2c65784ec26f4ed27c6a2ee9f5d58ed9fdb67ba7f255f12fe5d889576773f057

Analysis

max time kernel
150s
max time network
20s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 20:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c65784ec26f4ed27c6a2ee9f5d58ed9fdb67ba7f255f12fe5d889576773f057.exe
Size

468KB
MD5

45688a89c1a492607db218c96ce49f54
SHA1

c65ec9698aea621236d53c6753618f584036413b
SHA256

2c65784ec26f4ed27c6a2ee9f5d58ed9fdb67ba7f255f12fe5d889576773f057
SHA512

62a7de2d0ec13f4a8ffde487b133433141642ec15c087dd9706cdb641be3ff503c1c13ecb3ba1bc6b4909c7f66289dc5839d2ed4d321e6df401e3e2784064c88
SSDEEP

3072:cqmzogu3j2822bYYPz3gcf8/JC6jy4plPmHx8/HfMOC+VGwN+xlc:cqKobX22fPDgcfJEcCMOFEwN+

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2096	Unicorn-43814.exe
2080	Unicorn-46611.exe
2792	Unicorn-51250.exe
2768	Unicorn-23944.exe
2740	Unicorn-54670.exe
2616	Unicorn-5561.exe
2604	Unicorn-34804.exe
2944	Unicorn-11373.exe
2104	Unicorn-63175.exe
2064	Unicorn-63175.exe
1236	Unicorn-17504.exe
2276	Unicorn-17504.exe
2416	Unicorn-17504.exe
2072	Unicorn-17504.exe
2044	Unicorn-36974.exe
2328	Unicorn-7244.exe
1912	Unicorn-52916.exe
1740	Unicorn-46258.exe
1316	Unicorn-48469.exe
3012	Unicorn-32687.exe
1456	Unicorn-27233.exe
1728	Unicorn-63435.exe
772	Unicorn-49792.exe
2548	Unicorn-47099.exe
832	Unicorn-5112.exe
2312	Unicorn-14042.exe
2964	Unicorn-20265.exe
1528	Unicorn-7912.exe
828	Unicorn-58474.exe
2496	Unicorn-1773.exe
1600	Unicorn-38630.exe
2268	Unicorn-20710.exe
2772	Unicorn-98.exe
2780	Unicorn-19964.exe
1688	Unicorn-14317.exe
2880	Unicorn-5387.exe
948	Unicorn-63061.exe
3052	Unicorn-5142.exe
2464	Unicorn-45236.exe
2896	Unicorn-24000.exe
2056	Unicorn-31422.exe
2440	Unicorn-60072.exe
2872	Unicorn-42989.exe
2128	Unicorn-33259.exe
1716	Unicorn-63885.exe
2060	Unicorn-949.exe
2180	Unicorn-54255.exe
1612	Unicorn-870.exe
2092	Unicorn-31505.exe
1476	Unicorn-20383.exe
2408	Unicorn-40249.exe
1684	Unicorn-31624.exe
1108	Unicorn-23721.exe
1616	Unicorn-54347.exe
2424	Unicorn-46855.exe
1696	Unicorn-59662.exe
2980	Unicorn-50747.exe
2736	Unicorn-28743.exe
2828	Unicorn-48609.exe
2384	Unicorn-33918.exe
2596	Unicorn-62506.exe
2796	Unicorn-62506.exe
2652	Unicorn-51935.exe
1624	Unicorn-52200.exe

