326.exe
    3⤵
    PID:1092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5521.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5521.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37356.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37356.exe
    3⤵
    PID:1940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57849.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57849.exe
    3⤵
    PID:4180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17450.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17450.exe
    3⤵
    PID:3524
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29510.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29510.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64482.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64482.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53953.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53751.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39053.exe
        7⤵
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59593.exe
        7⤵
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28484.exe
        7⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27314.exe
        7⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39586.exe
        7⤵
        
        PID:4152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36745.exe
        6⤵
        
        PID:2236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46784.exe
        6⤵
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22260.exe
        6⤵
        
        PID:3832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45729.exe
        6⤵
        
        PID:3192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22741.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58582.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17658.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11212.exe
        6⤵
        
        PID:3940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1479.exe
        6⤵
        
        PID:3924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9327.exe
        6⤵
        
        PID:4584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58008.exe
        6⤵
        
        PID:5040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59033.exe
        5⤵
        
        PID:2956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18632.exe
        5⤵
        
        PID:2632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13595.exe
        5⤵
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64401.exe
        5⤵
        
        PID:2128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1192.exe
        5⤵
        
        PID:4600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56182.exe
        5⤵
        
        PID:4652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39043.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47996.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56730.exe
        6⤵
        
        PID:2680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-599.exe
        6⤵
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15544.exe
        6⤵
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7344.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-662.exe
        6⤵
        
        PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31000.exe
        5⤵
        
        PID:1744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52649.exe
        5⤵
        
        PID:1260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13595.exe
        5⤵
        
        PID:3884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64401.exe
        5⤵
        
        PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1192.exe
        5⤵
        
        PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37007.exe
        5⤵
        
        PID:4932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64471.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32299.exe
        5⤵
        
        PID:2012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64761.exe
        5⤵
        
        PID:2908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16395.exe
        5⤵
        
        PID:3812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7344.exe
        5⤵
        
        PID:3440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43742.exe
        5⤵
        
        PID:4784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45573.exe
      4⤵
      PID:2740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43984.exe
      4⤵
      PID:1524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62597.exe
      4⤵
      PID:3780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45026.exe
      4⤵
      PID:3168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51087.exe
      4⤵
      PID:4596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33127.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33127.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59293.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14939.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14052.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23126.exe
        6⤵
        
        PID:2792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7791.exe
        6⤵
        
        PID:928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34350.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18648.exe
        6⤵
        
        PID:4224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52249.exe
        6⤵
        
        PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe
        5⤵
        Executes dropped EXE
        
        PID:1760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22706.exe
        6⤵
        
        PID:3260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55355.exe
        6⤵
        
        PID:4828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36862.exe
        5⤵
        
        PID:2856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13656.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25684.exe
        5⤵
        
        PID:852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28729.exe
        5⤵
        
        PID:4320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38886.exe
        5⤵
        
        PID:4808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28130.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7036.exe
        5⤵
        
        PID:2904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36017.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57309.exe
        5⤵
        
        PID:1232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15736.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7344.exe
        5⤵
        
        PID:3284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-662.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57315.exe
      4⤵
      PID:2708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29053.exe
      4⤵
      PID:692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29464.exe
      4⤵
      PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64401.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1192.exe
      4⤵
      PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56182.exe
      4⤵
      PID:4660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1762.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1762.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54841.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58951.exe
        5⤵
        
        PID:1356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-599.exe
        5⤵
        
        PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37305.exe
        5⤵
        
        PID:3580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5363.exe
        5⤵
        
        PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6361.exe
        5⤵
        
        PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12765.exe
      4⤵
      PID:1752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-533.exe
      4⤵
      PID:1120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12104.exe
      4⤵
      PID:3436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5893.exe
      4⤵
      PID:4016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26784.exe
      4⤵
      PID:5104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56989.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56989.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53824.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13921.exe
        5⤵
        
        PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27685.exe
        5⤵
        
        PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17905.exe
        5⤵
        
        PID:4820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47631.exe
      4⤵
      PID:2552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7791.exe
      4⤵
      PID:976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18648.exe
      4⤵
      PID:4196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60417.exe
      4⤵
      PID:4876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
    3⤵
    PID:588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29502.exe
      4⤵
      PID:2960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24880.exe
      4⤵
      PID:2188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37305.exe
      4⤵
      PID:3584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62803.exe
      4⤵
      PID:2168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32721.exe
      4⤵
      PID:4420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4036.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4036.exe
    3⤵
    PID:2212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36346.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36346.exe
    3⤵
    PID:1996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58131.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58131.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54600.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54600.exe
    3⤵
    PID:3856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44063.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44063.exe
    3⤵
    PID:4564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8136.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8136.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4988
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17511.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17511.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53678.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53678.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34104.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13486.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23342.exe
        6⤵
        
