f88bac8d719c4711c81bd855a5356af0dd51337da1b2192e65ba47ef18d2b89a

Analysis

max time kernel
119s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-09-2024 12:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

310c0bcf19cfc6bcd5197b2ba27dfec0N.exe
Size

468KB
MD5

310c0bcf19cfc6bcd5197b2ba27dfec0
SHA1

d2d78e0091dd9bd83337b823ad397709e23d129a
SHA256

f88bac8d719c4711c81bd855a5356af0dd51337da1b2192e65ba47ef18d2b89a
SHA512

3ed26541fa3356551ea7d156103d35a8631387c1a9e363df8d3f5b89b784601266d0ea0e9a8d77157d8a64abffed8980a38e90554beff24473b2a8130a8b5592
SSDEEP

3072:EYgiogIyb45BtbYBPzqjuf8/ECObInpsnmHhQEhEHshMFPAoHdE3:EY1ok4Bt2P+jufgph0HsOhAoH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1968	Unicorn-32049.exe
2520	Unicorn-11986.exe
2056	Unicorn-53574.exe
2172	Unicorn-13221.exe
2796	Unicorn-29366.exe
2764	Unicorn-23235.exe
2728	Unicorn-38088.exe
2596	Unicorn-26481.exe
2612	Unicorn-55624.exe
1040	Unicorn-22205.exe
1384	Unicorn-42817.exe
1516	Unicorn-42552.exe
2456	Unicorn-44855.exe
1728	Unicorn-61052.exe
1652	Unicorn-50985.exe
2636	Unicorn-27908.exe
2844	Unicorn-11057.exe
1972	Unicorn-11187.exe
2072	Unicorn-4180.exe
1476	Unicorn-52495.exe
1960	Unicorn-44690.exe
1064	Unicorn-15546.exe
1620	Unicorn-31883.exe
2460	Unicorn-12017.exe
2292	Unicorn-65302.exe
780	Unicorn-48027.exe
1660	Unicorn-55930.exe
2316	Unicorn-5140.exe
484	Unicorn-11270.exe
2152	Unicorn-22760.exe
1488	Unicorn-7653.exe
1252	Unicorn-48302.exe
3060	Unicorn-28436.exe
2980	Unicorn-54616.exe
2476	Unicorn-12853.exe
2516	Unicorn-54441.exe
2752	Unicorn-8769.exe
1928	Unicorn-4420.exe
3024	Unicorn-601.exe
2816	Unicorn-58333.exe
2896	Unicorn-57778.exe
2724	Unicorn-63900.exe
2788	Unicorn-24722.exe
2716	Unicorn-772.exe
2808	Unicorn-49973.exe
1644	Unicorn-40866.exe
1624	Unicorn-48464.exe
688	Unicorn-57394.exe
1708	Unicorn-59293.exe
1196	Unicorn-13621.exe
1248	Unicorn-13621.exe
1336	Unicorn-56692.exe
2020	Unicorn-62822.exe
1164	Unicorn-62822.exe
1780	Unicorn-62557.exe
2120	Unicorn-20828.exe
2200	Unicorn-26428.exe
2940	Unicorn-60584.exe
2236	Unicorn-61945.exe
628	Unicorn-13491.exe
880	Unicorn-5920.exe
2028	Unicorn-16126.exe
1296	Unicorn-22257.exe
896	Unicorn-5463.exe

