cf2243f5a4949e17cbb0bb4c81b746646686394beb826a9a517160c5f5401617

Analysis

max time kernel
111s
max time network
21s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 08:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf2243f5a4949e17cbb0bb4c81b746646686394beb826a9a517160c5f5401617N.exe
Size

468KB
MD5

ca9e5082b7396dbdf23736a2b18814b0
SHA1

545859865f74b341ad20b62cc549c4793c427e46
SHA256

cf2243f5a4949e17cbb0bb4c81b746646686394beb826a9a517160c5f5401617
SHA512

2174928cea73fe49a69d634002ed16b86ef3e36d49090da960e807b31342688c4d0bb33d7a2afdba2df56e98e8d2cba2b467c6d175a4077b545252b2224d132f
SSDEEP

3072:/bCBovIwU35/tbY4Pgt58fF/E5Ra6IXXlmHowrx4J0qwO+ceeolB:/bIoIJ/tjPM58fU2JvJ0/Ncee

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
776	Unicorn-49405.exe
2084	Unicorn-35264.exe
2328	Unicorn-48263.exe
2828	Unicorn-3363.exe
2824	Unicorn-47319.exe
2868	Unicorn-9493.exe
2684	Unicorn-46997.exe
2660	Unicorn-15108.exe
2296	Unicorn-58179.exe
1808	Unicorn-64309.exe
1732	Unicorn-15492.exe
1728	Unicorn-15227.exe
1392	Unicorn-15492.exe
1872	Unicorn-61164.exe
2356	Unicorn-61164.exe
760	Unicorn-31440.exe
2932	Unicorn-46359.exe
2312	Unicorn-22312.exe
2480	Unicorn-5975.exe
3060	Unicorn-47008.exe
640	Unicorn-55176.exe
2784	Unicorn-2638.exe
1880	Unicorn-49238.exe
1712	Unicorn-35502.exe
1528	Unicorn-61735.exe
860	Unicorn-24232.exe
2212	Unicorn-62249.exe
1804	Unicorn-53319.exe
1940	Unicorn-37745.exe
1884	Unicorn-31614.exe
2280	Unicorn-37422.exe
580	Unicorn-10630.exe
2252	Unicorn-33468.exe
1436	Unicorn-33983.exe
1740	Unicorn-28259.exe
2444	Unicorn-1694.exe
2196	Unicorn-49094.exe
2476	Unicorn-28311.exe
2752	Unicorn-19373.exe
2804	Unicorn-44839.exe
2208	Unicorn-59831.exe
2956	Unicorn-53701.exe
2768	Unicorn-44564.exe
2548	Unicorn-52659.exe
2508	Unicorn-32181.exe
980	Unicorn-38818.exe
1316	Unicorn-25082.exe
1504	Unicorn-3038.exe
2616	Unicorn-25274.exe
1824	Unicorn-45140.exe
1768	Unicorn-20636.exe
1536	Unicorn-28804.exe
556	Unicorn-57266.exe
1928	Unicorn-43530.exe
2656	Unicorn-8257.exe
3056	Unicorn-60059.exe
2440	Unicorn-47252.exe
444	Unicorn-14579.exe
1716	Unicorn-4802.exe
484	Unicorn-26234.exe
1724	Unicorn-19925.exe
1372	Unicorn-57620.exe
1692	Unicorn-20117.exe
796	Unicorn-14178.exe

