8d5f21374418bba0bf863161120206a39431a57e703a334a05d7ee111cb95503

Analysis

max time kernel
120s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 05:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d5f21374418bba0bf863161120206a39431a57e703a334a05d7ee111cb95503N.exe
Size

468KB
MD5

e41203eec89d744bff96c227b5ea4ca0
SHA1

56aa8866f2e0637619143a50c1935f53c4fb078f
SHA256

8d5f21374418bba0bf863161120206a39431a57e703a334a05d7ee111cb95503
SHA512

275f4412181ddc86480b27715889e8462361ace883d9eca38e2ad4127650a02954b91a9ef3c9a04c97c772e89bf4a26d6db9a4e2c6c7ae8e409ca7cfb088e15f
SSDEEP

3072:FbedovI76q5yubYsPYmhff8g/EbCP3p0PmHexVosTJI7md4cqSlU:Fb0oVuyuHPrhffFZeNTJ6O4cq

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
868	Unicorn-50848.exe
2964	Unicorn-61943.exe
2132	Unicorn-9405.exe
2392	Unicorn-1925.exe
2756	Unicorn-31068.exe
2792	Unicorn-37212.exe
2824	Unicorn-51318.exe
1572	Unicorn-5812.exe
2604	Unicorn-59076.exe
2360	Unicorn-47997.exe
1768	Unicorn-23301.exe
2552	Unicorn-23036.exe
2676	Unicorn-23301.exe
1712	Unicorn-17170.exe
1648	Unicorn-35723.exe
1052	Unicorn-48703.exe
568	Unicorn-4141.exe
864	Unicorn-52076.exe
2128	Unicorn-32018.exe
2108	Unicorn-44977.exe
2284	Unicorn-12304.exe
1604	Unicorn-39423.exe
2004	Unicorn-58360.exe
524	Unicorn-39305.exe
1828	Unicorn-22777.exe
1680	Unicorn-47592.exe
1544	Unicorn-9054.exe
2844	Unicorn-23161.exe
2508	Unicorn-52605.exe
1032	Unicorn-6933.exe
2540	Unicorn-14147.exe
1004	Unicorn-53934.exe
2208	Unicorn-9948.exe
2568	Unicorn-37899.exe
2704	Unicorn-12361.exe
2808	Unicorn-31158.exe
2228	Unicorn-47420.exe
2960	Unicorn-32227.exe
2928	Unicorn-18312.exe
3020	Unicorn-31843.exe
2968	Unicorn-54738.exe
2788	Unicorn-43000.exe
2640	Unicorn-43119.exe
2144	Unicorn-60494.exe
2680	Unicorn-3887.exe
2664	Unicorn-54157.exe
1920	Unicorn-13124.exe
264	Unicorn-41115.exe
548	Unicorn-8827.exe
2972	Unicorn-33331.exe
1764	Unicorn-58589.exe
784	Unicorn-18434.exe
628	Unicorn-18434.exe
2236	Unicorn-18434.exe
900	Unicorn-18434.exe
1776	Unicorn-18434.exe
2404	Unicorn-18434.exe
948	Unicorn-18434.exe
1784	Unicorn-50073.exe
2340	Unicorn-7124.exe
2168	Unicorn-58926.exe
2252	Unicorn-34124.exe
1240	Unicorn-51910.exe
816	Unicorn-51910.exe