Loads dropped DLL 64 IoCs

pid	Process
904	2c65784ec26f4ed27c6a2ee9f5d58ed9fdb67ba7f255f12fe5d889576773f057.exe
904	2c65784ec26f4ed27c6a2ee9f5d58ed9fdb67ba7f255f12fe5d889576773f057.exe
2096	Unicorn-43814.exe
2096	Unicorn-43814.exe
904	2c65784ec26f4ed27c6a2ee9f5d58ed9fdb67ba7f255f12fe5d889576773f057.exe
904	2c65784ec26f4ed27c6a2ee9f5d58ed9fdb67ba7f255f12fe5d889576773f057.exe
2080	Unicorn-46611.exe
2792	Unicorn-51250.exe
2080	Unicorn-46611.exe
2792	Unicorn-51250.exe
904	2c65784ec26f4ed27c6a2ee9f5d58ed9fdb67ba7f255f12fe5d889576773f057.exe
904	2c65784ec26f4ed27c6a2ee9f5d58ed9fdb67ba7f255f12fe5d889576773f057.exe
2096	Unicorn-43814.exe
2096	Unicorn-43814.exe
2096	Unicorn-43814.exe
2096	Unicorn-43814.exe
2792	Unicorn-51250.exe
2080	Unicorn-46611.exe
2792	Unicorn-51250.exe
2080	Unicorn-46611.exe
2604	Unicorn-34804.exe
2768	Unicorn-23944.exe
2616	Unicorn-5561.exe
2740	Unicorn-54670.exe
2604	Unicorn-34804.exe
2740	Unicorn-54670.exe
2616	Unicorn-5561.exe
904	2c65784ec26f4ed27c6a2ee9f5d58ed9fdb67ba7f255f12fe5d889576773f057.exe
904	2c65784ec26f4ed27c6a2ee9f5d58ed9fdb67ba7f255f12fe5d889576773f057.exe
2944	Unicorn-11373.exe
2944	Unicorn-11373.exe
2768	Unicorn-23944.exe
2768	Unicorn-23944.exe
2096	Unicorn-43814.exe
2096	Unicorn-43814.exe
2416	Unicorn-17504.exe
2416	Unicorn-17504.exe
2604	Unicorn-34804.exe
2616	Unicorn-5561.exe
2604	Unicorn-34804.exe
2616	Unicorn-5561.exe
2072	Unicorn-17504.exe
2044	Unicorn-36974.exe
2740	Unicorn-54670.exe
2740	Unicorn-54670.exe
2044	Unicorn-36974.exe
2072	Unicorn-17504.exe
2064	Unicorn-63175.exe
904	2c65784ec26f4ed27c6a2ee9f5d58ed9fdb67ba7f255f12fe5d889576773f057.exe
2792	Unicorn-51250.exe
2104	Unicorn-63175.exe
2064	Unicorn-63175.exe
2792	Unicorn-51250.exe
904	2c65784ec26f4ed27c6a2ee9f5d58ed9fdb67ba7f255f12fe5d889576773f057.exe
2104	Unicorn-63175.exe
1912	Unicorn-52916.exe
1912	Unicorn-52916.exe
2768	Unicorn-23944.exe
2768	Unicorn-23944.exe
2328	Unicorn-7244.exe
2328	Unicorn-7244.exe
2944	Unicorn-11373.exe
2944	Unicorn-11373.exe
1236	Unicorn-17504.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24339.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43215.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20754.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38764.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51250.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22010.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11636.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32279.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58414.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31505.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37074.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21889.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3283.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31233.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22228.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3004.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23944.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28990.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36422.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1781.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43420.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55564.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45142.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46611.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63061.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49298.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19870.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46204.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19870.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5142.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41401.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58276.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13790.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17504.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29575.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54127.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12468.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48884.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41401.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6471.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43966.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41401.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60144.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47386.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29865.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43420.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6471.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17341.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7895.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32279.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6144.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15486.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59972.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10875.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23216.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36422.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22686.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46258.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22028.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
904	2c65784ec26f4ed27c6a2ee9f5d58ed9fdb67ba7f255f12fe5d889576773f057.exe
2096	Unicorn-43814.exe
2080	Unicorn-46611.exe
2792	Unicorn-51250.exe
2740	Unicorn-54670.exe
2768	Unicorn-23944.exe
2604	Unicorn-34804.exe
2616	Unicorn-5561.exe
2944	Unicorn-11373.exe
1236	Unicorn-17504.exe
2104	Unicorn-63175.exe
2416	Unicorn-17504.exe
2072	Unicorn-17504.exe
2064	Unicorn-63175.exe
2044	Unicorn-36974.exe
1912	Unicorn-52916.exe
2328	Unicorn-7244.exe
1740	Unicorn-46258.exe
1316	Unicorn-48469.exe
3012	Unicorn-32687.exe
832	Unicorn-5112.exe
1728	Unicorn-63435.exe
2548	Unicorn-47099.exe
1456	Unicorn-27233.exe
1528	Unicorn-7912.exe
772	Unicorn-49792.exe
2964	Unicorn-20265.exe
2312	Unicorn-14042.exe
2496	Unicorn-1773.exe
828	Unicorn-58474.exe
2780	Unicorn-19964.exe
1600	Unicorn-38630.exe
2268	Unicorn-20710.exe
2880	Unicorn-5387.exe
1688	Unicorn-14317.exe
2772	Unicorn-98.exe
948	Unicorn-63061.exe
3052	Unicorn-5142.exe
2464	Unicorn-45236.exe
2896	Unicorn-24000.exe
2056	Unicorn-31422.exe
2440	Unicorn-60072.exe
2872	Unicorn-42989.exe
2128	Unicorn-33259.exe
1716	Unicorn-63885.exe
2060	Unicorn-949.exe
2180	Unicorn-54255.exe
1612	Unicorn-870.exe
2092	Unicorn-31505.exe
2408	Unicorn-40249.exe
1476	Unicorn-20383.exe
1684	Unicorn-31624.exe
1616	Unicorn-54347.exe
1108	Unicorn-23721.exe
2424	Unicorn-46855.exe
1696	Unicorn-59662.exe
2736	Unicorn-28743.exe
2828	Unicorn-48609.exe
2980	Unicorn-50747.exe
2384	Unicorn-33918.exe
1624	Unicorn-52200.exe
2796	Unicorn-62506.exe
2596	Unicorn-62506.exe
2652	Unicorn-51935.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 2096	904	2c65784ec26f4ed27c6a2ee9f5d58ed9fdb67ba7f255f12fe5d889576773f057.exe	29
PID 904 wrote to memory of 2096	904	2c65784ec26f4ed27c6a2ee9f5d58ed9fdb67ba7f255f12fe5d889576773f057.exe	29
PID 904 wrote to memory of 2096	904	2c65784ec26f4ed27c6a2ee9f5d58ed9fdb67ba7f255f12fe5d889576773f057.exe	29
PID 904 wrote to memory of 2096	904	2c65784ec26f4ed27c6a2ee9f5d58ed9fdb67ba7f255f12fe5d889576773f057.exe	29
PID 2096 wrote to memory of 2080	2096	Unicorn-43814.exe	30
PID 2096 wrote to memory of 2080	2096	Unicorn-43814.exe	30
PID 2096 wrote to memory of 2080	2096	Unicorn-43814.exe	30
PID 2096 wrote to memory of 2080	2096	Unicorn-43814.exe	30
PID 904 wrote to memory of 2792	904	2c65784ec26f4ed27c6a2ee9f5d58ed9fdb67ba7f255f12fe5d889576773f057.exe	31
PID 904 wrote to memory of 2792	904	2c65784ec26f4ed27c6a2ee9f5d58ed9fdb67ba7f255f12fe5d889576773f057.exe	31
PID 904 wrote to memory of 2792	904	2c65784ec26f4ed27c6a2ee9f5d58ed9fdb67ba7f255f12fe5d889576773f057.exe	31
PID 904 wrote to memory of 2792	904	2c65784ec26f4ed27c6a2ee9f5d58ed9fdb67ba7f255f12fe5d889576773f057.exe	31
PID 2080 wrote to memory of 2768	2080	Unicorn-46611.exe	32
PID 2080 wrote to memory of 2768	2080	Unicorn-46611.exe	32
PID 2080 wrote to memory of 2768	2080	Unicorn-46611.exe	32
PID 2080 wrote to memory of 2768	2080	Unicorn-46611.exe	32
PID 2792 wrote to memory of 2740	2792	Unicorn-51250.exe	33
PID 2792 wrote to memory of 2740	2792	Unicorn-51250.exe	33
PID 2792 wrote to memory of 2740	2792	Unicorn-51250.exe	33
PID 2792 wrote to memory of 2740	2792	Unicorn-51250.exe	33
PID 904 wrote to memory of 2616	904	2c65784ec26f4ed27c6a2ee9f5d58ed9fdb67ba7f255f12fe5d889576773f057.exe	34
PID 904 wrote to memory of 2616	904	2c65784ec26f4ed27c6a2ee9f5d58ed9fdb67ba7f255f12fe5d889576773f057.exe	34
PID 904 wrote to memory of 2616	904	2c65784ec26f4ed27c6a2ee9f5d58ed9fdb67ba7f255f12fe5d889576773f057.exe	34
PID 904 wrote to memory of 2616	904	2c65784ec26f4ed27c6a2ee9f5d58ed9fdb67ba7f255f12fe5d889576773f057.exe	34
PID 2096 wrote to memory of 2604	2096	Unicorn-43814.exe	35
PID 2096 wrote to memory of 2604	2096	Unicorn-43814.exe	35
PID 2096 wrote to memory of 2604	2096	Unicorn-43814.exe	35
PID 2096 wrote to memory of 2604	2096	Unicorn-43814.exe	35
PID 2096 wrote to memory of 2944	2096	Unicorn-43814.exe	36
PID 2096 wrote to memory of 2944	2096	Unicorn-43814.exe	36
PID 2096 wrote to memory of 2944	2096	Unicorn-43814.exe	36
PID 2096 wrote to memory of 2944	2096	Unicorn-43814.exe	36
PID 2792 wrote to memory of 2104	2792	Unicorn-51250.exe	37
PID 2792 wrote to memory of 2104	2792	Unicorn-51250.exe	37
PID 2792 wrote to memory of 2104	2792	Unicorn-51250.exe	37
PID 2792 wrote to memory of 2104	2792	Unicorn-51250.exe	37
PID 2080 wrote to memory of 2064	2080	Unicorn-46611.exe	38
PID 2080 wrote to memory of 2064	2080	Unicorn-46611.exe	38
PID 2080 wrote to memory of 2064	2080	Unicorn-46611.exe	38
PID 2080 wrote to memory of 2064	2080	Unicorn-46611.exe	38
PID 2604 wrote to memory of 2416	2604	Unicorn-34804.exe	39
PID 2604 wrote to memory of 2416	2604	Unicorn-34804.exe	39
PID 2604 wrote to memory of 2416	2604	Unicorn-34804.exe	39
PID 2604 wrote to memory of 2416	2604	Unicorn-34804.exe	39
PID 2740 wrote to memory of 2072	2740	Unicorn-54670.exe	42
PID 2740 wrote to memory of 2072	2740	Unicorn-54670.exe	42
PID 2740 wrote to memory of 2072	2740	Unicorn-54670.exe	42
PID 2740 wrote to memory of 2072	2740	Unicorn-54670.exe	42
PID 2616 wrote to memory of 1236	2616	Unicorn-5561.exe	41
PID 2616 wrote to memory of 1236	2616	Unicorn-5561.exe	41
PID 2616 wrote to memory of 1236	2616	Unicorn-5561.exe	41
PID 2616 wrote to memory of 1236	2616	Unicorn-5561.exe	41
PID 904 wrote to memory of 2044	904	2c65784ec26f4ed27c6a2ee9f5d58ed9fdb67ba7f255f12fe5d889576773f057.exe	43
PID 904 wrote to memory of 2044	904	2c65784ec26f4ed27c6a2ee9f5d58ed9fdb67ba7f255f12fe5d889576773f057.exe	43
PID 904 wrote to memory of 2044	904	2c65784ec26f4ed27c6a2ee9f5d58ed9fdb67ba7f255f12fe5d889576773f057.exe	43
PID 904 wrote to memory of 2044	904	2c65784ec26f4ed27c6a2ee9f5d58ed9fdb67ba7f255f12fe5d889576773f057.exe	43
PID 2944 wrote to memory of 2328	2944	Unicorn-11373.exe	44
PID 2944 wrote to memory of 2328	2944	Unicorn-11373.exe	44
PID 2944 wrote to memory of 2328	2944	Unicorn-11373.exe	44
PID 2944 wrote to memory of 2328	2944	Unicorn-11373.exe	44
PID 2768 wrote to memory of 1912	2768	Unicorn-23944.exe	45
PID 2768 wrote to memory of 1912	2768	Unicorn-23944.exe	45
PID 2768 wrote to memory of 1912	2768	Unicorn-23944.exe	45
PID 2768 wrote to memory of 1912	2768	Unicorn-23944.exe	45