Loads dropped DLL 64 IoCs

pid	Process
2364	cf2243f5a4949e17cbb0bb4c81b746646686394beb826a9a517160c5f5401617N.exe
2364	cf2243f5a4949e17cbb0bb4c81b746646686394beb826a9a517160c5f5401617N.exe
776	Unicorn-49405.exe
776	Unicorn-49405.exe
2364	cf2243f5a4949e17cbb0bb4c81b746646686394beb826a9a517160c5f5401617N.exe
2364	cf2243f5a4949e17cbb0bb4c81b746646686394beb826a9a517160c5f5401617N.exe
2328	Unicorn-48263.exe
2364	cf2243f5a4949e17cbb0bb4c81b746646686394beb826a9a517160c5f5401617N.exe
2084	Unicorn-35264.exe
2328	Unicorn-48263.exe
2364	cf2243f5a4949e17cbb0bb4c81b746646686394beb826a9a517160c5f5401617N.exe
2084	Unicorn-35264.exe
776	Unicorn-49405.exe
776	Unicorn-49405.exe
2684	Unicorn-46997.exe
2684	Unicorn-46997.exe
776	Unicorn-49405.exe
776	Unicorn-49405.exe
2824	Unicorn-47319.exe
2824	Unicorn-47319.exe
2328	Unicorn-48263.exe
2084	Unicorn-35264.exe
2828	Unicorn-3363.exe
2868	Unicorn-9493.exe
2364	cf2243f5a4949e17cbb0bb4c81b746646686394beb826a9a517160c5f5401617N.exe
2828	Unicorn-3363.exe
2868	Unicorn-9493.exe
2364	cf2243f5a4949e17cbb0bb4c81b746646686394beb826a9a517160c5f5401617N.exe
2084	Unicorn-35264.exe
2328	Unicorn-48263.exe
2296	Unicorn-58179.exe
2296	Unicorn-58179.exe
776	Unicorn-49405.exe
776	Unicorn-49405.exe
1808	Unicorn-64309.exe
1808	Unicorn-64309.exe
2660	Unicorn-15108.exe
2660	Unicorn-15108.exe
1872	Unicorn-61164.exe
1872	Unicorn-61164.exe
1392	Unicorn-15492.exe
1392	Unicorn-15492.exe
2824	Unicorn-47319.exe
2824	Unicorn-47319.exe
2084	Unicorn-35264.exe
2084	Unicorn-35264.exe
2684	Unicorn-46997.exe
2684	Unicorn-46997.exe
2868	Unicorn-9493.exe
2868	Unicorn-9493.exe
1728	Unicorn-15227.exe
1728	Unicorn-15227.exe
2356	Unicorn-61164.exe
2364	cf2243f5a4949e17cbb0bb4c81b746646686394beb826a9a517160c5f5401617N.exe
2356	Unicorn-61164.exe
2364	cf2243f5a4949e17cbb0bb4c81b746646686394beb826a9a517160c5f5401617N.exe
1732	Unicorn-15492.exe
1732	Unicorn-15492.exe
2328	Unicorn-48263.exe
2328	Unicorn-48263.exe
2828	Unicorn-3363.exe
2828	Unicorn-3363.exe
760	Unicorn-31440.exe
760	Unicorn-31440.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38842.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23574.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12807.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55041.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24766.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59831.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55724.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11628.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23574.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30523.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4291.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33636.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28311.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10156.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48830.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61164.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29352.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37323.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37529.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28259.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35502.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15617.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8257.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29567.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55176.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8858.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2638.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15198.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10216.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15144.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64177.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44564.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6019.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1737.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21966.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34733.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24766.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-907.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36443.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25274.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46027.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10017.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62929.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15492.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59902.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1737.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25082.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21304.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43286.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24766.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26234.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59482.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56093.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35218.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2364	cf2243f5a4949e17cbb0bb4c81b746646686394beb826a9a517160c5f5401617N.exe
776	Unicorn-49405.exe
2084	Unicorn-35264.exe
2328	Unicorn-48263.exe
2828	Unicorn-3363.exe
2684	Unicorn-46997.exe
2824	Unicorn-47319.exe
2868	Unicorn-9493.exe
2296	Unicorn-58179.exe
1808	Unicorn-64309.exe
2660	Unicorn-15108.exe
1392	Unicorn-15492.exe
1872	Unicorn-61164.exe
1732	Unicorn-15492.exe
1728	Unicorn-15227.exe
2356	Unicorn-61164.exe
760	Unicorn-31440.exe