Loads dropped DLL 64 IoCs

pid	Process
2532	8d5f21374418bba0bf863161120206a39431a57e703a334a05d7ee111cb95503N.exe
2532	8d5f21374418bba0bf863161120206a39431a57e703a334a05d7ee111cb95503N.exe
868	Unicorn-50848.exe
868	Unicorn-50848.exe
2532	8d5f21374418bba0bf863161120206a39431a57e703a334a05d7ee111cb95503N.exe
2532	8d5f21374418bba0bf863161120206a39431a57e703a334a05d7ee111cb95503N.exe
2964	Unicorn-61943.exe
2964	Unicorn-61943.exe
868	Unicorn-50848.exe
868	Unicorn-50848.exe
2532	8d5f21374418bba0bf863161120206a39431a57e703a334a05d7ee111cb95503N.exe
2132	Unicorn-9405.exe
2132	Unicorn-9405.exe
2532	8d5f21374418bba0bf863161120206a39431a57e703a334a05d7ee111cb95503N.exe
2392	Unicorn-1925.exe
2392	Unicorn-1925.exe
2964	Unicorn-61943.exe
2964	Unicorn-61943.exe
2792	Unicorn-37212.exe
2792	Unicorn-37212.exe
2532	8d5f21374418bba0bf863161120206a39431a57e703a334a05d7ee111cb95503N.exe
2532	8d5f21374418bba0bf863161120206a39431a57e703a334a05d7ee111cb95503N.exe
2824	Unicorn-51318.exe
2756	Unicorn-31068.exe
868	Unicorn-50848.exe
2824	Unicorn-51318.exe
2756	Unicorn-31068.exe
868	Unicorn-50848.exe
2132	Unicorn-9405.exe
2132	Unicorn-9405.exe
1572	Unicorn-5812.exe
1572	Unicorn-5812.exe
2392	Unicorn-1925.exe
2392	Unicorn-1925.exe
2360	Unicorn-47997.exe
2360	Unicorn-47997.exe
2792	Unicorn-37212.exe
2792	Unicorn-37212.exe
1648	Unicorn-35723.exe
1648	Unicorn-35723.exe
1768	Unicorn-23301.exe
1768	Unicorn-23301.exe
2132	Unicorn-9405.exe
2132	Unicorn-9405.exe
2824	Unicorn-51318.exe
2824	Unicorn-51318.exe
1712	Unicorn-17170.exe
1712	Unicorn-17170.exe
2604	Unicorn-59076.exe
2604	Unicorn-59076.exe
868	Unicorn-50848.exe
868	Unicorn-50848.exe
2964	Unicorn-61943.exe
2964	Unicorn-61943.exe
2676	Unicorn-23301.exe
2676	Unicorn-23301.exe
2552	Unicorn-23036.exe
2552	Unicorn-23036.exe
2756	Unicorn-31068.exe
2756	Unicorn-31068.exe
2532	8d5f21374418bba0bf863161120206a39431a57e703a334a05d7ee111cb95503N.exe
2532	8d5f21374418bba0bf863161120206a39431a57e703a334a05d7ee111cb95503N.exe
1052	Unicorn-48703.exe
1052	Unicorn-48703.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21589.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8203.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11246.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23301.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45216.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44481.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46692.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46790.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21589.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37212.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8827.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31501.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-329.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6287.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40240.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32072.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24155.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9054.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41115.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44783.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48861.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54738.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22619.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49412.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62458.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50388.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38924.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60651.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11829.