Loads dropped DLL 64 IoCs

pid	Process
2948	310c0bcf19cfc6bcd5197b2ba27dfec0N.exe
2948	310c0bcf19cfc6bcd5197b2ba27dfec0N.exe
1968	Unicorn-32049.exe
1968	Unicorn-32049.exe
2948	310c0bcf19cfc6bcd5197b2ba27dfec0N.exe
2948	310c0bcf19cfc6bcd5197b2ba27dfec0N.exe
2056	Unicorn-53574.exe
2056	Unicorn-53574.exe
2948	310c0bcf19cfc6bcd5197b2ba27dfec0N.exe
2520	Unicorn-11986.exe
2520	Unicorn-11986.exe
2948	310c0bcf19cfc6bcd5197b2ba27dfec0N.exe
1968	Unicorn-32049.exe
1968	Unicorn-32049.exe
2172	Unicorn-13221.exe
2172	Unicorn-13221.exe
2056	Unicorn-53574.exe
2056	Unicorn-53574.exe
2764	Unicorn-23235.exe
2764	Unicorn-23235.exe
2948	310c0bcf19cfc6bcd5197b2ba27dfec0N.exe
2728	Unicorn-38088.exe
2728	Unicorn-38088.exe
2948	310c0bcf19cfc6bcd5197b2ba27dfec0N.exe
1968	Unicorn-32049.exe
1968	Unicorn-32049.exe
2520	Unicorn-11986.exe
2796	Unicorn-29366.exe
2520	Unicorn-11986.exe
2796	Unicorn-29366.exe
2596	Unicorn-26481.exe
2596	Unicorn-26481.exe
2172	Unicorn-13221.exe
2172	Unicorn-13221.exe
2612	Unicorn-55624.exe
2612	Unicorn-55624.exe
2056	Unicorn-53574.exe
2056	Unicorn-53574.exe
1040	Unicorn-22205.exe
1040	Unicorn-22205.exe
2764	Unicorn-23235.exe
2764	Unicorn-23235.exe
1384	Unicorn-42817.exe
1384	Unicorn-42817.exe
1652	Unicorn-50985.exe
2728	Unicorn-38088.exe
2728	Unicorn-38088.exe
1652	Unicorn-50985.exe
2796	Unicorn-29366.exe
2796	Unicorn-29366.exe
2456	Unicorn-44855.exe
2456	Unicorn-44855.exe
1968	Unicorn-32049.exe
1968	Unicorn-32049.exe
2520	Unicorn-11986.exe
2520	Unicorn-11986.exe
1516	Unicorn-42552.exe
1516	Unicorn-42552.exe
2948	310c0bcf19cfc6bcd5197b2ba27dfec0N.exe
2948	310c0bcf19cfc6bcd5197b2ba27dfec0N.exe
2636	Unicorn-27908.exe
2636	Unicorn-27908.exe
2844	Unicorn-11057.exe
2596	Unicorn-26481.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55101.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31545.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32103.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58725.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61969.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15767.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38007.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61976.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22683.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53402.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33771.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3445.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61976.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64325.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13491.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49876.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37791.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52676.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46137.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60692.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16852.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58619.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24826.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54072.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58653.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21832.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64776.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22308.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24717.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37592.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12017.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5889.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43985.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44690.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10450.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60692.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23235.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36312.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16126.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4052.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55889.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14864.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11400.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49524.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21832.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52676.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60692.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33667.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61976.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7750.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60227.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10248.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2485.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-523.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58653.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53419.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8883.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53574.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2948	310c0bcf19cfc6bcd5197b2ba27dfec0N.exe
1968	Unicorn-32049.exe
2520	Unicorn-11986.exe
2056	Unicorn-53574.exe
2172	Unicorn-13221.exe
2764	Unicorn-23235.exe
2728	Unicorn-38088.exe
2796	Unicorn-29366.exe