2932	Unicorn-46359.exe
2312	Unicorn-22312.exe
2480	Unicorn-5975.exe
3060	Unicorn-47008.exe
640	Unicorn-55176.exe
2784	Unicorn-2638.exe
1880	Unicorn-49238.exe
1712	Unicorn-35502.exe
860	Unicorn-24232.exe
1528	Unicorn-61735.exe
1804	Unicorn-53319.exe
2212	Unicorn-62249.exe
1940	Unicorn-37745.exe
1884	Unicorn-31614.exe
2280	Unicorn-37422.exe
580	Unicorn-10630.exe
2252	Unicorn-33468.exe
1436	Unicorn-33983.exe
1740	Unicorn-28259.exe
2444	Unicorn-1694.exe
2196	Unicorn-49094.exe
2476	Unicorn-28311.exe
2752	Unicorn-19373.exe
2804	Unicorn-44839.exe
2208	Unicorn-59831.exe
2956	Unicorn-53701.exe
2768	Unicorn-44564.exe
2548	Unicorn-52659.exe
2508	Unicorn-32181.exe
1504	Unicorn-3038.exe
980	Unicorn-38818.exe
1316	Unicorn-25082.exe
2616	Unicorn-25274.exe
1824	Unicorn-45140.exe
1536	Unicorn-28804.exe
1768	Unicorn-20636.exe
556	Unicorn-57266.exe
1928	Unicorn-43530.exe
444	Unicorn-14579.exe
2656	Unicorn-8257.exe
3056	Unicorn-60059.exe
1716	Unicorn-4802.exe
2440	Unicorn-47252.exe
484	Unicorn-26234.exe
1724	Unicorn-19925.exe
1372	Unicorn-57620.exe
1692	Unicorn-20117.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 776	2364	cf2243f5a4949e17cbb0bb4c81b746646686394beb826a9a517160c5f5401617N.exe	31
PID 2364 wrote to memory of 776	2364	cf2243f5a4949e17cbb0bb4c81b746646686394beb826a9a517160c5f5401617N.exe	31
PID 2364 wrote to memory of 776	2364	cf2243f5a4949e17cbb0bb4c81b746646686394beb826a9a517160c5f5401617N.exe	31
PID 2364 wrote to memory of 776	2364	cf2243f5a4949e17cbb0bb4c81b746646686394beb826a9a517160c5f5401617N.exe	31
PID 776 wrote to memory of 2084	776	Unicorn-49405.exe	32
PID 776 wrote to memory of 2084	776	Unicorn-49405.exe	32
PID 776 wrote to memory of 2084	776	Unicorn-49405.exe	32
PID 776 wrote to memory of 2084	776	Unicorn-49405.exe	32
PID 2364 wrote to memory of 2328	2364	cf2243f5a4949e17cbb0bb4c81b746646686394beb826a9a517160c5f5401617N.exe	33
PID 2364 wrote to memory of 2328	2364	cf2243f5a4949e17cbb0bb4c81b746646686394beb826a9a517160c5f5401617N.exe	33
PID 2364 wrote to memory of 2328	2364	cf2243f5a4949e17cbb0bb4c81b746646686394beb826a9a517160c5f5401617N.exe	33
PID 2364 wrote to memory of 2328	2364	cf2243f5a4949e17cbb0bb4c81b746646686394beb826a9a517160c5f5401617N.exe	33
PID 2328 wrote to memory of 2824	2328	Unicorn-48263.exe	34
PID 2328 wrote to memory of 2824	2328	Unicorn-48263.exe	34
PID 2328 wrote to memory of 2824	2328	Unicorn-48263.exe	34
PID 2328 wrote to memory of 2824	2328	Unicorn-48263.exe	34
PID 2364 wrote to memory of 2828	2364	cf2243f5a4949e17cbb0bb4c81b746646686394beb826a9a517160c5f5401617N.exe	35
PID 2364 wrote to memory of 2828	2364	cf2243f5a4949e17cbb0bb4c81b746646686394beb826a9a517160c5f5401617N.exe	35
PID 2364 wrote to memory of 2828	2364	cf2243f5a4949e17cbb0bb4c81b746646686394beb826a9a517160c5f5401617N.exe	35
PID 2364 wrote to memory of 2828	2364	cf2243f5a4949e17cbb0bb4c81b746646686394beb826a9a517160c5f5401617N.exe	35
PID 2084 wrote to memory of 2868	2084	Unicorn-35264.exe	36
PID 2084 wrote to memory of 2868	2084	Unicorn-35264.exe	36
PID 2084 wrote to memory of 2868	2084	Unicorn-35264.exe	36
PID 2084 wrote to memory of 2868	2084	Unicorn-35264.exe	36
PID 776 wrote to memory of 2684	776	Unicorn-49405.exe	37
PID 776 wrote to memory of 2684	776	Unicorn-49405.exe	37
PID 776 wrote to memory of 2684	776	Unicorn-49405.exe	37
PID 776 wrote to memory of 2684	776	Unicorn-49405.exe	37
PID 2684 wrote to memory of 2660	2684	Unicorn-46997.exe	38
PID 2684 wrote to memory of 2660	2684	Unicorn-46997.exe	38
PID 2684 wrote to memory of 2660	2684	Unicorn-46997.exe	38
PID 2684 wrote to memory of 2660	2684	Unicorn-46997.exe	38
PID 776 wrote to memory of 2296	776	Unicorn-49405.exe	39
PID 776 wrote to memory of 2296	776	Unicorn-49405.exe	39
PID 776 wrote to memory of 2296	776	Unicorn-49405.exe	39
PID 776 wrote to memory of 2296	776	Unicorn-49405.exe	39
PID 2824 wrote to memory of 1808	2824	Unicorn-47319.exe	40
PID 2824 wrote to memory of 1808	2824	Unicorn-47319.exe	40
PID 2824 wrote to memory of 1808	2824	Unicorn-47319.exe	40
PID 2824 wrote to memory of 1808	2824	Unicorn-47319.exe	40
PID 2828 wrote to memory of 1732	2828	Unicorn-3363.exe	43
PID 2828 wrote to memory of 1732	2828	Unicorn-3363.exe	43
PID 2828 wrote to memory of 1732	2828	Unicorn-3363.exe	43
PID 2828 wrote to memory of 1732	2828	Unicorn-3363.exe	43
PID 2868 wrote to memory of 1392	2868	Unicorn-9493.exe	44
PID 2868 wrote to memory of 1392	2868	Unicorn-9493.exe	44
PID 2868 wrote to memory of 1392	2868	Unicorn-9493.exe	44
PID 2868 wrote to memory of 1392	2868	Unicorn-9493.exe	44
PID 2364 wrote to memory of 1728	2364	cf2243f5a4949e17cbb0bb4c81b746646686394beb826a9a517160c5f5401617N.exe	45
PID 2364 wrote to memory of 1728	2364	cf2243f5a4949e17cbb0bb4c81b746646686394beb826a9a517160c5f5401617N.exe	45
PID 2364 wrote to memory of 1728	2364	cf2243f5a4949e17cbb0bb4c81b746646686394beb826a9a517160c5f5401617N.exe	45
PID 2364 wrote to memory of 1728	2364	cf2243f5a4949e17cbb0bb4c81b746646686394beb826a9a517160c5f5401617N.exe	45
PID 2084 wrote to memory of 1872	2084	Unicorn-35264.exe	42
PID 2084 wrote to memory of 1872	2084	Unicorn-35264.exe	42
PID 2084 wrote to memory of 1872	2084	Unicorn-35264.exe	42
PID 2084 wrote to memory of 1872	2084	Unicorn-35264.exe	42
PID 2328 wrote to memory of 2356	2328	Unicorn-48263.exe	41
PID 2328 wrote to memory of 2356	2328	Unicorn-48263.exe	41
PID 2328 wrote to memory of 2356	2328	Unicorn-48263.exe	41
PID 2328 wrote to memory of 2356	2328	Unicorn-48263.exe	41
PID 2296 wrote to memory of 760	2296	Unicorn-58179.exe	46
PID 2296 wrote to memory of 760	2296	Unicorn-58179.exe	46
PID 2296 wrote to memory of 760	2296	Unicorn-58179.exe	46
PID 2296 wrote to memory of 760	2296	Unicorn-58179.exe	46