        PID:2500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31154.exe
        6⤵
        
        PID:1812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37305.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53566.exe
        6⤵
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32721.exe
        6⤵
        
        PID:4240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9636.exe
        5⤵
        
        PID:1708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        5⤵
        
        PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22260.exe
        5⤵
        
        PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6355.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11190.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59158.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13921.exe
        5⤵
        
        PID:3220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37437.exe
        5⤵
        
        PID:3508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44496.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14627.exe
      4⤵
      PID:2640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52649.exe
      4⤵
      PID:2464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13595.exe
      4⤵
      PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47680.exe
      4⤵
      PID:3756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1192.exe
      4⤵
      PID:4616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56182.exe
      4⤵
      PID:4676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31150.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31150.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29055.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44305.exe
        5⤵
        
        PID:3488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21488.exe
      4⤵
      PID:2440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51819.exe
        5⤵
        
        PID:2612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59593.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8770.exe
        5⤵
        
        PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9327.exe
        5⤵
        
        PID:4576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58008.exe
        5⤵
        
        PID:5072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5507.exe
      4⤵
      PID:2272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36210.exe
      4⤵
      PID:3392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64216.exe
      4⤵
      PID:4012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49663.exe
      4⤵
      PID:4544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16868.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16868.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54762.exe
      4⤵
      PID:3232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37437.exe
      4⤵
      PID:3404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44496.exe
      4⤵
      PID:4760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29268.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29268.exe
    3⤵
    PID:972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59054.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59054.exe
    3⤵
    PID:1732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12104.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12104.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49100.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49100.exe
    3⤵
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46887.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46887.exe
    3⤵
    PID:4560
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3335.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3335.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58909.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58909.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43544.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13921.exe
        5⤵
        
        PID:3212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37437.exe
        5⤵
        
        PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44496.exe
        5⤵
        
        PID:4752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56183.exe
      4⤵
      PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7791.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24885.exe
      4⤵
      PID:3960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1065.exe
      4⤵
      PID:4864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17238.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17238.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53198.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53198.exe
    3⤵
    PID:884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13656.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13656.exe
    3⤵
    PID:2448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25684.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25684.exe
    3⤵
    PID:3148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
    3⤵
    PID:4680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56182.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56182.exe
    3⤵
    PID:4448
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34026.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34026.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3642.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3642.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39042.exe
      4⤵
      PID:2096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13471.exe
      4⤵
      PID:4724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17044.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17044.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7791.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7791.exe
    3⤵
    PID:2156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34350.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34350.exe
    3⤵
    PID:1160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45265.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45265.exe
    3⤵
    PID:4332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23050.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23050.exe
    3⤵
    PID:4208
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59111.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59111.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2971.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2971.exe
    3⤵
    PID:808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1809.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1809.exe
    3⤵
    PID:3628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47085.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47085.exe
    3⤵
    PID:3732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1163.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1163.exe
    3⤵
    PID:4272
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59096.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59096.exe
  2⤵
  PID:3064
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49527.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49527.exe
  2⤵
  PID:3120
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64886.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64886.exe
  2⤵
  PID:3388
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23129.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23129.exe
  2⤵
  PID:4344
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55251.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55251.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11633.exe

Filesize
468KB

MD5
45f3a3b40fba31ab56d33632631d6e4b

SHA1
81b718d3af39020146158403ac80078747ae5f96

SHA256
c6c97a138e5165717d9fd186364ff527cf25f475ac4fd057dfff63dc1a864ab9

SHA512
ca54225364b04da330121c6c7151470835f445a4553808a5e98796c71f1032dd28c23dd1e1b7ed79573bb317c8633f5588641d40be143f63cffdfdadac50304c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26111.exe

Filesize
468KB

MD5
044cad5d31541c53f7c4103f35a4588f

SHA1
8a9bfd1fdf450e03d6c3c5aa182f727f10b02540

SHA256
cd8185711cc8be57ec4b04cf1d730df81a9a5b4fa15f29a66d1c064dd4db404b

SHA512
dd936aef36094d35e2410b8555e86239884885257d35b7a972767cd72e475bcab3aeb97ced5a4d70374e1bb999bd19b9a019f4dad50047664fa09d8dd75c7533

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29510.exe

Filesize
468KB

MD5
d00684d96be1caa44d5f758f697886da

SHA1
09be4e734e291bd65af99b5a9b7d1bb2054b47fa

SHA256
d4647d831dd656668dd3c7753113a2ac1d37d71b910795fe3d6e50c6ccabf893

SHA512
5bb51cb98de870860d92acc598baa178fb916670adf82831e15aed0fd423f3b342652d12af4521d8d288017a48c08054e125240fc53ffab08e4201bc2d71e52a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31234.exe