2596	Unicorn-26481.exe
2612	Unicorn-55624.exe
1040	Unicorn-22205.exe
1384	Unicorn-42817.exe
1728	Unicorn-61052.exe
2456	Unicorn-44855.exe
1516	Unicorn-42552.exe
1652	Unicorn-50985.exe
2636	Unicorn-27908.exe
2844	Unicorn-11057.exe
1972	Unicorn-11187.exe
2072	Unicorn-4180.exe
1476	Unicorn-52495.exe
1960	Unicorn-44690.exe
1064	Unicorn-15546.exe
1620	Unicorn-31883.exe
2460	Unicorn-12017.exe
780	Unicorn-48027.exe
1660	Unicorn-55930.exe
2292	Unicorn-65302.exe
2316	Unicorn-5140.exe
484	Unicorn-11270.exe
2152	Unicorn-22760.exe
1488	Unicorn-7653.exe
3060	Unicorn-28436.exe
1252	Unicorn-48302.exe
2980	Unicorn-54616.exe
2476	Unicorn-12853.exe
1928	Unicorn-4420.exe
2516	Unicorn-54441.exe
3024	Unicorn-601.exe
2752	Unicorn-8769.exe
2816	Unicorn-58333.exe
2896	Unicorn-57778.exe
2724	Unicorn-63900.exe
2788	Unicorn-24722.exe
2716	Unicorn-772.exe
2808	Unicorn-49973.exe
688	Unicorn-57394.exe
1644	Unicorn-40866.exe
1624	Unicorn-48464.exe
1196	Unicorn-13621.exe
1708	Unicorn-59293.exe
1248	Unicorn-13621.exe
1780	Unicorn-62557.exe
2020	Unicorn-62822.exe
1336	Unicorn-56692.exe
1164	Unicorn-62822.exe
2120	Unicorn-20828.exe
2200	Unicorn-26428.exe
2940	Unicorn-60584.exe
2236	Unicorn-61945.exe
628	Unicorn-13491.exe
880	Unicorn-5920.exe
2028	Unicorn-16126.exe
1296	Unicorn-22257.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 1968	2948	310c0bcf19cfc6bcd5197b2ba27dfec0N.exe	30
PID 2948 wrote to memory of 1968	2948	310c0bcf19cfc6bcd5197b2ba27dfec0N.exe	30
PID 2948 wrote to memory of 1968	2948	310c0bcf19cfc6bcd5197b2ba27dfec0N.exe	30
PID 2948 wrote to memory of 1968	2948	310c0bcf19cfc6bcd5197b2ba27dfec0N.exe	30
PID 1968 wrote to memory of 2520	1968	Unicorn-32049.exe	31
PID 1968 wrote to memory of 2520	1968	Unicorn-32049.exe	31
PID 1968 wrote to memory of 2520	1968	Unicorn-32049.exe	31
PID 1968 wrote to memory of 2520	1968	Unicorn-32049.exe	31
PID 2948 wrote to memory of 2056	2948	310c0bcf19cfc6bcd5197b2ba27dfec0N.exe	32
PID 2948 wrote to memory of 2056	2948	310c0bcf19cfc6bcd5197b2ba27dfec0N.exe	32
PID 2948 wrote to memory of 2056	2948	310c0bcf19cfc6bcd5197b2ba27dfec0N.exe	32
PID 2948 wrote to memory of 2056	2948	310c0bcf19cfc6bcd5197b2ba27dfec0N.exe	32
PID 2056 wrote to memory of 2172	2056	Unicorn-53574.exe	34
PID 2056 wrote to memory of 2172	2056	Unicorn-53574.exe	34
PID 2056 wrote to memory of 2172	2056	Unicorn-53574.exe	34
PID 2056 wrote to memory of 2172	2056	Unicorn-53574.exe	34
PID 2520 wrote to memory of 2796	2520	Unicorn-11986.exe	35
PID 2520 wrote to memory of 2796	2520	Unicorn-11986.exe	35
PID 2520 wrote to memory of 2796	2520	Unicorn-11986.exe	35
PID 2520 wrote to memory of 2796	2520	Unicorn-11986.exe	35
PID 2948 wrote to memory of 2764	2948	310c0bcf19cfc6bcd5197b2ba27dfec0N.exe	36
PID 2948 wrote to memory of 2764	2948	310c0bcf19cfc6bcd5197b2ba27dfec0N.exe	36
PID 2948 wrote to memory of 2764	2948	310c0bcf19cfc6bcd5197b2ba27dfec0N.exe	36
PID 2948 wrote to memory of 2764	2948	310c0bcf19cfc6bcd5197b2ba27dfec0N.exe	36
PID 1968 wrote to memory of 2728	1968	Unicorn-32049.exe	37
PID 1968 wrote to memory of 2728	1968	Unicorn-32049.exe	37
PID 1968 wrote to memory of 2728	1968	Unicorn-32049.exe	37
PID 1968 wrote to memory of 2728	1968	Unicorn-32049.exe	37
PID 2172 wrote to memory of 2596	2172	Unicorn-13221.exe	38
PID 2172 wrote to memory of 2596	2172	Unicorn-13221.exe	38
PID 2172 wrote to memory of 2596	2172	Unicorn-13221.exe	38
PID 2172 wrote to memory of 2596	2172	Unicorn-13221.exe	38
PID 2056 wrote to memory of 2612	2056	Unicorn-53574.exe	39
PID 2056 wrote to memory of 2612	2056	Unicorn-53574.exe	39
PID 2056 wrote to memory of 2612	2056	Unicorn-53574.exe	39
PID 2056 wrote to memory of 2612	2056	Unicorn-53574.exe	39
PID 2764 wrote to memory of 1040	2764	Unicorn-23235.exe	40
PID 2764 wrote to memory of 1040	2764	Unicorn-23235.exe	40
PID 2764 wrote to memory of 1040	2764	Unicorn-23235.exe	40
PID 2764 wrote to memory of 1040	2764	Unicorn-23235.exe	40
PID 2728 wrote to memory of 1384	2728	Unicorn-38088.exe	42
PID 2728 wrote to memory of 1384	2728	Unicorn-38088.exe	42
PID 2728 wrote to memory of 1384	2728	Unicorn-38088.exe	42
PID 2728 wrote to memory of 1384	2728	Unicorn-38088.exe	42
PID 2948 wrote to memory of 1516	2948	310c0bcf19cfc6bcd5197b2ba27dfec0N.exe	41
PID 2948 wrote to memory of 1516	2948	310c0bcf19cfc6bcd5197b2ba27dfec0N.exe	41
PID 2948 wrote to memory of 1516	2948	310c0bcf19cfc6bcd5197b2ba27dfec0N.exe	41
PID 2948 wrote to memory of 1516	2948	310c0bcf19cfc6bcd5197b2ba27dfec0N.exe	41
PID 1968 wrote to memory of 2456	1968	Unicorn-32049.exe	43
PID 1968 wrote to memory of 2456	1968	Unicorn-32049.exe	43
PID 1968 wrote to memory of 2456	1968	Unicorn-32049.exe	43
PID 1968 wrote to memory of 2456	1968	Unicorn-32049.exe	43
PID 2520 wrote to memory of 1728	2520	Unicorn-11986.exe	44
PID 2520 wrote to memory of 1728	2520	Unicorn-11986.exe	44
PID 2520 wrote to memory of 1728	2520	Unicorn-11986.exe	44
PID 2520 wrote to memory of 1728	2520	Unicorn-11986.exe	44
PID 2796 wrote to memory of 1652	2796	Unicorn-29366.exe	45
PID 2796 wrote to memory of 1652	2796	Unicorn-29366.exe	45
PID 2796 wrote to memory of 1652	2796	Unicorn-29366.exe	45
PID 2796 wrote to memory of 1652	2796	Unicorn-29366.exe	45
PID 2596 wrote to memory of 2636	2596	Unicorn-26481.exe	46
PID 2596 wrote to memory of 2636	2596	Unicorn-26481.exe	46
PID 2596 wrote to memory of 2636	2596	Unicorn-26481.exe	46
PID 2596 wrote to memory of 2636	2596	Unicorn-26481.exe	46