C:\Users\Admin\AppData\Local\Temp\cf2243f5a4949e17cbb0bb4c81b746646686394beb826a9a517160c5f5401617N.exe
"C:\Users\Admin\AppData\Local\Temp\cf2243f5a4949e17cbb0bb4c81b746646686394beb826a9a517160c5f5401617N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49405.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49405.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35264.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35264.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9493.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15492.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55176.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45140.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33358.exe
        8⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        9⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15617.exe
        9⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
        8⤵
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe
        8⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38233.exe
        8⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13492.exe
        7⤵
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-634.exe
        8⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11628.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11641.exe
        8⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4291.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30632.exe
        7⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10216.exe
        7⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43530.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2994.exe
        7⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33141.exe
        8⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11031.exe
        8⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29352.exe
        8⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19896.exe
        7⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26599.exe
        8⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15198.exe
        7⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26552.exe
        7⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12432.exe
        6⤵
        
        PID:772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        7⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15617.exe
        7⤵
        
        PID:5996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31220.exe
        6⤵
        
        PID:2888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42008.exe
        6⤵
        
        PID:4148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49444.exe
        6⤵
        
        PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61735.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28804.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19326.exe
        7⤵
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59482.exe
        8⤵
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33636.exe
        8⤵
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57064.exe
        8⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe
        7⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35218.exe
        7⤵
        
        PID:5988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23196.exe
        6⤵
        
        PID:2460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4291.exe
        6⤵
        
        PID:3768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30632.exe
        6⤵
        
        PID:4808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26552.exe
        6⤵
        
        PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8257.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9839.exe
        6⤵
        
        PID:2528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36824.exe
        6⤵
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15144.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1624.exe
        5⤵
        
        PID:1704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18675.exe
        6⤵
        
        PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1491.exe
        5⤵
        
        PID:3868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5431.exe
        5⤵
        
        PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30098.exe
        5⤵
        
        PID:5528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61164.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47008.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49953.exe
        6⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29705.exe
        7⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8480.exe
        7⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47372.exe
        7⤵
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62929.exe
        7⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37877.exe
        6⤵
        
        PID:2604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50673.exe
        6⤵
        
        PID:4196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54264.exe
        6⤵
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60059.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9839.exe
        6⤵
        
        PID:468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61328.exe
        6⤵
        
        PID:3392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1472.exe
        6⤵
        
        PID:3624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26552.exe
        6⤵
        
        PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-554.exe
        5⤵
        
        PID:672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36443.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10156.exe
        5⤵
        
        PID:3736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21966.exe
        5⤵
        
        PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10017.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49238.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59831.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20810.exe
        6⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29705.exe
        7⤵
        
        PID:304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23088.exe
        7⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56076.exe
        7⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7881.exe
        7⤵
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9839.exe
        6⤵
        
        PID:288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61135.exe
        7⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13016.exe
        7⤵
        
        PID:5500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1472.exe
        6⤵
        
        PID:3404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49950.exe
        6⤵
        
        PID:5660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54530.exe
        5⤵
        
        PID:1428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10722.exe
        6⤵
        
        PID:3640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        6⤵
        
        PID:4248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2513.exe
        6⤵
        
        PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8058.exe
        5⤵
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1472.exe
        5⤵
        
        PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10216.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52659.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52195.exe
        5⤵
        
        PID:2008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28107.exe
        6⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48830.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28846.exe
        6⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57064.exe
        6⤵
        
        PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19896.exe
        5⤵
        
        PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61144.exe
        5⤵
        
        PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62929.exe
        5⤵
        
        PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59902.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65045.exe
        5⤵
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11031.exe
        5⤵
        
        PID:4900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9613.exe
        5⤵
        
        PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6019.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42538.exe
      4⤵
      PID:4180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8567.exe
      4⤵
      PID:5568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46997.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46997.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15108.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5975.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1694.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34733.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29705.exe
        8⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15198.exe
        8⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26552.exe
        8⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9839.exe
        7⤵
        
        PID:1184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1472.exe
        7⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18192.exe
        7⤵
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31395.exe
        6⤵
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16695.exe
        7⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
        7⤵
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe
        7⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62929.exe
        7⤵
        
        PID:5228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18369.exe
        6⤵
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2938.exe
        7⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        7⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59882.exe
        7⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10156.exe
        6⤵
        
        PID:3700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21966.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10017.exe
        6⤵
        
        PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49094.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51261.exe
        6⤵
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19436.exe
        7⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11031.exe
        7⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29352.exe
        7⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52761.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15198.exe
        6⤵
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10216.exe
        6⤵
        
        PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5359.exe
        5⤵
        
        PID:2724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42678.exe
        6⤵
        
        PID:960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58906.exe
        7⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59656.exe
        7⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19809.exe
        7⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
        6⤵
        
        PID:3844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe
        6⤵
        
        PID:4584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-948.exe
        6⤵
        
        PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49870.exe
        5⤵
        
        PID:780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1491.exe
        5⤵
        
        PID:3876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5431.exe
        5⤵
        
        PID:4768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45484.exe
        5⤵
        
        PID:6036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35502.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23205.exe
        5⤵
        
        PID:2880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38624.exe
        6⤵
        
        PID:4224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35352.exe
        6⤵
        
        PID:5684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31220.exe
        5⤵
        
        PID:3048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42008.exe
        5⤵
        
        PID:4188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13032.exe
        5⤵
        
        PID:5608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38818.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58495.exe
        5⤵
        