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31068.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22777.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26483.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47117.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12304.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17304.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61943.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51986.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38573.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16521.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62458.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16864.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48200.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26886.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58439.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46692.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16611.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7813.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36657.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37553.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49138.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40906.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14746.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2532	8d5f21374418bba0bf863161120206a39431a57e703a334a05d7ee111cb95503N.exe
868	Unicorn-50848.exe
2964	Unicorn-61943.exe
2132	Unicorn-9405.exe
2392	Unicorn-1925.exe
2792	Unicorn-37212.exe
2824	Unicorn-51318.exe
2756	Unicorn-31068.exe
1572	Unicorn-5812.exe
2604	Unicorn-59076.exe
2360	Unicorn-47997.exe
1768	Unicorn-23301.exe
1712	Unicorn-17170.exe
1648	Unicorn-35723.exe
2552	Unicorn-23036.exe
2676	Unicorn-23301.exe
1052	Unicorn-48703.exe
568	Unicorn-4141.exe
864	Unicorn-52076.exe
2128	Unicorn-32018.exe
2108	Unicorn-44977.exe
2284	Unicorn-12304.exe
1604	Unicorn-39423.exe
2004	Unicorn-58360.exe
524	Unicorn-39305.exe
1828	Unicorn-22777.exe
1680	Unicorn-47592.exe
2844	Unicorn-23161.exe
1544	Unicorn-9054.exe
2508	Unicorn-52605.exe
2540	Unicorn-14147.exe
1032	Unicorn-6933.exe
1004	Unicorn-53934.exe
2208	Unicorn-9948.exe
2568	Unicorn-37899.exe
2808	Unicorn-31158.exe
2960	Unicorn-32227.exe
2228	Unicorn-47420.exe
2928	Unicorn-18312.exe
2704	Unicorn-12361.exe
3020	Unicorn-31843.exe
2968	Unicorn-54738.exe
2788	Unicorn-43000.exe
2640	Unicorn-43119.exe
2664	Unicorn-54157.exe
2680	Unicorn-3887.exe
2144	Unicorn-60494.exe
548	Unicorn-8827.exe
1920	Unicorn-13124.exe
264	Unicorn-41115.exe
2972	Unicorn-33331.exe
1764	Unicorn-58589.exe
2236	Unicorn-18434.exe
948	Unicorn-18434.exe
900	Unicorn-18434.exe
1776	Unicorn-18434.exe
784	Unicorn-18434.exe
628	Unicorn-18434.exe
2404	Unicorn-18434.exe
1784	Unicorn-50073.exe
2168	Unicorn-58926.exe
2340	Unicorn-7124.exe
2580	Unicorn-3285.exe
2252	Unicorn-34124.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 868	2532	8d5f21374418bba0bf863161120206a39431a57e703a334a05d7ee111cb95503N.exe	30
PID 2532 wrote to memory of 868	2532	8d5f21374418bba0bf863161120206a39431a57e703a334a05d7ee111cb95503N.exe	30
PID 2532 wrote to memory of 868	2532	8d5f21374418bba0bf863161120206a39431a57e703a334a05d7ee111cb95503N.exe	30
PID 2532 wrote to memory of 868	2532	8d5f21374418bba0bf863161120206a39431a57e703a334a05d7ee111cb95503N.exe	30
PID 868 wrote to memory of 2964	868	Unicorn-50848.exe	31
PID 868 wrote to memory of 2964	868	Unicorn-50848.exe	31
PID 868 wrote to memory of 2964	868	Unicorn-50848.exe	31
PID 868 wrote to memory of 2964	868	Unicorn-50848.exe	31
PID 2532 wrote to memory of 2132	2532	8d5f21374418bba0bf863161120206a39431a57e703a334a05d7ee111cb95503N.exe	32