C:\Users\Admin\AppData\Local\Temp\310c0bcf19cfc6bcd5197b2ba27dfec0N.exe
"C:\Users\Admin\AppData\Local\Temp\310c0bcf19cfc6bcd5197b2ba27dfec0N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32049.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32049.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11986.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11986.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29366.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50985.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31883.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26511.exe
        7⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3445.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40531.exe
        8⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45727.exe
        8⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43720.exe
        7⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54072.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49524.exe
        7⤵
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59293.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38007.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
        7⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45727.exe
        7⤵
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20153.exe
        6⤵
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58541.exe
        6⤵
        
        PID:4184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33387.exe
        6⤵
        
        PID:5784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65302.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62822.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2390.exe
        7⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33439.exe
        8⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5588.exe
        7⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23127.exe
        7⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41356.exe
        7⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43891.exe
        6⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15698.exe
        7⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32363.exe
        7⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64776.exe
        7⤵
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48956.exe
        6⤵
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47248.exe
        6⤵
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61969.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60584.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33771.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40669.exe
        7⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64325.exe
        7⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60692.exe
        7⤵
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15701.exe
        6⤵
        
        PID:3808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32596.exe
        6⤵
        
        PID:4656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37592.exe
        6⤵
        
        PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35609.exe
        5⤵
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18739.exe
        6⤵
        
        PID:2320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
        6⤵
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33667.exe
        6⤵
        
        PID:5820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13700.exe
        5⤵
        
        PID:1712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33340.exe
        5⤵
        
        PID:4200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29834.exe
        5⤵
        
        PID:6060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61052.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-772.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9895.exe
        6⤵
        
        PID:976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43985.exe
        7⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39052.exe
        7⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60692.exe
        7⤵
        
        PID:5340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3040.exe
        6⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21832.exe
        7⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64325.exe
        7⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60692.exe
        7⤵
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35930.exe
        6⤵
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39961.exe
        6⤵
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29270.exe
        6⤵
        
        PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28544.exe
        5⤵
        
        PID:2240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43985.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39052.exe
        6⤵
        
        PID:4736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15767.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43061.exe
        5⤵
        
        PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49876.exe
        5⤵
        
        PID:3624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20936.exe
        5⤵
        
        PID:5592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5140.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13621.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64031.exe
        6⤵
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21832.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64325.exe
        7⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23935.exe
        7⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36563.exe
        6⤵
        
        PID:3832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9015.exe
        6⤵
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7750.exe
        6⤵
        
        PID:6272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7217.exe
        5⤵
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43985.exe
        6⤵
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39052.exe
        6⤵
        
        PID:4728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40272.exe
        6⤵
        
        PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21566.exe
        5⤵
        
        PID:3752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18455.exe
        5⤵
        
        PID:4636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58422.exe
        5⤵
        
        PID:5180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62557.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21572.exe
        5⤵
        
        PID:1892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24717.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48373.exe
        6⤵
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3323.exe
        6⤵
        
        PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19952.exe
        5⤵
        
        PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52676.exe
        5⤵
        
        PID:4120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37061.exe
        5⤵
        
        PID:5252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5625.exe
      4⤵
      PID:1344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4052.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6813.exe
        6⤵
        
        PID:276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25129.exe
        6⤵
        
        PID:4868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3323.exe
        6⤵
        
        PID:4156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23403.exe
        5⤵
        
        PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43656.exe
        5⤵
        
        PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61976.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20387.exe
      4⤵
      PID:380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10338.exe
      4⤵
      PID:2548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28875.exe
      4⤵
      PID:4208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7052.exe
      4⤵
      PID:5984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38088.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38088.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42817.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15546.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24722.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64524.exe
        7⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21832.exe
        8⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37791.exe
        8⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1020.exe
        8⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44073.exe
        7⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52676.exe
        7⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42053.exe
        7⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44166.exe
        6⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43985.exe
        7⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57797.exe
        7⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37061.exe
        7⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50299.exe
        6⤵
        
        PID:3844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5368.exe
        6⤵
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-523.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49973.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18915.exe
        6⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20196.exe
        7⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25927.exe
        7⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56984.exe
        6⤵
        
        PID:3888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4931.exe
        6⤵
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21632.exe
        6⤵
        
        PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29743.exe
        5⤵
        
        PID:1700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24826.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39052.exe
        6⤵
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64776.exe
        6⤵
        
        PID:304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39636.exe
        5⤵
        
        PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49988.exe
        5⤵
        
        PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20936.exe
        5⤵
        
        PID:5712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12017.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13621.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33771.exe
        6⤵
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25724.exe
        7⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20360.exe
        7⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60692.exe
        7⤵
        
        PID:5308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65260.exe
        6⤵
        
        PID:3312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31793.exe
        6⤵
        
        PID:4676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8883.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        5⤵
        
        PID:2484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56621.exe
        6⤵
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39052.exe
        6⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64776.exe
        6⤵
        
        PID:5128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37855.exe
        5⤵
        
        PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58653.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8466.exe
        5⤵
        
        PID:6084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56692.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51120.exe
        5⤵
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6787.exe
        6⤵
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34095.exe
        6⤵
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9188.exe
        6⤵
        
        PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52459.exe
        5⤵
        
        PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52676.exe
        5⤵
        
        PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46137.exe
        5⤵
        
        PID:5676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17990.exe
      4⤵
      PID:1484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21832.exe
        5⤵
        
        PID:3908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64325.exe
        5⤵
        
        PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3323.exe
        5⤵
        
        PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9891.exe
      4⤵
      PID:3100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33340.exe
      4⤵
      PID:4192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16061.exe
      4⤵
      PID:5176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44855.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44855.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48027.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10450.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2485.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
        6⤵
        
        PID:3564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45727.exe
        6⤵
        
        PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65208.exe
        5⤵
        
        PID:960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58541.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37471.exe
        5⤵
        
        PID:5792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26428.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56.exe
        5⤵
        
        PID:1508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48837.exe
        6⤵
        
        PID:3440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37791.exe
        6⤵
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5104.exe
        6⤵
        
        PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15701.exe
        5⤵
        
        PID:3816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18388.exe
        5⤵
        
        PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-523.exe
        5⤵
        
        PID:4976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57901.exe
      4⤵
      PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58764.exe
        5⤵
        
        PID:1256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34095.exe
        5⤵
        
        PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9188.exe
        5⤵
        
        PID:4512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6522.exe
      4⤵
      PID:2420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49876.exe
      4⤵
      PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12768.exe
      4⤵
      PID:6068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55930.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55930.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40866.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42760.exe
        5⤵
        
        PID:1772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21832.exe
        6⤵
        