        PID:1544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        6⤵
        
        PID:4036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3748.exe
        6⤵
        
        PID:5472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
        5⤵
        
        PID:3912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe
        5⤵
        
        PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62929.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58443.exe
      4⤵
      PID:2220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1491.exe
      4⤵
      PID:3860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5431.exe
      4⤵
      PID:4672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
      4⤵
      PID:6120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58179.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58179.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31440.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10630.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19925.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1889.exe
        7⤵
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
        7⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57190.exe
        8⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35218.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54961.exe
        6⤵
        
        PID:1104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4291.exe
        6⤵
        
        PID:3996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30632.exe
        6⤵
        
        PID:4864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49950.exe
        6⤵
        
        PID:6148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57620.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64853.exe
        6⤵
        
        PID:3988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11031.exe
        6⤵
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29352.exe
        6⤵
        
        PID:5892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23574.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        6⤵
        
        PID:3076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15617.exe
        6⤵
        
        PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19170.exe
        5⤵
        
        PID:3496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21966.exe
        5⤵
        
        PID:4680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37728.exe
        5⤵
        
        PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33468.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20117.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54800.exe
        6⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4225.exe
        7⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33636.exe
        7⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29352.exe
        7⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37323.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21966.exe
        6⤵
        
        PID:4696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37728.exe
        6⤵
        
        PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58479.exe
        5⤵
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37529.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27184.exe
        6⤵
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25354.exe
        5⤵
        
        PID:872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50673.exe
        5⤵
        
        PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26552.exe
        5⤵
        
        PID:5816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14178.exe
      4⤵
      Executes dropped EXE
      PID:796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36659.exe
        5⤵
        
        PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61135.exe
        5⤵
        
        PID:4320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29352.exe
        5⤵
        
        PID:5884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29440.exe
      4⤵
      PID:2844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10505.exe
      4⤵
      PID:3480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5431.exe
      4⤵
      PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54794.exe
      4⤵
      PID:5360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46359.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46359.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33983.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61341.exe
        5⤵
        
        PID:2344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47717.exe
        6⤵
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
        6⤵
        
        PID:3812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe
        6⤵
        
        PID:4576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-948.exe
        6⤵
        
        PID:5864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47561.exe
        5⤵
        
        PID:2176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4291.exe
        5⤵
        
        PID:4004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30632.exe
        5⤵
        
        PID:4856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54264.exe
        5⤵
        
        PID:5316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41667.exe
      4⤵
      PID:2556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2113.exe
        5⤵
        
        PID:3540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33636.exe
        5⤵
        
        PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29352.exe
        5⤵
        
        PID:5908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23574.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9960.exe
      4⤵
      PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59230.exe
      4⤵
      PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57612.exe
      4⤵
      PID:904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28259.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28259.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61533.exe
      4⤵
      PID:2360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12807.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        6⤵
        
        PID:4056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64818.exe
        6⤵
        
        PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36123.exe
        5⤵
        
        PID:2628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44808.exe
        5⤵
        
        PID:4164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18881.exe
        5⤵
        
        PID:5564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25998.exe
      4⤵
      PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43328.exe
        5⤵
        
        PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49859.exe
      4⤵
      PID:2904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50673.exe
      4⤵
      PID:4172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10216.exe
      4⤵
      PID:1384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-907.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-907.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29705.exe
      4⤵
      PID:840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61144.exe
      4⤵
      PID:3612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38233.exe
      4⤵
      PID:5592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21304.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21304.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55041.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55041.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61168.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61168.exe
    3⤵
    PID:4656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32128.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32128.exe
    3⤵
    PID:5180
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48263.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48263.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47319.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47319.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64309.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22312.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44564.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43394.exe
        7⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26426.exe
        8⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49973.exe
        8⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29352.exe
        8⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8760.exe
        7⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15198.exe
        7⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10216.exe
        7⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1328.exe
        6⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59482.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33636.exe
        7⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57064.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33631.exe
        6⤵
        
        PID:3152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1472.exe
        6⤵
        
        PID:3400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49950.exe
        6⤵
        
        PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25082.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33358.exe
        6⤵
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        7⤵
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15617.exe
        7⤵
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
        6⤵
        
        PID:3788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe
        6⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38233.exe
        6⤵
        
        PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61820.exe
        5⤵
        
        PID:1756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23213.exe
        6⤵
        
        PID:2492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
        6⤵
        
        PID:3804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-948.exe
        6⤵
        
        PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58033.exe
        5⤵
        
        PID:3016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1491.exe
        5⤵
        
        PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5431.exe
        5⤵
        
        PID:4752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45484.exe
        5⤵
        
        PID:5852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2638.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20636.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3679.exe
        6⤵
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27770.exe
        7⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33636.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13016.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11619.exe
        6⤵
        
        PID:2200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44808.exe
        6⤵
        
        PID:3708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35218.exe
        6⤵
        
        PID:6028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51271.exe
        5⤵
        
        PID:2680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43395.exe
        6⤵
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15629.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42970.exe
        6⤵
        
        PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10156.exe
        5⤵
        
        PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21966.exe
        5⤵
        
        PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37728.exe
        5⤵
        
        PID:5256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57266.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9839.exe
        5⤵
        
        PID:2580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36824.exe
        5⤵
        
        PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4036.exe
        5⤵
        
        PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10216.exe
        5⤵
        
        PID:6068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6419.exe
      4⤵
      PID:3040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1491.exe
      4⤵
      PID:3884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5431.exe
      4⤵
      PID:4776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61164.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61164.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62249.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64177.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43062.exe
        6⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20145.exe
        7⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29104.exe
        7⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
        6⤵
        