C:\Users\Admin\AppData\Local\Temp\2c65784ec26f4ed27c6a2ee9f5d58ed9fdb67ba7f255f12fe5d889576773f057.exe
"C:\Users\Admin\AppData\Local\Temp\2c65784ec26f4ed27c6a2ee9f5d58ed9fdb67ba7f255f12fe5d889576773f057.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:904
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43814.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43814.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46611.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46611.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
        5⤵
        Executes dropped EXE
        
        PID:2276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52916.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58474.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48609.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38154.exe
        8⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8003.exe
        8⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        8⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4830.exe
        8⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41740.exe
        8⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43420.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21163.exe
        7⤵
        
        PID:812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7646.exe
        7⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8479.exe
        7⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19112.exe
        7⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20754.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22028.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46126.exe
        6⤵
        
        PID:2608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14487.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28865.exe
        6⤵
        
        PID:3444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29865.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20046.exe
        6⤵
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47204.exe
        6⤵
        
        PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1773.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33918.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49037.exe
        6⤵
        
        PID:3040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36592.exe
        6⤵
        
        PID:3152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        6⤵
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32233.exe
        6⤵
        
        PID:4740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41401.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56699.exe
        6⤵
        
        PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51935.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59972.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17256.exe
        5⤵
        
        PID:3168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23216.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
        5⤵
        
        PID:3644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14535.exe
        5⤵
        
        PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63175.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20265.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46855.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44450.exe
        7⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16795.exe
        7⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17287.exe
        7⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54066.exe
        7⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51476.exe
        7⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58806.exe
        7⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21889.exe
        7⤵
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21163.exe
        6⤵
        
        PID:2572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30698.exe
        6⤵
        
        PID:1640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27756.exe
        6⤵
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49508.exe
        6⤵
        
        PID:3392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45978.exe
        6⤵
        
        PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59662.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21617.exe
        6⤵
        
        PID:1708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59727.exe
        6⤵
        
        PID:316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24339.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31352.exe
        6⤵
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38764.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24335.exe
        6⤵
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6471.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15486.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13790.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62380.exe
        5⤵
        
        PID:3360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6151.exe
        5⤵
        
        PID:3540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39294.exe
        5⤵
        
        PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19870.exe
        5⤵
        
        PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45142.exe
        5⤵
        
        PID:6072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63061.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19720.exe
        5⤵
        
        PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40261.exe
        5⤵
        
        PID:2108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23153.exe
        5⤵
        
        PID:3912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37232.exe
        5⤵
        
        PID:2712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3004.exe
        5⤵
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37275.exe
        5⤵
        
        PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18500.exe
        5⤵
        
        PID:5340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-483.exe
      4⤵
      PID:928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54127.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15847.exe
      4⤵
      PID:3244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1686.exe
      4⤵
      PID:3416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12428.exe
      4⤵
      PID:2336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18735.exe
      4⤵
      PID:4580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21607.exe
      4⤵
      PID:6096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34804.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34804.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48469.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14317.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31505.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21036.exe
        8⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38134.exe
        8⤵
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61076.exe
        8⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20828.exe
        8⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53832.exe
        7⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30698.exe
        7⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49861.exe
        7⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29865.exe
        7⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19870.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51364.exe
        7⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20383.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21617.exe
        7⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59727.exe
        7⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54189.exe
        7⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        7⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7535.exe
        7⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6144.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13348.exe
        6⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33766.exe
        7⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25732.exe
        7⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13790.exe
        6⤵
        
        PID:2320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64518.exe
        6⤵
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11221.exe
        6⤵
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1037.exe
        6⤵
        
        PID:4052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24447.exe
        6⤵
        
        PID:5032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20638.exe
        6⤵
        
        PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5142.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54530.exe
        6⤵
        
        PID:1856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45529.exe
        6⤵
        
        PID:1332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36592.exe
        6⤵
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        6⤵
        
        PID:3292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1507.exe
        6⤵
        
        PID:4728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41401.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50477.exe
        6⤵
        
        PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3283.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13790.exe
        5⤵
        
        PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51389.exe
        5⤵
        
        PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1390.exe
        5⤵
        
        PID:908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8334.exe
        5⤵
        
        PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14535.exe
        5⤵
        
        PID:4996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55564.exe
        5⤵
        
        PID:5864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32687.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23721.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35706.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33432.exe
        6⤵
        
        PID:1520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27593.exe
        6⤵
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35784.exe
        6⤵
        
        PID:4080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12581.exe
        6⤵
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58806.exe
        6⤵
        
        PID:4640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21889.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38974.exe
        5⤵
        
        PID:1908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10110.exe
        5⤵
        
        PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23153.exe
        5⤵
        
        PID:3876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37232.exe
        5⤵
        
        PID:3792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12799.exe
        5⤵
        
        PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41401.exe
        5⤵
        
        PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50477.exe
        5⤵
        
        PID:6048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54347.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24497.exe
        5⤵
        
        PID:1596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24832.exe
        5⤵
        
        PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        5⤵
        
        PID:3284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31233.exe
        5⤵
        
        PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7205.exe
        5⤵
        
        PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26892.exe
        5⤵
        
        PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1948.exe
      4⤵
      PID:2940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22032.exe
      4⤵
      PID:1820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1390.exe
      4⤵
      PID:3140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8334.exe
      4⤵
      PID:4400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31940.exe
      4⤵
      PID:4068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22700.exe
      4⤵
      PID:5380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11373.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11373.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7244.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38630.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62506.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49037.exe
        6⤵
        
        PID:964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1781.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        6⤵
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-507.exe
        6⤵
        
        PID:3596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28912.exe
        6⤵
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43420.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18520.exe
        5⤵
        
        PID:1956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25177.exe
        6⤵
        
        PID:1744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34278.exe
        6⤵
        
        PID:3832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17474.exe
        6⤵
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38000.exe
        6⤵
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58276.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61165.exe
        6⤵
        
        PID:5816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46126.exe
        5⤵
        
        PID:1940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60448.exe
        5⤵
        
        PID:3460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16138.exe
        5⤵
        
        PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39501.exe
        5⤵
        
        PID:4576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38328.exe
        5⤵
        
        PID:4168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32814.exe
        5⤵
        
        PID:5316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20710.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54255.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20455.exe
        6⤵
        
        PID:3608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49567.exe
        6⤵
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6011.exe
        6⤵
        
        PID:4172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12468.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53832.exe
        5⤵
        
        PID:2852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13675.exe
        5⤵
        
        PID:2372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24087.exe
        5⤵
        
        PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29479.exe
        5⤵
        
        PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47386.exe
        5⤵
        
        PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6471.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-870.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7895.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10875.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33696.exe
      4⤵
      PID:3648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30010.exe
      4⤵
      PID:3372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24447.exe
      4⤵
      PID:5000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51364.exe
      4⤵
      PID:5832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46258.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46258.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19964.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33259.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62506.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19806.exe
        7⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61855.exe
        7⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32279.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54113.exe
        7⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42890.exe
        7⤵
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49037.exe
        6⤵
        
        PID:3028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36592.exe
        6⤵
        
        PID:3076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57876.exe
        6⤵
        
        PID:4064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47386.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6471.exe
        6⤵
        
        PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46.exe
        5⤵
        
        PID:1964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19806.exe
        6⤵
        