        PID:3900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64325.exe
        6⤵
        
        PID:5040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60692.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34538.exe
        5⤵
        
        PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18388.exe
        5⤵
        
        PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61976.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44166.exe
      4⤵
      PID:2988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21832.exe
        5⤵
        
        PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64325.exe
        5⤵
        
        PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3323.exe
        5⤵
        
        PID:3016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21566.exe
      4⤵
      PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9723.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4600.exe
      4⤵
      PID:5416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48464.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48464.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6003.exe
      4⤵
      PID:1540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6377.exe
        5⤵
        
        PID:3220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
        5⤵
        
        PID:4148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36188.exe
        5⤵
        
        PID:5924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11400.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6136.exe
      4⤵
      PID:4400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-523.exe
      4⤵
      PID:940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54243.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54243.exe
    3⤵
    PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43985.exe
      4⤵
      PID:3964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39052.exe
      4⤵
      PID:4744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11683.exe
      4⤵
      PID:5916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10421.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10421.exe
    3⤵
    PID:2772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28875.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28875.exe
    3⤵
    PID:572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11136.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11136.exe
    3⤵
    PID:5992
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53574.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53574.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13221.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13221.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26481.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27908.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7653.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61945.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47903.exe
        8⤵
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
        8⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40272.exe
        8⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35738.exe
        7⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52676.exe
        7⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25001.exe
        7⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13491.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26284.exe
        7⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34095.exe
        7⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13272.exe
        7⤵
        
        PID:4456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20153.exe
        6⤵
        
        PID:2408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58541.exe
        6⤵
        
        PID:3372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37471.exe
        6⤵
        
        PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28436.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5920.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58764.exe
        7⤵
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
        7⤵
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32103.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30538.exe
        6⤵
        
        PID:800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52676.exe
        6⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7750.exe
        6⤵
        
        PID:6256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16126.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58619.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
        6⤵
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53402.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62438.exe
        5⤵
        
        PID:1668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49876.exe
        5⤵
        
        PID:3580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20936.exe
        5⤵
        
        PID:5532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11057.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48302.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5728.exe
        6⤵
        
        PID:1328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26284.exe
        7⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
        7⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33667.exe
        7⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42982.exe
        6⤵
        
        PID:1856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52676.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46137.exe
        6⤵
        
        PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26895.exe
        5⤵
        
        PID:2352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8224.exe
        6⤵
        
        PID:316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21832.exe
        7⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37791.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29801.exe
        7⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15701.exe
        6⤵
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32596.exe
        6⤵
        
        PID:4816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37592.exe
        6⤵
        
        PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29743.exe
        5⤵
        
        PID:1724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21832.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64325.exe
        6⤵
        
        PID:5052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23935.exe
        6⤵
        
        PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61976.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9723.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49524.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54616.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22257.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
        6⤵
        
        PID:3380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50044.exe
        6⤵
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54471.exe
        6⤵
        
        PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42837.exe
        5⤵
        
        PID:864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52676.exe
        5⤵
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46137.exe
        5⤵
        
        PID:5548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5463.exe
      4⤵
      Executes dropped EXE
      PID:896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64031.exe
        5⤵
        
        PID:1060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21832.exe
        6⤵
        
        PID:3884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64325.exe
        6⤵
        
        PID:5032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60692.exe
        6⤵
        
        PID:5388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15701.exe
        5⤵
        
        PID:3800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32596.exe
        5⤵
        
        PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37592.exe
        5⤵
        
        PID:5160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55101.exe
      4⤵
      PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6787.exe
        5⤵
        
        PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
        5⤵
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33667.exe
        5⤵
        
        PID:6024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63003.exe
      4⤵
      PID:1000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50406.exe
      4⤵
      PID:3352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18401.exe
      4⤵
      PID:5748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55624.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55624.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11187.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12853.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46377.exe
        6⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55604.exe
        7⤵
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34095.exe
        7⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9188.exe
        7⤵
        
        PID:1672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5889.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52676.exe
        6⤵
        
        PID:3092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37969.exe
        6⤵
        
        PID:6044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10450.exe
        5⤵
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50835.exe
        6⤵
        
        PID:2744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
        6⤵
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33667.exe
        6⤵
        
        PID:5888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-657.exe
        5⤵
        
        PID:1008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58541.exe
        5⤵
        
        PID:3420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33387.exe
        5⤵
        
        PID:5776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54441.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31084.exe
        5⤵
        
        PID:1300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6486.exe
        6⤵
        
        PID:2000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
        6⤵
        
        PID:3504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53402.exe
        6⤵
        
        PID:5672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51966.exe
        5⤵
        
        PID:1776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52676.exe
        5⤵
        
        PID:3284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46137.exe
        5⤵
        
        PID:5540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44990.exe
      4⤵
      PID:3048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3253.exe
        5⤵
        
        PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2104.exe
        5⤵
        
        PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60692.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55889.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49876.exe
      4⤵
      PID:4176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37592.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4180.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4180.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8769.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2390.exe
        5⤵
        
        PID:2444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46962.exe
        6⤵
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39338.exe
        6⤵
        
        PID:5980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5588.exe
        5⤵
        
        PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18455.exe
        5⤵
        
        PID:4788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58422.exe
        5⤵
        
        PID:5396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60227.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24525.exe
        5⤵
        
        PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52073.exe
        5⤵
        
        PID:4388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60692.exe
        5⤵
        
        PID:5380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33129.exe
      4⤵
      PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58725.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1053.exe
      4⤵
      PID:4968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4420.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4420.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64031.exe
      4⤵
      PID:1044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28609.exe
        5⤵
        
        PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52073.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14864.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46621.exe
      4⤵
      PID:3360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
      4⤵
      PID:4708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16061.exe
      4⤵
      PID:6124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55101.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55101.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63746.exe
      4⤵
      PID:3300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
      4⤵
      PID:3428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33667.exe
      4⤵
      PID:5824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15120.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15120.exe
    3⤵
    PID:3344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39937.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39937.exe
    3⤵
    PID:4376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53419.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53419.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5496
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23235.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23235.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22205.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22205.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52495.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-601.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
        6⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56294.exe
        7⤵
        
        PID:408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21832.exe
        8⤵
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64325.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23935.exe
        8⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1966.exe
        7⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12523.exe
        7⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7750.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49724.exe
        6⤵
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22308.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34170.exe
        6⤵
        
        PID:3820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34990.exe
        6⤵
        
        PID:4672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41356.exe
        6⤵
        
        PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30787.exe
        5⤵
        
        PID:2784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34883.exe
        6⤵
        
        PID:1168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
        6⤵
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40272.exe
        6⤵
        
        PID:5856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
        5⤵
        
        PID:1428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63008.exe
        5⤵
        
        PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53609.exe
        5⤵
        
        PID:4392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58333.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28972.exe
        5⤵
        
        PID:2360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40010.exe
        6⤵
        
        PID:3724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56733.exe
        6⤵
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15767.exe
        6⤵
        
        PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51473.exe
        5⤵
        
        PID:1480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52676.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44737.exe
        5⤵
        
        PID:5724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24185.exe
      4⤵
      PID:588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2485.exe
        5⤵
        
        PID:900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
        5⤵
        
        PID:3644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36188.exe
        5⤵
        
        PID:5932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5536.exe
      4⤵
      PID:2864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49876.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20936.exe
      4⤵
      PID:5648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44690.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44690.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57778.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25848.exe
        5⤵
        
        PID:2684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10461.exe
        6⤵
        
        PID:3192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
        6⤵
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40272.exe
        6⤵
        
        PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10248.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52676.exe
        5⤵
        
        PID:3484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37061.exe
        5⤵
        
        PID:5520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50715.exe
      4⤵
      PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23866.exe
        5⤵
        
        PID:3492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9203.exe
        5⤵
        
        PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60692.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33687.exe
      4⤵
      PID:1796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58541.exe
      4⤵
      PID:4132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29303.exe
      4⤵
      PID:6052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63900.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63900.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25765.exe
      4⤵
      PID:1104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19782.exe
        5⤵
        
        PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        5⤵
        
        PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60692.exe
        5⤵
        
        PID:5300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31545.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52676.exe
      4⤵
      PID:3320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46137.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37944.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37944.exe
    3⤵
    PID:1720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
      4⤵
      PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
      4⤵
      PID:3860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40272.exe
      4⤵
      PID:5864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62901.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62901.exe
    3⤵
    PID:2024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33340.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33340.exe
    3⤵
    PID:2080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38002.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38002.exe
    3⤵
    PID:6000
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42552.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42552.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11270.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11270.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57394.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35874.exe
        5⤵
        
        PID:1788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40861.exe
        6⤵
        
        PID:3308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52073.exe
        6⤵
        
        PID:4416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64776.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42375.exe
        5⤵
        
        PID:3608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45048.exe
        5⤵
        
        PID:4972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20526.exe
        5⤵
        
        PID:6140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16008.exe
      4⤵
      PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7337.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5695.exe
        5⤵
        
        PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64776.exe
        5⤵
        
        PID:592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33879.exe
      4⤵
      PID:3708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14880.exe
      4⤵
      PID:4852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21135.exe
      4⤵
      PID:5424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56858.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56858.exe
    3⤵
    PID:2856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27182.exe
      4⤵
      PID:2008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
      4⤵
      PID:4032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53402.exe
      4⤵
      PID:5812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5536.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5536.exe
    3⤵
    PID:2212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49876.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49876.exe
    3⤵
    PID:4140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16852.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16852.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5756
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22760.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22760.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62822.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62822.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56356.exe
      4⤵
      PID:1792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56621.exe
        5⤵
        
        PID:3772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39052.exe
        5⤵
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33667.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44073.exe
      4⤵
      PID:3140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52676.exe
      4⤵
      PID:840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25001.exe
      4⤵
      PID:6036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44166.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44166.exe
    3⤵
    PID:1604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20196.exe
      4⤵
      PID:3412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43656.exe
      4⤵
      PID:4804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61976.exe
      4⤵
      PID:944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50299.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50299.exe
    3⤵
    PID:3852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58653.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58653.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57892.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57892.exe
    3⤵
    PID:5228
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20828.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20828.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5043.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5043.exe
    3⤵
    PID:2452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56538.exe
      4⤵
      PID:3656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59473.exe
      4⤵
      PID:4620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60692.exe
      4⤵
      PID:5324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43091.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43091.exe
    3⤵
    PID:3180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55913.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55913.exe
    3⤵
    PID:4932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61976.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61976.exe
    3⤵
    PID:4116
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22683.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22683.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24717.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24717.exe
    3⤵
    PID:3160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36312.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36312.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60692.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60692.exe
    3⤵
    PID:5348
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9887.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9887.exe
  2⤵
  PID:2996
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23540.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23540.exe
  2⤵
  PID:4076
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11252.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11252.exe
  2⤵
  PID:5972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11986.exe