PID 2532 wrote to memory of 2132	2532	8d5f21374418bba0bf863161120206a39431a57e703a334a05d7ee111cb95503N.exe	32
PID 2532 wrote to memory of 2132	2532	8d5f21374418bba0bf863161120206a39431a57e703a334a05d7ee111cb95503N.exe	32
PID 2532 wrote to memory of 2132	2532	8d5f21374418bba0bf863161120206a39431a57e703a334a05d7ee111cb95503N.exe	32
PID 2964 wrote to memory of 2392	2964	Unicorn-61943.exe	33
PID 2964 wrote to memory of 2392	2964	Unicorn-61943.exe	33
PID 2964 wrote to memory of 2392	2964	Unicorn-61943.exe	33
PID 2964 wrote to memory of 2392	2964	Unicorn-61943.exe	33
PID 868 wrote to memory of 2756	868	Unicorn-50848.exe	34
PID 868 wrote to memory of 2756	868	Unicorn-50848.exe	34
PID 868 wrote to memory of 2756	868	Unicorn-50848.exe	34
PID 868 wrote to memory of 2756	868	Unicorn-50848.exe	34
PID 2132 wrote to memory of 2824	2132	Unicorn-9405.exe	36
PID 2132 wrote to memory of 2824	2132	Unicorn-9405.exe	36
PID 2132 wrote to memory of 2824	2132	Unicorn-9405.exe	36
PID 2132 wrote to memory of 2824	2132	Unicorn-9405.exe	36
PID 2532 wrote to memory of 2792	2532	8d5f21374418bba0bf863161120206a39431a57e703a334a05d7ee111cb95503N.exe	35
PID 2532 wrote to memory of 2792	2532	8d5f21374418bba0bf863161120206a39431a57e703a334a05d7ee111cb95503N.exe	35
PID 2532 wrote to memory of 2792	2532	8d5f21374418bba0bf863161120206a39431a57e703a334a05d7ee111cb95503N.exe	35
PID 2532 wrote to memory of 2792	2532	8d5f21374418bba0bf863161120206a39431a57e703a334a05d7ee111cb95503N.exe	35
PID 2392 wrote to memory of 1572	2392	Unicorn-1925.exe	37
PID 2392 wrote to memory of 1572	2392	Unicorn-1925.exe	37
PID 2392 wrote to memory of 1572	2392	Unicorn-1925.exe	37
PID 2392 wrote to memory of 1572	2392	Unicorn-1925.exe	37
PID 2964 wrote to memory of 2604	2964	Unicorn-61943.exe	38
PID 2964 wrote to memory of 2604	2964	Unicorn-61943.exe	38
PID 2964 wrote to memory of 2604	2964	Unicorn-61943.exe	38
PID 2964 wrote to memory of 2604	2964	Unicorn-61943.exe	38
PID 2792 wrote to memory of 2360	2792	Unicorn-37212.exe	39
PID 2792 wrote to memory of 2360	2792	Unicorn-37212.exe	39
PID 2792 wrote to memory of 2360	2792	Unicorn-37212.exe	39
PID 2792 wrote to memory of 2360	2792	Unicorn-37212.exe	39
PID 2532 wrote to memory of 2552	2532	8d5f21374418bba0bf863161120206a39431a57e703a334a05d7ee111cb95503N.exe	40
PID 2532 wrote to memory of 2552	2532	8d5f21374418bba0bf863161120206a39431a57e703a334a05d7ee111cb95503N.exe	40
PID 2532 wrote to memory of 2552	2532	8d5f21374418bba0bf863161120206a39431a57e703a334a05d7ee111cb95503N.exe	40
PID 2532 wrote to memory of 2552	2532	8d5f21374418bba0bf863161120206a39431a57e703a334a05d7ee111cb95503N.exe	40
PID 2824 wrote to memory of 1768	2824	Unicorn-51318.exe	41
PID 2824 wrote to memory of 1768	2824	Unicorn-51318.exe	41
PID 2824 wrote to memory of 1768	2824	Unicorn-51318.exe	41
PID 2824 wrote to memory of 1768	2824	Unicorn-51318.exe	41
PID 2756 wrote to memory of 2676	2756	Unicorn-31068.exe	42
PID 2756 wrote to memory of 2676	2756	Unicorn-31068.exe	42
PID 2756 wrote to memory of 2676	2756	Unicorn-31068.exe	42
PID 2756 wrote to memory of 2676	2756	Unicorn-31068.exe	42
PID 868 wrote to memory of 1712	868	Unicorn-50848.exe	43
PID 868 wrote to memory of 1712	868	Unicorn-50848.exe	43
PID 868 wrote to memory of 1712	868	Unicorn-50848.exe	43
PID 868 wrote to memory of 1712	868	Unicorn-50848.exe	43
PID 2132 wrote to memory of 1648	2132	Unicorn-9405.exe	44
PID 2132 wrote to memory of 1648	2132	Unicorn-9405.exe	44
PID 2132 wrote to memory of 1648	2132	Unicorn-9405.exe	44
PID 2132 wrote to memory of 1648	2132	Unicorn-9405.exe	44
PID 1572 wrote to memory of 1052	1572	Unicorn-5812.exe	45
PID 1572 wrote to memory of 1052	1572	Unicorn-5812.exe	45
PID 1572 wrote to memory of 1052	1572	Unicorn-5812.exe	45
PID 1572 wrote to memory of 1052	1572	Unicorn-5812.exe	45