Filesize
468KB

MD5
8baa349af9efb951e72e64f5c40b3f2b

SHA1
c89690f5c26d7c81409e85c4ddcaced62811b258

SHA256
5bc7e4e39f3b0a831ada9592e4550fe7e2f9befd5ca2373d5638e48c9de3b771

SHA512
184186ce3ee9b75222011822450992b161080422ad07b0988deea10ad2544436a1ddb58cf34b0ba7412c8e8666cd232cbee457946fb227bc837ad422dffe652f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33127.exe

Filesize
468KB

MD5
66b3ec5dc845d64d5408a72e4d45df29

SHA1
f6fa19147789af061ad6561274a60a70a24cfe46

SHA256
237fec3c9bb6fd15b7b1cfa40cfdb6176b19506ab46c28a7de18830e98720919

SHA512
4a8acfe56df4bc919961501f4ffddd6f87ed7d28ab39982afebba3f588f9ee0aab8c43684a0271e67e37634515d4a57df9f8ac4e010a600e6a8cfdb1e20e78ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3335.exe

Filesize
468KB

MD5
c6eb7d01530dea58e9a0a8cca12ac677

SHA1
fa30663dd37e217219469dd204d437f2dd283e1b

SHA256
19f1b699be94f994dbe56290511d4498f4930dacd6f368bc6007d11b0b243489

SHA512
08f5a785e017bbf611002a23c31b32feb63072da1d56220743ee17d00b13f831b97139a506557c412a993b5a883e27a0cec9ebe78cc17decca3fd3c8136409da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39708.exe

Filesize
1B

MD5
93b885adfe0da089cdf634904fd59f71

SHA1
5ba93c9db0cff93f52b521d7420e43f6eda2784f

SHA256
6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d

SHA512
b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46863.exe

Filesize
468KB

MD5
a8edb80a215d8b0ef55aade36c463e38

SHA1
38294b513b3c25fff748ea50d7517e1f26f007a0

SHA256
965b404d389681eaca7694fc818f182f2be373fdaa9ee190daccf413d939f23f

SHA512
ca416bbdda53aab7d7aa41eca2adfee7019e260b12047bfe7a57dc1312d8f5945c9cb84b6281d5965ddbf085c76f4f42ec0c4e06dde2c838027bca368d953e1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-533.exe

Filesize
468KB

MD5
a986047aac85fa47172ed6c2c8d5a335

SHA1
5ed1400dad13af37ed305d11d9a0f5ab5fbc06dc

SHA256
1954e9bb50277a9e9482fdc454c87c7cfb5c70ad690b8ce04765f92aa7c54984

SHA512
109e40495dd92943e2e3673291f2c21b7dc5d4b54c29438a3d166c860ec634f7ea26aac7c4892c92c2c5cf83d79b4866930b2b16c51867c735261629d53d392a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53678.exe

Filesize
468KB

MD5
fb4ae57d41c2fb4c2ab95b738ccfcd05

SHA1
06c22a93ab172d8a145ff83128dd6cc87a25d04e

SHA256
41e7990d5aa51f81d32112cc61096ebdf58bd5b96c69949e1cb36231f6779097

SHA512
1e9bb31ce0c7a609d8d4bfe51c45e11f31429661b7b87c65d8478b7ad5b440e073cb16f27d667832e43562485cae3b1c520e0264df767b1087a331149ce7369d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53953.exe

Filesize
468KB

MD5
1d0de60bcfb85dd210c957678e3386ac

SHA1
b03259f517340792773c9e3764d17272738f9001

SHA256
1f93a36f4b4fcaa9bed19b2531138e03d3e094ebb1715c670040443ff28ca66a

SHA512
6590a64b9643943f53d565cad6bdf341cb87ebfb92d7a89f79d43729524f6eab055011f0b6b5775c9bb443673dc3bf3532fa5a76d9276ca7f26cd0883c42bbff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64482.exe

Filesize
468KB

MD5
3e1472b4096ba49a0b9e9bb22f91ed24

SHA1
963094b6695071cc4d58cb814d25135248c118f0

SHA256
23da8ce977a14882c1aaa6ffe4fb4eb1349b6e333a90c30b8b0e0706d2fac82f

SHA512
d9c56724a144a7c4558efccdbb43acefa3cb2e534d41a6be7b2a8d10992bd924b0ca46b2c05e8f79d1ceebc0a838cdac5f48f5e99146875f261d68de9cbbb7b3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-10616.exe