        PID:3836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62929.exe
        6⤵
        
        PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52578.exe
        5⤵
        
        PID:1228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10156.exe
        5⤵
        
        PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21966.exe
        5⤵
        
        PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59218.exe
        5⤵
        
        PID:5624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32181.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32181.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33939.exe
        5⤵
        
        PID:2916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4915.exe
        6⤵
        
        PID:3412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11031.exe
        6⤵
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57064.exe
        6⤵
        
        PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11619.exe
        5⤵
        
        PID:1584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15198.exe
        5⤵
        
        PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26552.exe
        5⤵
        
        PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13200.exe
      4⤵
      PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49259.exe
        5⤵
        
        PID:3284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33636.exe
        5⤵
        
        PID:2968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57064.exe
        5⤵
        
        PID:5344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55724.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42008.exe
      4⤵
      PID:3984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10017.exe
      4⤵
      PID:5832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31614.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31614.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47252.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4608.exe
        5⤵
        
        PID:792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4291.exe
        5⤵
        
        PID:3744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30632.exe
        5⤵
        
        PID:4600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10216.exe
        5⤵
        
        PID:2536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38842.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4291.exe
      4⤵
      PID:4020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30632.exe
      4⤵
      PID:4840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49950.exe
      4⤵
      PID:5544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4802.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4802.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52387.exe
      4⤵
      PID:1116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15617.exe
        5⤵
        
        PID:5868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36123.exe
      4⤵
      PID:2028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15198.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26552.exe
      4⤵
      PID:5688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11085.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11085.exe
    3⤵
    PID:328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19602.exe
      4⤵
      PID:3324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33636.exe
      4⤵
      PID:4948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29352.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30523.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30523.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42538.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42538.exe
    3⤵
    PID:4108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5552.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5552.exe
    3⤵
    PID:5704
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3363.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3363.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15492.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15492.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37745.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14579.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6684.exe
        6⤵
        
        PID:2032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
        6⤵
        
        PID:3904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe
        6⤵
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35218.exe
        6⤵
        
        PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52356.exe
        5⤵
        
        PID:1484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        6⤵
        
        PID:4140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15617.exe
        6⤵
        
        PID:6112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4291.exe
        5⤵
        
        PID:3752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30632.exe
        5⤵
        
        PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26552.exe
        5⤵
        
        PID:5744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26234.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39549.exe
        5⤵
        
        PID:112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
        5⤵
        
        PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe
        5⤵
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35218.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61296.exe
      4⤵
      PID:2276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10156.exe
      4⤵
      PID:3676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21966.exe
      4⤵
      PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13032.exe
      4⤵
      PID:5628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37422.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37422.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44839.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12449.exe
        5⤵
        
        PID:2224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2113.exe
        6⤵
        
        PID:3532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50211.exe
        6⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8378.exe
        6⤵
        
        PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4291.exe
        5⤵
        
        PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30632.exe
        5⤵
        
        PID:4848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54264.exe
        5⤵
        
        PID:5384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42360.exe
      4⤵
      PID:1760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15653.exe
        5⤵
        
        PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11031.exe
        5⤵
        
        PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57064.exe
        5⤵
        
        PID:6140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10156.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21966.exe
      4⤵
      PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10017.exe
      4⤵
      PID:5804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53701.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53701.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8858.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44324.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11031.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13016.exe
        5⤵
        
        PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11619.exe
      4⤵
      PID:1700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44808.exe
      4⤵
      PID:4156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38233.exe
      4⤵
      PID:5580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33674.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33674.exe
    3⤵
    PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59098.exe
      4⤵
      PID:3288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49973.exe
      4⤵
      PID:4464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29352.exe
      4⤵
      PID:5972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47059.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47059.exe
    3⤵
    PID:316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25472.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25472.exe
    3⤵
    PID:4116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
    3⤵
    PID:5844
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15227.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15227.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24232.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24232.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3038.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33358.exe
        5⤵
        
        PID:1764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29705.exe
        6⤵
        
        PID:2064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23088.exe
        6⤵
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63708.exe
        6⤵
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-948.exe
        6⤵
        
        PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9839.exe
        5⤵
        
        PID:932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61328.exe
        5⤵
        
        PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47411.exe
        5⤵
        
        PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48714.exe
        5⤵
        
        PID:5576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37119.exe
      4⤵
      PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        5⤵
        
        PID:3392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15617.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4291.exe
      4⤵
      PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30632.exe
      4⤵
      PID:4832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29567.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25274.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25274.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27499.exe
      4⤵
      PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43286.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11031.exe
        5⤵
        
        PID:4924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57064.exe
        5⤵
        
        PID:5252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59860.exe
      4⤵
      PID:3100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15198.exe
      4⤵
      PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10216.exe
      4⤵
      PID:5296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30112.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30112.exe
    3⤵
    PID:1588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3457.exe
      4⤵
      PID:3408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33636.exe
      4⤵
      PID:4536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57064.exe
      4⤵
      PID:380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55724.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55724.exe
    3⤵
    PID:1944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42008.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42008.exe
    3⤵
    PID:3340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1849.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1849.exe
    3⤵
    PID:5648
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53319.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53319.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28311.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28311.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35117.exe
      4⤵
      PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25279.exe
        5⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        6⤵
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15617.exe
        6⤵
        
        PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47409.exe
        5⤵
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29352.exe
        5⤵
        
        PID:6104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61121.exe
      4⤵
      PID:3252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15198.exe
      4⤵
      PID:4308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26552.exe
      4⤵
      PID:6080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64177.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64177.exe
    3⤵
    PID:2800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9839.exe
      4⤵
      PID:1196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61328.exe
      4⤵
      PID:3364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47411.exe
      4⤵
      PID:5172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40546.exe
      4⤵
      PID:6088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25634.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25634.exe
    3⤵
    PID:1236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10156.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10156.exe
    3⤵
    PID:3920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21966.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21966.exe
    3⤵
    PID:4688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37728.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37728.exe
    3⤵
    PID:5236
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33358.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33358.exe
    3⤵
    PID:1452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
      4⤵
      PID:4088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23370.exe
      4⤵
      PID:1492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
    3⤵
    PID:3796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe
    3⤵
    PID:4624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-948.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-948.exe
    3⤵
    PID:5788
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24958.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24958.exe
  2⤵
  PID:1988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8226.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8226.exe
    3⤵
    PID:4052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33636.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33636.exe
    3⤵
    PID:4940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29352.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29352.exe
    3⤵
    PID:6128
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46027.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46027.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3780
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61168.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61168.exe
  2⤵
  PID:4664
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4417.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4417.exe
  2⤵
  PID:6092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-15108.exe

Filesize
468KB

MD5
d08391b6157d83f0f8538221dc60cb5a

SHA1
7e6e641406947f4b19ae7ba68963888fda2e67f7

SHA256
552264dab57c2dd65561bda6734f9d40fd214a6c8958ea9ada4bbe0aeae985af

SHA512
77904e6562e8a8784a3fcb5d452420f0bff0768e8fc75fcb8f75effd1da8886942816642b6d6ac81f7df2264039dc35606cdf52ea3e27f2cae8d05212b8e3f95

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35264.exe

Filesize
468KB

MD5
c3c4ade7cb16325f022331eade1cd6a2

SHA1
d89b2064fc8b8c929c928684532a681d94f00783

SHA256
3dd38900c12a7323c24162d66d61be18813351362ccd9d63f21fda1f3f68a2ce

SHA512
529f6cc0d15c22bd2361b4ad24967b8a2083f8cd64b8598e693f745664962fbeed43e7989180fe17f110fb3aaa3fb63c98198e71fbbe21f933526ea0bfd10256

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48263.exe

Filesize
468KB

MD5
8ec08e914177805db60714642801a19e

SHA1
993ae7b4f7f50435ec8c3e590ef8bc2d761447dc

SHA256
d0dc597bb735476c68ea72431fad4106301715d4df267614b8045860104fdf1f

SHA512
72a7ca581700549f89f474c963527f407c9a1a8926fd24adfed875449c1b94dfdf80fe1006e2806cfa94ce8e351e2f743a044063349387ee593676d7530ec7bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52659.exe

Filesize
468KB

MD5
9fe9445900e5b01fcfeb3d9c18338c8f

SHA1
bf439501a9534b0fe29e16ce0a33469401acb4c4

SHA256
57a13c6affd17592989978c92a0b5aa6d04e6f18b42c00a059591f3c0df1a476

SHA512
0d8fecda90cae9366494817ea0a9774bc03361add1b5477f5654911eed4fb5c1c2d88f5e52ca4616f7f91d9ba97ce9079c171884d7888a426c32382e3552c1b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58179.exe

Filesize
468KB

MD5
e673b3671e520774b2e0f90529828c9c

SHA1
c61da2f1d85432616670743cd9fdd6021ae6d70d

SHA256
288405a4120d4f40ef329b5ee4d6196085bb46e442c2d88df94c2fabcd606057

SHA512
13af57668e53f3abca20e6362ada5377c1d42e6035e00122ce72422cf7573a852be2119c2055bf4cae53ce5dcb3ffcac61595643f08ff8c1dbcf8b742ede01df

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5975.exe

Filesize
468KB

MD5
33ceaccba62f2ed0a847b1fea8c93df9

SHA1
2533a5aa4c31b106528afcbe0269580592ef6f9e

SHA256
61ba59cb519c8393afe9ff743372b1f6f441fc3ccd10dd986bab118cfc661024

SHA512
d58aaa3fda66cde28638799939992cfeff6a280826b90e72baf3b154919e46cba5da9af0a9493c3c9d75fac10902bab6da7fc9c5d58e046cffda9c7f242a1e27

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64309.exe

Filesize
468KB

MD5
3655745444561ca892f2eed9df436426

SHA1
8182f74ab8b087b7d3420d6c7a401829ebacd406

SHA256
2f7164ea25946c0016bbf430d3c52da0aaa21ee8d986d748be07c65fb893833a

SHA512
c66ae73f889873d44f5909d05a60c0f04cf1586c9bc87ec780095cced00aee0c26e204960f314210e45905d0c4b6d8460f8ab0a2a64ac2f5462843541e77fa45

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9493.exe

Filesize
468KB

MD5
97e0b8962e91d9bd5cbecaf14d97a111

SHA1
75d4331d9e323262bd3b71a801943456bbdad947

SHA256
d672df7984417d538188b8253255628ed7715ae954bcaf09a43a1303714cd54b

SHA512
dfde28910994a616104b90a6802dc1a6d6edf2d4a95328093116860788a367e9bf64df872277cae3b265afa7ab1a0d041f19fb342a3774edf47e52f923b1bdd2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15227.exe