C:\Users\Admin\AppData\Local\Temp\8d5f21374418bba0bf863161120206a39431a57e703a334a05d7ee111cb95503N.exe
"C:\Users\Admin\AppData\Local\Temp\8d5f21374418bba0bf863161120206a39431a57e703a334a05d7ee111cb95503N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50848.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50848.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61943.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61943.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1925.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5812.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48703.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53934.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18434.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62458.exe
        8⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22623.exe
        8⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46790.exe
        8⤵
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16864.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51583.exe
        8⤵
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58926.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53212.exe
        7⤵
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20180.exe
        7⤵
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3507.exe
        7⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62795.exe
        7⤵
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9948.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18434.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62458.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6287.exe
        7⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37553.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8203.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18526.exe
        7⤵
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-108.exe
        6⤵
        
        PID:1760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50346.exe
        6⤵
        
        PID:2536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22044.exe
        6⤵
        
        PID:3312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21589.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17394.exe
        6⤵
        
        PID:4240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47117.exe
        6⤵
        
        PID:5060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4141.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37899.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18434.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43245.exe
        8⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62458.exe
        7⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6287.exe
        7⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46790.exe
        7⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63487.exe
        7⤵
        
        PID:4136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51910.exe
        6⤵
        Executes dropped EXE
        
        PID:1240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44481.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2832.exe
        6⤵
        
        PID:3248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38124.exe
        6⤵
        
        PID:1184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-521.exe
        6⤵
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3111.exe
        6⤵
        
        PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47420.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39076.exe
        5⤵
        
        PID:1836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3288.exe
        5⤵
        
        PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38655.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61401.exe
        5⤵
        
        PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41782.exe
        5⤵
        
        PID:3924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59076.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22777.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54157.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48200.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58439.exe
        8⤵
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22619.exe
        8⤵
        
        PID:360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33760.exe
        8⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57273.exe
        8⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16800.exe
        8⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41876.exe
        7⤵
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36657.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38124.exe
        7⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40209.exe
        7⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3111.exe
        7⤵
        
        PID:3520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1630.exe
        6⤵
        
        PID:1472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58439.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30787.exe
        7⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35105.exe
        7⤵
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49105.exe
        7⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59675.exe
        7⤵
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52309.exe
        6⤵
        
        PID:1252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50388.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28887.exe
        6⤵
        
        PID:3076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7620.exe
        6⤵
        
        PID:4456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3111.exe
        6⤵
        
        PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8827.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34692.exe
        6⤵
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        7⤵
        
        PID:364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11893.exe
        8⤵
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18528.exe
        8⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19664.exe
        8⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11246.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54628.exe
        7⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36255.exe
        7⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33940.exe
        7⤵
        
        PID:4220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14902.exe
        6⤵
        
        PID:2620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7932.exe
        6⤵
        
        PID:3368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46790.exe
        6⤵
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24539.exe
        6⤵
        
        PID:4568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51583.exe
        6⤵
        
        PID:4128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-705.exe
        5⤵
        
        PID:2500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4187.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
        6⤵
        
        PID:3872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59545.exe
        6⤵
        
        PID:3596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11246.exe
        6⤵
        
        PID:4284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44783.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16611.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21589.exe
        5⤵
        
        PID:4060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24685.exe
        5⤵
        
        PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47117.exe
        5⤵
        
        PID:4148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9054.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18434.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32985.exe
        6⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13711.exe
        7⤵
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32956.exe
        7⤵
        
        PID:664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
        7⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43019.exe
        7⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27846.exe
        7⤵
        
        PID:4916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25366.exe
        6⤵
        
        PID:2744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46692.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45381.exe
        6⤵
        
        PID:3224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51986.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51116.exe
        6⤵
        
        PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45216.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42229.exe
        5⤵
        
        PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26.exe
        5⤵
        
        PID:3984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10095.exe
        5⤵
        
        PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        5⤵
        
        PID:5088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1178.exe
      4⤵
      PID:1560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55865.exe
        5⤵
        
        PID:2064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22619.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49412.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11533.exe
        5⤵
        
        PID:3804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10090.exe
        5⤵
        
        PID:4448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41681.exe
      4⤵
      PID:2220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8956.exe
        5⤵
        
        PID:3992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18004.exe
        5⤵
        
        PID:4088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57122.exe
        5⤵
        