        PID:2040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61855.exe
        6⤵
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38192.exe
        6⤵
        
        PID:4180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40871.exe
        6⤵
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61165.exe
        6⤵
        
        PID:5884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46126.exe
        5⤵
        
        PID:616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14487.exe
        5⤵
        
        PID:3892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60144.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34166.exe
        5⤵
        
        PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42528.exe
        5⤵
        
        PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5078.exe
        5⤵
        
        PID:5216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-949.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17341.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59727.exe
        5⤵
        
        PID:1480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53687.exe
        5⤵
        
        PID:4044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4944.exe
        5⤵
        
        PID:4028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29647.exe
        5⤵
        
        PID:5036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19870.exe
        5⤵
        
        PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45142.exe
        5⤵
        
        PID:6040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22092.exe
      4⤵
      PID:1776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13790.exe
      4⤵
      PID:1868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27569.exe
      4⤵
      PID:3332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9942.exe
      4⤵
      PID:3724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8334.exe
      4⤵
      PID:4412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14535.exe
      4⤵
      PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39036.exe
      4⤵
      PID:5288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5387.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5387.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63386.exe
      4⤵
      PID:2232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61113.exe
      4⤵
      PID:3312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11636.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38000.exe
      4⤵
      PID:4464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40871.exe
      4⤵
      PID:4856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37074.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37074.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10195.exe
      4⤵
      PID:5112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4627.exe
      4⤵
      PID:5472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50435.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50435.exe
    3⤵
    PID:3064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59023.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59023.exe
    3⤵
    PID:3968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10897.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10897.exe
    3⤵
    PID:3380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7199.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7199.exe
    3⤵
    PID:4420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8404.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8404.exe
    3⤵
    PID:4544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9628.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9628.exe
    3⤵
    PID:5892
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51250.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51250.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54670.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54670.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47099.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31422.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52200.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39941.exe
        8⤵
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18399.exe
        8⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43671.exe
        8⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14606.exe
        8⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49037.exe
        7⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1781.exe
        7⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        7⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31233.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28912.exe
        7⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43420.exe
        7⤵
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
        6⤵
        
        PID:1828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62772.exe
        6⤵
        
        PID:1944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42457.exe
        6⤵
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22228.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41401.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50477.exe
        6⤵
        
        PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60072.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14709.exe
        6⤵
        
        PID:3056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35030.exe
        6⤵
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43354.exe
        6⤵
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18715.exe
        6⤵
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29334.exe
        6⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24335.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12693.exe
        6⤵
        
        PID:5948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29575.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53033.exe
        5⤵
        
        PID:1060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49298.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33141.exe
        5⤵
        
        PID:1852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29865.exe
        5⤵
        
        PID:4384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19870.exe
        5⤵
        
        PID:4768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45142.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49792.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42989.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50747.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1331.exe
        7⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10900.exe
        7⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32279.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7050.exe
        7⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42890.exe
        7⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22010.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1781.exe
        6⤵
        
        PID:3192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9412.exe
        6⤵
        
        PID:3756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3004.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37275.exe
        6⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16554.exe
        6⤵
        
        PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28743.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46126.exe
        5⤵
        
        PID:2856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14487.exe
        5⤵
        
        PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23455.exe
        5⤵
        
        PID:4020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8334.exe
        5⤵
        
        PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14535.exe
        5⤵
        
        PID:4936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55564.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63885.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3365.exe
        5⤵
        
        PID:2936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25534.exe
        5⤵
        
        PID:3632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53883.exe
        5⤵
        
        PID:3780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38000.exe
        5⤵
        
        PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58276.exe
        5⤵
        
        PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26354.exe
        5⤵
        
        PID:5752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49090.exe
      4⤵
      PID:2848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47982.exe
      4⤵
      PID:3084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28287.exe
      4⤵
      PID:1120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22485.exe
      4⤵
      PID:1336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19112.exe
      4⤵
      PID:4132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20754.exe
      4⤵
      PID:5760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63175.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63175.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14042.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48884.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59727.exe
        5⤵
        
        PID:2208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40868.exe
        5⤵
        
        PID:2528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61032.exe
        5⤵
        
        PID:4600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43663.exe
        5⤵
        
        PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34836.exe
        5⤵
        
        PID:5276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1751.exe
      4⤵
      PID:296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7925.exe
      4⤵
      PID:1312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22126.exe
        5⤵
        
        PID:2984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7107.exe
        5⤵
        
        PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17522.exe
        5⤵
        
        PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44836.exe
        5⤵
        
        PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36235.exe
      4⤵
      PID:3348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58414.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29865.exe
      4⤵
      PID:4392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19870.exe
      4⤵
      PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45142.exe
      4⤵
      PID:5960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7912.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7912.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40249.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47885.exe
      4⤵
      PID:2816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19806.exe
        5⤵
        
        PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28990.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32279.exe
        5⤵
        
        PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7050.exe
        5⤵
        
        PID:4972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12163.exe
        5⤵
        
        PID:5920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13675.exe
      4⤵
      PID:2800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24855.exe
      4⤵
      PID:3868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31233.exe
      4⤵
      PID:3984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15513.exe
      4⤵
      PID:4632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58806.exe
      4⤵
      PID:4664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31624.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31624.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7610.exe
      4⤵
      PID:3048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32668.exe
      4⤵
      PID:1780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23153.exe
      4⤵
      PID:3856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14674.exe
      4⤵
      PID:3412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29647.exe
      4⤵
      PID:5052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19870.exe
      4⤵
      PID:4796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45142.exe
      4⤵
      PID:5968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47689.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47689.exe
    3⤵
    PID:2648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1382.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1382.exe
    3⤵
    PID:2420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41084.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41084.exe
    3⤵
    PID:3676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54586.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54586.exe
    3⤵
    PID:3996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2999.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2999.exe
    3⤵
    PID:4500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36140.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36140.exe
    3⤵
    PID:4836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58555.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58555.exe
    3⤵
    PID:5680
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5561.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5561.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-98.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-98.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61549.exe
        5⤵
        
        PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3552.exe
        5⤵
        
        PID:3824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48201.exe
        5⤵
        
        PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38000.exe
        5⤵
        
        PID:4472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58276.exe
        5⤵
        
        PID:4840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19269.exe
      4⤵
      PID:1040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
      4⤵
      PID:2560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49298.exe
      4⤵
      PID:3804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4361.exe
      4⤵
      PID:3340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29865.exe
      4⤵
      PID:4360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
      4⤵
      PID:4804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47204.exe
      4⤵
      PID:5208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27233.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27233.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41894.exe
      4⤵
      PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40261.exe
      4⤵
      PID:2600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23153.exe
      4⤵
      PID:3884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37232.exe
      4⤵
      PID:3872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3004.exe
      4⤵
      PID:5076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37275.exe
      4⤵
      PID:4656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43004.exe
      4⤵
      PID:5220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50538.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50538.exe
    3⤵
    PID:2076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64870.exe
      4⤵
      PID:960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16603.exe
      4⤵
      PID:392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20111.exe
      4⤵
      PID:3428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7440.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8645.exe
      4⤵
      PID:4820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11479.exe
      4⤵
      PID:5536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45145.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45145.exe
    3⤵
    PID:1496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16438.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16438.exe
    3⤵
    PID:2744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63489.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63489.exe
    3⤵
    PID:3848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37763.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37763.exe
    3⤵
    PID:3708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8334.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8334.exe
    3⤵
    PID:4428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14535.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14535.exe
    3⤵
    PID:4932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49342.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49342.exe
    3⤵
    PID:5188
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36974.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36974.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63435.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63435.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45236.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8160.exe
        5⤵
        
        PID:2152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36646.exe
        6⤵
        
        PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65477.exe
        5⤵
        
        PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3831.exe
        5⤵
        
        PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15394.exe
        5⤵
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45448.exe
        5⤵
        
        PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63671.exe
      4⤵
      PID:1288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4080.exe
      4⤵
      PID:1324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23153.exe
      4⤵
      PID:3952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6390.exe
      4⤵
      PID:3776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29865.exe
      4⤵
      PID:4376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20046.exe
      4⤵
      PID:4704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10448.exe
      4⤵
      PID:5144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24000.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24000.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38154.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38154.exe
      4⤵
      PID:764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25291.exe
      4⤵
      PID:3732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10050.exe
      4⤵
      PID:3772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29647.exe
      4⤵
      PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19870.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45142.exe
      4⤵
      PID:6064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38320.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38320.exe
    3⤵
    PID:1576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36396.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36396.exe
    3⤵
    PID:1548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14487.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14487.exe
    3⤵
    PID:3944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20697.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20697.exe
    3⤵
    PID:3752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16284.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16284.exe
    3⤵
    PID:4960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31940.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31940.exe
    3⤵
    PID:4900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55564.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55564.exe
    3⤵
    PID:5808
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5112.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5112.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46204.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46204.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38969.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38969.exe
    3⤵
    PID:2732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20111.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20111.exe
    3⤵
    PID:3448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7440.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7440.exe
    3⤵
    PID:3716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43966.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43966.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7825.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7825.exe
    3⤵
    PID:4460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54561.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54561.exe
    3⤵
    PID:5300
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63634.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63634.exe
  2⤵
  PID:2672
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5655.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5655.exe
  2⤵
  PID:2216
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12791.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12791.exe
  2⤵
  PID:3104
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61888.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61888.exe
  2⤵
  PID:3456
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16628.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16628.exe
  2⤵
  PID:3328
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43215.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43215.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4564
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3406.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3406.exe
  2⤵
  PID:6132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe

Filesize
468KB

MD5
dac0b2b55da8f2116e977fe1431fac32

SHA1
109de22c24fb964aad68a9890b4857cbe599819f

SHA256
140ff89f62a8d12735f6e7a91f970bc3f5ef96ec2835072878d96c047b3dcfb2

SHA512
aa07834abeae83d606e31f56b9b68b6f35f13fa5f0eca23a0f981167cef1eae4f3c0e2ba6a810e7a2122fcc5863a85e9702ef1232b2b590ede167e02c7629c56

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe

Filesize
468KB

MD5
54906f55715cde1c2ae2a01affaf2d78

SHA1
946946c46f366d97f82063a824d139494e64ede8

SHA256
bef30e59cb253942e66b951f4b8495e9404862ba5a1e0e28c85a091372f7cdc5

SHA512
c5bd9914060f248c86e75dc8fbe3fffcdb9f8973b296220cde9831a1cf1c8502ef6718401dabef83e4f88bdbb3270f05fb0d5fa22e5b44aae88d3dfd35e0d7ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-483.exe

Filesize
468KB

MD5
b077b07e6a14096bc458cbda70aca912

SHA1
a5dc673b853d02fb2601f8cef52f663bbb71821e

SHA256
d0325dc0044e274cabbfaa6d79b228d0b7ca7b6099e2208936622b426bbb7b5b

SHA512
bf521e2e5ba0d6d4562e5d4748561be3e69ae5f1fb2ddcc52793b059a7614f1a9ab5a602609cc88e630eb716a0cb137366af0af68bd2549ce9f22d7eb104fea4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5142.exe

Filesize
468KB

MD5
6c405d75a8fc3a60f0fd261a7da8f07f

SHA1
447eab200be72832c6ef514f6ec865c97fd09407

SHA256
59c4bcda16d2f60360035f3b8b79daf38b7a0e6945398249baa29380ee52cb95

SHA512
d583a733a04eeeade3dc65923e917e41e2f2a48882d1a4ce5c915652b66a6a8f3fdcda022c00d9b401c26452d1feb64baaed02b14a19f3b698606a24277741c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54670.exe

Filesize
468KB

MD5
7f8d776e1aea742216d8fdc39f0cf0b9

SHA1
9f81f0ba1422bc38825b18dcd31f952d28d8c33e

SHA256
db7869cf0b9e7586e808c2496ea03fed767c9e4f180045d00f3be7ea0b43efa1

SHA512
c057c892a15570a9b43f448cf73f2f8288f785bc0474cfbe6315cb963c5e5dfed0232e6ff602b9221909864cf7e8d427e251a127cc9f67f1cbfbf7bf89ea2b2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5561.exe