Filesize
468KB

MD5
88d4352a8d3230e354ad9349a700ce62

SHA1
5b1865f5ffcaf149a9a1345e4db976070e005a3e

SHA256
a71acdcbd6c7eaad25cb504d5004ae8d93760fe5db764f7e71f505540e9ff981

SHA512
7fb28e6e3e2fe8d048b91228e509284318f3de3ab046da3ee650d9f62d02171da15c00dd21efae5debec9227658973212ea09b005647633dcf3dffbfc67ecc78

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26481.exe

Filesize
468KB

MD5
b5e28bfa1a96370c4acc16271e17f737

SHA1
aa4abc7162b3402688319da0b747b6ae0e243974

SHA256
01d78c8c1fca4a1dc65af87a3a62af2b4f80383a121cf3ce76876c79dabebc0d

SHA512
8ee86443c977605fb3d5d6d46ba6b1b3dec312c6ce8581ff8d0a170a5b9ad18076861647b78d16a6af6c916d4e4f20a8eac3412b380295bde1bde22b42a9217e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29366.exe

Filesize
468KB

MD5
8fb73e84ecf9206a09c036ee83f14fe2

SHA1
796fd5126bd8d7599ee959b1fc85dc494c93e196

SHA256
14d1a917f58eeb0348502281c00c777611b6b049acdaaa3e2c1d4749c5b9a3cc

SHA512
74c2d074aa28af7bd52fbf1ddc95ce0fe1588c6fe4c547bffc6a16a7cc23112e8cb8430c5778d900f602ec25911cb721d5939dbcec76aad4d7b7a33f62b303bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44855.exe

Filesize
468KB

MD5
a700aaba73cf8a59119ba9df5a18b9f9

SHA1
1fa292a1fa946d84f7a0b589df9286750b483a6e

SHA256
4b339aca48b424432abd5cbc3272629a627a110acf7c490cc43e8a7f1b247fdb

SHA512
ff470054bf784cfd55a9522cd4fd6ab6d1e74a75abd04f45f40edaa2c78e602326474ff580bfa5a919184ee525a9ed15e0a97ad567485e40f8d49d12438dc347

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50985.exe

Filesize
468KB

MD5
d84bcff870f5ac3013d01835ad2cc1ce

SHA1
960c49b34320a75090c23adc5456a3f681ac3092

SHA256
3ca668922f745aeb161aac73df47d9adef231fdfe5428d656710e8e72c0ce0c4

SHA512
3814f8c5df7d5418fad6de0bcbe23f23f02be45b8c2407cddd006e4629d71127137a3ed4e7405ec9c467f7bc2fc637fd8f9bb4e62b0f7db0cc6fb6ede1ea2ff5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5728.exe

Filesize
468KB

MD5
9837c951dc06263344bbee785f8b46ba

SHA1
9ed44b33fef099ca105d5cfa83a30761d7cf48fd

SHA256
3778557e0bfad54c0489aef1ef11e30433d33d5b6a08f58f219f7e8d18abb27a

SHA512
1241259b8279df2a615db05d095c9afa7a6fd155ae6741dccd10c49ec4858d676908a2f47b3fb9258430228ed91db8c2783ada95a856fe70e200ecc1f89a2e56

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5920.exe

Filesize
468KB

MD5
dbc274ecaaad03ff8535af78565d914b

SHA1
e5c9f2b120335542dd168e28e823efec320e98e5

SHA256
5d8db97240d598b4fd774e553720c7e05d3d97d7caf6e0be713663032bd1da9f

SHA512
a9a52ff7e78750394bd81ab59bd9f83c2a7f4572fb3174409020e5dd18b885aa305c4f51b530b37c8fdd275c468a2a4249b73857a322e3cf0ac10e71683bb7be

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-11057.exe

Filesize
468KB

MD5
33e3b0e8a0306f9ac40e147fbfe71a9c

SHA1
4105da6b87a44e74c815e4a0b63de7c3ce265072

SHA256
8f1f4402ca20afdce8200b3b1e92c9e600ef55efdf92817b7609c7218a520d96

SHA512
1cbf788f26c2deacd587b7770b0d49f9d1aa11e0079c22892328f17424e62a59408a0f3317517316bbd47821672c57fa2c81da68f283b842ee4876cd21819230

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-11187.exe

Filesize
468KB

MD5
a405e3d076c551c2965f4bf7535c6c85

SHA1
9446393c7f94fbbc4a11ecb6bf9511310a3abddb

SHA256
df5da42cdc5ad2e8804151671fb506426053ffabc2fd63f346390282fe0d40e1

SHA512
ded5308044539da3f2377b318e2e9c86b1b9c19a59f85f507ecffe917e0451295ae33b4241d705f494df21473de3e874b9fe6a31ecfc74943bc165192f183e09

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13221.exe

Filesize
468KB

MD5
d075e698bb2411790775f91dce98a3c2

SHA1
e29bbb87e739596ef18ca9da00a0c15dbf4062ca

SHA256
a45ec0135271818fcb03efb4731bc3c033c6d1e51b66476f9bd0c2a7394a1a71

SHA512
1fb5650bdd581708172ce1c7263b9d35d4ec783ac55c893a4d85d21a037203d4d6efb03b0d59dc7c85b90209cd38556d5ccfe42bd49dddda7b094c22c33df179