Filesize
468KB

MD5
eacb779219e1b9c8ce2262d4fb092e1c

SHA1
74adb889472aa63da7b5af0065a0023eb50074c7

SHA256
1e698290b2c6269c6cacb3f91726589d5f773552309b15929b2b0215e8feb18d

SHA512
3dea590d6879c47994c51040760477bbe3e14d833635a6430e5692982e8d948d787b5b8c18191151578a0dc2d6886589dd7ba9d41ee467e0ed4d8a3756199e64

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15492.exe

Filesize
468KB

MD5
229966fdf7826c4db45bc17916d89f65

SHA1
15b86d5b88acd631f053a8cf5afd3794f3a5ec38

SHA256
ef001ecbdfbd708f6693ec8884d6da188f41921f24d8e117dce9fb0fc4cbe292

SHA512
25b047a2ad1d2b55e192fa456c5eb5d368aab13e2f82a4c58ed973716e91c1b612866d2a582f388ca2a4f9188b2dfb4d9a8a2b10ba28d2db1ae4f7d450825bd7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22312.exe

Filesize
468KB

MD5
ecf90cbcfaafecbe33f1c0eb717632cc

SHA1
cf29b82b9463e1574be2a7b736e842b7d5768758

SHA256
4b88029be6b8fefd4a4b5c983dcd957785ef6d8afef103b8524c9918b77572ae

SHA512
a62ff58b1d3797021dd98c0ad21c5494fd4ea5ed5fbbc7763dcf6c9be351f7072724f9648caee97eb743878e0c020ae0d052b386cffcc743b9ad374b1c091078

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31440.exe

Filesize
468KB

MD5
f709a7f6ee0030b34408ef18b8a78af1

SHA1
c579fb1b5270b7464afd7682ad146b241d6e34d5

SHA256
bf8849281aaadab1c27a862a3101279e37e59385a5eaf92b4106fb99c2cbaf8e

SHA512
c5b9d3bc90e5571aa664b0fec747224ea47d2f1da2f2e03a6094dae07fe5e8effc380a1604b52bd671384e170063b892c0585b4eb0b0832540e1604206cd177c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3363.exe

Filesize
468KB

MD5
02739d6c3dc138539fb8629e8e5e708a

SHA1
5da15fc1756cfa53c59afd26acb4d91144c19fe2

SHA256
170e92421c77dd2ff67214b4a208705666961ff9854acc483579cadd41a986f8

SHA512
25538a2a8803d980f2ccdfe59ffc4d0a1592f52eb8ab492a72304de6595da7ced99eb374dbc14a31dbba8b1c6e4ce5490dfc2e1cd24ea922ce171ad45eac8ede

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46359.exe

Filesize
468KB

MD5
0171584159affaec9beb31b0a162f24d

SHA1
b25e8d590217104afce35a2aa00e3e194c5003ef

SHA256
aa99d99c2a3b7273c9b0d5371a59cc08a45b0b0dc89a80dfbaff91f4c18160e7

SHA512
33ba7c860e7687661d59fae029aa9508b82864b5e5b15817a1b1def85162d7d7e6074146d9d6365d00e2c97f8dd3ae1da018f695a5af69c4e7a64c0275626faf

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46997.exe

Filesize
468KB

MD5
986abe9685547d54e431408240ce6048

SHA1
2324f50c3fc487717eb48d2bfd1f8cbecc3cd7f4

SHA256
7b687a2aa65b5a05cd104b6b51b38aad04cb5242995ed134f08b126ea2ad456d

SHA512
cd6c4c93b1a860dff11e1c634ae6bb80a514c5410e2ae0fefe2811cb1e4fbfceab3aa2e3077624dfdbb54f44f8c7ffa1724e21401ec8f1e99f6863ad3195d85b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47319.exe

Filesize
468KB

MD5
af0a403dc170d4584178b013e7d53503

SHA1
9365fa1a8f5c650e5282d7a01c25684fd4a7f0a0

SHA256
3825ee5972e52fba8b12e3d1ebf2ddeea5389a7f312de039a4542f9d61430934

SHA512
83aef9ec1a8dc6f931059e011c640416db0d41ec6c93213cf3bb4852291d5ee6a0132a7ee1427b79475172c7e8a18b07ef9dcce2aea6c4b9bb8dc018567c8f57

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49405.exe

Filesize
468KB

MD5
e9096d17a99c42f752ea0ee930680fdc

SHA1
d5540c8327931b370621007524a016822ca34cdd

SHA256
45f1ac1b665737189e72b5c63bff58e81d188f77569b55deaeea4068a3727c3c

SHA512
5cdfbc7fc2c97217c2549beb3d2ba9a4afff4221eaa57f691dfc1c052cb8ff66a62cb4bd634ef026482f54feb54c88b4fdd82cd5c7581384ebeb9c9482a5ab8e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61164.exe

Filesize
468KB

MD5
57c2ac3b5264906d0bc4ffc20a43f23f

SHA1
2216f8c47aca3a977c1e07d90efda94cc516b0c2

SHA256
b48a293e1fb60e59893595a3c75c02785bee3ca92b22782771dc18eef510aee5

SHA512
b273d9c091b32e1cb60a9034a63695007ec6e852518fa0ecc6872433534685d348d4cac17ed20cf1a73914e6a8ccaefbebd754bdb348cdd8aeeff19c4c8812e0

Download Submit