Filesize
468KB

MD5
9a7c6070fa583dcc6d066cbcd838523d

SHA1
5d00e3f9bbb151bf15ea2e03c835ace7e564321b

SHA256
22e5c21097959d5c312a0533da6806d4cd9279b8c4d751703cb8618e560ee930

SHA512
70b2fdbaee38e62fa948237a4c444ea182b826dc658d286e75a9e749c049a77583bccc4796f4581f146ef7fa58c41eb9fab57b967c787e8cf0b765ea4da7a2e7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-11373.exe

Filesize
468KB

MD5
3ff4093405ea5df45b314e28e2b7d92b

SHA1
acef05e31646e8988b6f19ec27dfed711a69d229

SHA256
e1354a9f487a78a0f0dc31d22ae64b8f4a1d77fba7b7432f80bd2ab07be3fa01

SHA512
d4bd672d9a34ad141b73aae50b68caf17c3d490bb05bddfec012a4af6cf9b1a89096c15ba2e087687a3b66e036bd50b492f513b8231c1a29762ed1be6f4b2345

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34804.exe

Filesize
468KB

MD5
7078c97d54b29e930c8a273ce6ac72c5

SHA1
db9ccd69a3f55d80ef3613d83b84e058373d6d09

SHA256
bc76a28ef40d93a611c48a25267ea01943ee01ac57ef59ce0ae2e67653ce6d66

SHA512
8d3648e2866dca4a6f7fd2c584975525e5b6d2e35cbcf85f8974bef53d824c368574f6e4b2b4694b2a4bdc182d468d5e2bcfee74fffea120dcf81faa3e30ed7b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36974.exe

Filesize
468KB

MD5
ce8e7ac08c29545db8134dc3162d807d

SHA1
a7a25b2358f0a5ed2c343418c74e92dbff93af03

SHA256
b58ce96fc282233a9516b2aab0b3aa6eab2f6b84a5fef8861559c148b1b74ae5

SHA512
0b0e9151a0886715a27be9dce22ce55d2a57dda5afaaa01e59d182dd793e3fd4af80e198c2030dc6304528cfaf48b378bd5076ecbfb8ffabcd1435efc3f3f1f2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43814.exe

Filesize
468KB

MD5
88b1f5aa2ce2f868c440c0c619592822

SHA1
01414f4533f502c7e4147aa29fa59f644ffc5e73

SHA256
f0e07779d672b9ff84a41df33af4bbe53fd2660f4036aeccf51949ea0132a418

SHA512
57f0903e15fa4ebf5166ac75854fd6828618b59ce13c21af4c84e08cb1677a6608f5322c3773f0288bde43d9d71ff67512b85d2d7439a5fc319c6e60c52700f0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46258.exe

Filesize
468KB

MD5
25653f494d4ffb754c0132d686b0d60c

SHA1
619ffbad31e73e8940d146894cca5e47bf6bb629

SHA256
a86378e75165634e933e1a6ab9ba2a4baac1d28d7166c08f92f194d17bb1c832

SHA512
4d217073c675aa44a17119328db60727ac588547a5fde0168bca920f51a0995923e305a03030a21640183d1721a057f9228f85fa528d283ce46f64e8a8f4d3c2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46611.exe

Filesize
468KB

MD5
d64ad1e1f72a7035994d6164bb098f4f

SHA1
367da47f31ca21673ce522d37e4096ca5f692412

SHA256
689ae68042e600b2c8c002ffe8c32049621b3223e99ba6d88f147ba808e6b0c8

SHA512
916f0500c9611d5b8818ef00f824ca7fd3ca0bd19c513ab23895c49074240104d3073554cc98cbcfc48364c1d6533980762c8369191b9136899799ecc3f65fbe

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51250.exe

Filesize
468KB

MD5
a5c0a47a3fe0bd9a0b657da79bde5f0f

SHA1
4c50697dd889b8a2faab335e31e4cfe7c6496dd2

SHA256
3173bd8a34b0b044e1430d579dcfe6d4e79f1fc5a758ec7342581b88ba40ef87

SHA512
63b1017449bb138068b0dfcebef4de55ca12eb5567a51d44956d185e2fd2b56cc210c5fbea7c24396216c04539fa6df50d2184629db6ce067dfe73c02a465a67

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52916.exe

Filesize
468KB

MD5
ee04b50e430820c0ff97b4220523dfd6

SHA1
8876e29e7b610d9cc64272883e0dac2ad84bbca0

SHA256
f37bf9a16fbf92d8c889d612d509ce959a6efcf5402bd23d63f5c122f6ef41a3

SHA512
ed609f15092d17df8dfd02b64854c9c13ef144bb6c70ec7dc33e041de35480e05c64b72241f02e972e5fb20759cb7262211a09dce714bace44d838c3374d6708

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63175.exe

Filesize
468KB

MD5
b6858e9b98828af8d2a9dc0c8ab9642d

SHA1
ce03d2a6c7cda77c914c476465c2735c1ccd615f

SHA256
ea0a6d0e5ecc99cd7588c550c24d1a83a3cc8a8650c97f447eb2800d0d7474c6

SHA512
db504638ec357bcb284d24c94e46fb6e99d20132373b6063956923866b30456e8c453f560bc952586e543ec2c4ead160afd2e777eca22b9f097682c90aa8da79

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-7244.exe

Filesize
468KB

MD5
ad86a81b0508bf7e4cbf7d3837c44bae

SHA1
1d9fd700c4d3ddc3297ac215e77c910ae69475e6

SHA256
7eb0c27ddf591508e8739f8466419a5f8ce225ab086f2ad832c51cb52d2d81f4

SHA512
220d7d76c9eafcf03234340f9615d0bfc6761ab4e2b5a2730deffe7e9511667cd39b377d1ff76e4769926562eeeb78a1e9c5c11a30c5750255a7d97f5c50f3fb