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22205.exe

Filesize
468KB

MD5
2ac69c366ceb3791663ba7e1f59d3b7b

SHA1
b34a9069318fc605d375c0e50dce7233abbc106a

SHA256
dea45ee2655ab664648d7adbd5edee44f66127f54e8ba132190309e9bba4c184

SHA512
43bd1f083816cd84452b8eb3fc91724bf5093579142485376203fca6b965dec60f5697b69ef3facb81c485cf493bd6c67dfd712e7510bbe1f29289bf05e27495

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23235.exe

Filesize
468KB

MD5
c24bbb8e8b83d41e4ae43e84273ed0d4

SHA1
d68fddefa3c6046f614e452be2bf342c247a73df

SHA256
cd7a2d308feb5899a8fb51ae8ea609930782bfc52dfcdf2eb9be895961f0fde3

SHA512
a3a44578fa2700a8007802181527e66bba3b5dde189bb8edaf238130f38cc9047fc5254909b3dea1f22cdf2483dd76529a67949e13ad941527c38f8a2d2396eb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27908.exe

Filesize
468KB

MD5
1b2ebb671d407ced6453632c43102578

SHA1
912f77399596ba41bf183dddc48edcc63ae5c68d

SHA256
4cec8eabade6eec9ae1496b17de8df8a4093199fe497bbfa8da26ac4d7611623

SHA512
84320ef6e90f9b994cfe63e72bcf333c3f9f6f3551ab164a508b49a4762b818f9b108277943d7aced076f355b0b1b94f185c677ec3641ac6f9a83076ed6d8df2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32049.exe

Filesize
468KB

MD5
2806c10e3a25ee0997c864945dc4c077

SHA1
1c93a828f08a0cec4ceb28fd561bb0c342a70f41

SHA256
486a34b0a72081889d6f505f99100ddb12a43624ba67b9b2bc099e2b4656b57d

SHA512
43a4552208703c4f519e65f7e59e5ed5f086b5133981df9e74b9731a302b8fa945a5c5e783dd68df62e11bf4bd5deadf2565de767608422269074434339686e2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38088.exe

Filesize
468KB

MD5
f3b7dfb522087ca7899e279693a5ecb6

SHA1
e0343f81143dad0dc64e15e1da891c4c8ae2278b

SHA256
0dbb7d11dcbad93504f5e7298df08555fc67074b085a14c45d1c101356e83721

SHA512
70971edc0a976677f9e36f8f413425bb5125b0498904111d771c4cf07ae3c645a8ea0184d5dabb10ca6c744111da1690f404ac1a5675438e0caaa4874574d4e2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4180.exe

Filesize
468KB

MD5
aa24e77dfb04b6a136c6b6a04dbacc16

SHA1
379a69f716a792225bf7529810da9699a01b5ca9

SHA256
6005ece56a3934b50137d1449c6086e5659e6ce0d5a9503ae675bb5b578e79d5

SHA512
0900c2b93df071ec344488ea9f019aa3fee7ec1927c0d5526a4b8899ac87c211465b27a0215542822df3f8f327cb9133e760c80b1bb992d734b59f1b5038fd12

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42552.exe

Filesize
468KB

MD5
c9da2e7c95b60c680ea54d33fb4015b6

SHA1
3d78622403e4e336933cfbac95bf38cdc18cb6ff

SHA256
dad0990ba5eebd6a729baba951133f6b8a29aec5f799b1bf4dd18117a2caf043

SHA512
6999b3de19ad2134f27626ef85c7a929562f0bef1c6c82c2c04dc204afe8b00a7a04636fb94558a00074014d102d6ccf3fccc0171bb547791c7b77ce6c13f857

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42817.exe

Filesize
468KB

MD5
a7f333807bb0e0801c8611039cb5332c

SHA1
a0e665a605db8b2d2e326417345fa5b8d8c07a26

SHA256
74761f3a5f9999e6b26da843bd8649e06091c0c25684a82b15a6006401eef520

SHA512
7cfdbd2045e147b532b62095a43a9eedb7a6f4329b8dfb91984d2c74f3e82cf2dcaa505d65bd8cf171d3ea1946900aca61f31ca98bfa7edc65a42e59909c46b4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53574.exe

Filesize
468KB

MD5
1d365630913cd7362197bcd56f833dd5

SHA1
f83cb99335e35abb5d4a7c2d3620ad5752ea98ed

SHA256
5ed096b51a2c30a56ac791451062070071f0d0f9b9987128674f4a5796d1da03

SHA512
f85aea6deea2ceb4a00452e030bbd9b301fb61e9d969fcc074673268a07a64ac3521c2f9f89e76d310b44e162fd1fc1945227368af8b5e8f3f668e627c3026c1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55624.exe

Filesize
468KB

MD5
6cef72415c8cb60c2016f5239f46ffdc

SHA1
8fd6a1fe2febbff5474423feaeefa76442dcc4e0

SHA256
b6b96286f82f263701d5f6b07016e93c83f1d443b1d2c4b888e2d210cc6ad47f

SHA512
dab03d2d47b2ca0d685edf295857b7012506bcfc9d9d79fa93a65bf2bac72319e048a87b04ecddf48caa84d4bd15853a341bcc777b56025e0f38bf8046ce7682

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61052.exe

Filesize
468KB

MD5
568dba12cce6ad77176591c664747050

SHA1
5f25b0f18ab78a795ba8c0a90c88e0720ae207ab

SHA256
2663c7c99ae93622a4b26487f3e88a2db7090dea6671b9798ca90968ddb31cf3

SHA512
150e40f91c6d53f0b170d115209dda03faa822bfbee4b758133de2bf3016e244bf2aac7760777c9b28319c7120819516f3c2872ac8e19b9c646b0083574da059

Download Submit