Filesize
468KB

MD5
03c5fb1a1f0d45d1d5484ac7e7d1ffef

SHA1
143af57dc3b62a4d8665b0558b36240ce563d70f

SHA256
7750416bff2a7fe907b9945d03429ff6a6ef37236e27dcba3432a464fb68ad6e

SHA512
a19cc7d8ffad9fec00877f782f2bba078ddcfd6df84451cf2190149e63667c0aa16b8be46bff0a625aa200637ad858b05e18aba86430980fedc2349b259ac72e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17511.exe

Filesize
468KB

MD5
3d5f19904d8c20445b6092c6bd7476ea

SHA1
f86584c294b36328c23bb946c131aef50cf05616

SHA256
a7da9941d43ba96e7b797b5d3948d3eb354e8d689312c3df9043009cfbd2e76e

SHA512
9011bf49b5e0882523a357dd273234068293127ff9ef378caacaa19c1a2a0f1e061b5aeb5179d57bff71726ffa90506dd3056040a7dfe320bc2bbea3c9fd7566

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24763.exe

Filesize
468KB

MD5
94cbb7fca13fa6413adcc93012bb0614

SHA1
2e7c4736cafd8d19e5649b2f624cb1d857177414

SHA256
eace482ed1afecb9f6064ade7eca5ace10715e60a55b4eb27b203cfbd66a1974

SHA512
a0cdf68d16a17a787738ffbaac83c6e09ccc9cc17b490700e199e2ff037573f9959b470c6f8f725e2b06040db284da2bf54ef1ca4fb7756f301eba1d4fc05e61

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32952.exe

Filesize
468KB

MD5
fa97ca5f30d7e80e62f96f0eefa582c1

SHA1
67049e41a371fe1b3d1a2ce3d3b2136288d0ed4a

SHA256
99d7f0778beed8b59f80320114a84cb12723dead27be9c1e334b283c3ccc7d04

SHA512
5ace8972dbae29e548c86f7beb4436c35b47ede75f0b46c7680f0c718a20d606ec7ec50adfb33ccec5e57cc3e1dc37c7f9f6d241a8f270f7f2bb17c31af41c35

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-44617.exe

Filesize
468KB

MD5
df517253e56701c1ca069cf479c9de6d

SHA1
55b57bd85494d1873a35f6ccb435f414ccf62695

SHA256
6f6238fc886f05b1144e99cc7181105ca8010aef34ed57fb1afb795ef5aa94be

SHA512
4fdba486f6b3f91664f259929ad800072004163f06b71fbfff33cbd6b59ffd21b0c11498b0ea58f3ca76b7adeff6356bdb11dd42d2d7e4740e7c7cda282c62da

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45785.exe

Filesize
468KB

MD5
b084ae0c039e254172b22cc60f698f15

SHA1
f7edc41d1cc5e7c0db412ddec117771e0f1b9ab9

SHA256
9e80884f1e38f318eec928247b2d3a73845e18803e886cd3e6d2b15430fd19cc

SHA512
fae4e422675616459bee29132b2505d34e808493b34314c13324e52d982b1636cfaf44926f28ac8f985f51e592f2971e4cfcdedc81986776249a11449ba4776e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47835.exe

Filesize
468KB

MD5
094cb4fd7aa1da861c6895eb587a4ffb

SHA1
b85f60e86cd2cbb57d82951d1601d5c62c862583

SHA256
94e8eaa616eadfc5f6b47f8167600e9d7c35fd05dc591e22fadf85ce770fb7b7

SHA512
58f337e8fce68e84eb756b5cc1bd09f80bf965f9f03381b28290348aba7ed4625581fe9235efafd3df75dfe0f30920c6a4b189f2b898f68732b20fe10df37f65

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54521.exe

Filesize
468KB

MD5
fee4b83ad3d360901f2c21278860c850

SHA1
27e807ae903eee0a4cf240423a49c911a083be2e

SHA256
7e546cc8825b01ba22dd1abe72a9d41d134add55e75882491b570487cbee10a3

SHA512
550b1a0822ff3e2909799f3cc65f6a7b8dbcf46a58de20cd06fb660cb2cd46b0d8c8bdcfc8df20275a954c2dbd1eabe430e5ca2491f53cc33bdcfce45176c383

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-973.exe

Filesize
468KB

MD5
be1dcc236b0eb61c25e17e2b1dab0cc1

SHA1
da2fb462bc688cdb52c4f7d466b76e4efe78aafa

SHA256
443e9392de1e6507436c9667abafd27e90856b189282d681e1414ef0eb152f92

SHA512
fbeb3c2c5392668262fea7e8f1d3ac5b6479fa1b7ebfa8f68252433af190336615f478c7ed63e9d3ee7a921643d77cec7886e62e90395dd3dc0fb7eefcf48e29

Download Submit