Download Submit
memory/772-239-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/828-297-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/832-271-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/904-266-0x00000000028D0000-0x0000000002945000-memory.dmp

Filesize
468KB

Download
memory/904-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/904-335-0x0000000003400000-0x0000000003475000-memory.dmp

Filesize
468KB

Download
memory/904-269-0x00000000028D0000-0x0000000002945000-memory.dmp

Filesize
468KB

Download
memory/904-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/904-341-0x00000000028D0000-0x0000000002945000-memory.dmp

Filesize
468KB

Download
memory/904-373-0x00000000028D0000-0x0000000002945000-memory.dmp

Filesize
468KB

Download
memory/904-136-0x00000000028D0000-0x0000000002945000-memory.dmp

Filesize
468KB

Download
memory/904-6-0x0000000003400000-0x0000000003475000-memory.dmp

Filesize
468KB

Download
memory/904-142-0x00000000028D0000-0x0000000002945000-memory.dmp

Filesize
468KB

Download
memory/948-374-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1236-332-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/1236-333-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/1316-198-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1316-357-0x00000000027F0000-0x0000000002865000-memory.dmp

Filesize
468KB

Download
memory/1456-218-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1528-272-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1600-316-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1688-361-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1728-398-0x0000000001E10000-0x0000000001E85000-memory.dmp

Filesize
468KB

Download
memory/1728-236-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1728-397-0x0000000001E10000-0x0000000001E85000-memory.dmp

Filesize
468KB

Download
memory/1740-342-0x0000000000360000-0x00000000003D5000-memory.dmp

Filesize
468KB

Download
memory/1740-337-0x0000000000360000-0x00000000003D5000-memory.dmp

Filesize
468KB

Download
memory/1740-186-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1912-295-0x0000000002940000-0x00000000029B5000-memory.dmp

Filesize
468KB

Download
memory/1912-296-0x0000000002940000-0x00000000029B5000-memory.dmp

Filesize
468KB

Download
memory/1912-171-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2044-233-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/2044-144-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2056-418-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2064-263-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/2064-268-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/2072-238-0x0000000002870000-0x00000000028E5000-memory.dmp

Filesize
468KB

Download
memory/2072-237-0x0000000002870000-0x00000000028E5000-memory.dmp

Filesize
468KB

Download
memory/2080-407-0x0000000001E70000-0x0000000001EE5000-memory.dmp

Filesize
468KB

Download
memory/2080-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2080-369-0x0000000001C70000-0x0000000001CE5000-memory.dmp

Filesize
468KB

Download
memory/2096-349-0x0000000000670000-0x00000000006E5000-memory.dmp

Filesize
468KB

Download
memory/2096-358-0x0000000000670000-0x00000000006E5000-memory.dmp

Filesize
468KB

Download
memory/2096-24-0x0000000000670000-0x00000000006E5000-memory.dmp

Filesize
468KB

Download
memory/2096-23-0x0000000000670000-0x00000000006E5000-memory.dmp

Filesize
468KB

Download
memory/2096-106-0x0000000000670000-0x00000000006E5000-memory.dmp

Filesize
468KB

Download
memory/2096-183-0x0000000000670000-0x00000000006E5000-memory.dmp

Filesize
468KB

Download
memory/2096-184-0x0000000000670000-0x00000000006E5000-memory.dmp

Filesize
468KB

Download
memory/2096-343-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2096-360-0x0000000000670000-0x00000000006E5000-memory.dmp

Filesize
468KB

Download
memory/2104-270-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/2104-108-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2268-322-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2312-265-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2328-313-0x00000000007D0000-0x0000000000845000-memory.dmp

Filesize
468KB

Download
memory/2328-161-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2328-308-0x00000000007D0000-0x0000000000845000-memory.dmp

Filesize
468KB

Download
memory/2416-197-0x0000000000370000-0x00000000003E5000-memory.dmp

Filesize
468KB

Download
memory/2416-191-0x0000000000370000-0x00000000003E5000-memory.dmp

Filesize
468KB

Download
memory/2464-399-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2496-306-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2548-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2548-416-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/2604-78-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2604-215-0x00000000002F0000-0x0000000000365000-memory.dmp

Filesize
468KB

Download
memory/2604-112-0x00000000002F0000-0x0000000000365000-memory.dmp

Filesize
468KB

Download
memory/2616-216-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2616-72-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2616-120-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2616-203-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2740-62-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2740-119-0x0000000002740000-0x00000000027B5000-memory.dmp

Filesize
468KB

Download
memory/2740-417-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2740-235-0x0000000002740000-0x00000000027B5000-memory.dmp

Filesize
468KB

Download
memory/2740-234-0x0000000002740000-0x00000000027B5000-memory.dmp

Filesize
468KB

Download
memory/2768-303-0x0000000002750000-0x00000000027C5000-memory.dmp

Filesize
468KB

Download
memory/2768-305-0x0000000002750000-0x00000000027C5000-memory.dmp

Filesize
468KB

Download
memory/2768-169-0x0000000002750000-0x00000000027C5000-memory.dmp

Filesize
468KB

Download
memory/2768-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2768-164-0x0000000002750000-0x00000000027C5000-memory.dmp

Filesize
468KB

Download
memory/2768-57-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2772-334-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2780-344-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2792-264-0x00000000007B0000-0x0000000000825000-memory.dmp

Filesize
468KB

Download
memory/2792-384-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2792-56-0x00000000007B0000-0x0000000000825000-memory.dmp

Filesize
468KB

Download
memory/2792-35-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2792-267-0x00000000007B0000-0x0000000000825000-memory.dmp

Filesize
468KB

Download
memory/2880-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2896-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2944-321-0x0000000000B10000-0x0000000000B85000-memory.dmp

Filesize
468KB

Download
memory/2944-159-0x0000000000B10000-0x0000000000B85000-memory.dmp

Filesize
468KB

Download
memory/2944-107-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2964-273-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3012-217-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3052-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download