        PID:4920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5509.exe
      4⤵
      PID:3276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32635.exe
      4⤵
      PID:1684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10197.exe
      4⤵
      PID:5012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31068.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31068.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23301.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23161.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51910.exe
        6⤵
        Executes dropped EXE
        
        PID:816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44481.exe
        6⤵
        
        PID:1528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2832.exe
        6⤵
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28932.exe
        6⤵
        
        PID:2956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4198.exe
        6⤵
        
        PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41115.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7188.exe
        6⤵
        
        PID:2172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32956.exe
        6⤵
        
        PID:764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
        6⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60651.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59099.exe
        6⤵
        
        PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52309.exe
        5⤵
        
        PID:1276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3617.exe
        5⤵
        
        PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60326.exe
        5⤵
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64733.exe
        5⤵
        
        PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52605.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18434.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62458.exe
        5⤵
        
        PID:2328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6287.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46790.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56745.exe
        5⤵
        
        PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26886.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7124.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24835.exe
        5⤵
        
        PID:1480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57375.exe
        5⤵
        
        PID:4576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16521.exe
      4⤵
      PID:2412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10695.exe
      4⤵
      PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21589.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24685.exe
      4⤵
      PID:4500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
      4⤵
      PID:4324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17170.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17170.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39305.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13124.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35999.exe
        5⤵
        
        PID:2816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        5⤵
        
        PID:3932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29456.exe
        5⤵
        
        PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9169.exe
        5⤵
        
        PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4627.exe
        5⤵
        
        PID:4252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33331.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7136.exe
        5⤵
        
        PID:2332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44471.exe
        6⤵
        
        PID:828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64007.exe
        6⤵
        
        PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60481.exe
        5⤵
        
        PID:1612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3459.exe
        5⤵
        
        PID:3832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12524.exe
        5⤵
        
        PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11829.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52703.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64978.exe
        5⤵
        
        PID:4912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48094.exe
      4⤵
      PID:2524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-659.exe
      4⤵
      PID:3796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37624.exe
      4⤵
      PID:3412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61510.exe
      4⤵
      PID:5104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47592.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47592.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3887.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48359.exe
        5⤵
        
        PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55261.exe
        5⤵
        
        PID:3780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40925.exe
        5⤵
        
        PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65410.exe
        5⤵
        
        PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2581.exe
        5⤵
        
        PID:5068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25610.exe
      4⤵
      PID:1988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21602.exe
      4⤵
      PID:3464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38124.exe
      4⤵
      PID:1796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50124.exe
      4⤵
      PID:4160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60494.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60494.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61952.exe
      4⤵
      PID:1580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57461.exe
      4⤵
      PID:2076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
      4⤵
      PID:3344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11642.exe
      4⤵
      PID:3612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59675.exe
      4⤵
      PID:4632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21878.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21878.exe
    3⤵
    PID:2868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36638.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36638.exe
    3⤵
    PID:1600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15715.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15715.exe
    3⤵
    PID:3356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42178.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42178.exe
    3⤵
    PID:3972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54067.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54067.exe
    3⤵
    PID:4728
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9405.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9405.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51318.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51318.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23301.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12304.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58589.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56965.exe
        7⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25172.exe
        7⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
        7⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11533.exe
        7⤵
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59675.exe
        7⤵
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38443.exe
        6⤵
        
        PID:600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46692.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45381.exe
        6⤵
        
        PID:3236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51986.exe
        6⤵
        
        PID:3488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43139.exe
        6⤵
        
        PID:1340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50073.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45048.exe
        6⤵
        
        PID:2072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63045.exe
        6⤵
        
        PID:3692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40925.exe
        6⤵
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57325.exe
        6⤵
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2581.exe
        6⤵
        
        PID:4200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10656.exe
        5⤵
        
        PID:1152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28489.exe
        5⤵
        
        PID:844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38124.exe
        5⤵
        
        PID:3868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-329.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22582.exe
        5⤵
        
        PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58360.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52507.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28140.exe
        6⤵
        
        PID:2692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22623.exe
        6⤵
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46790.exe
        6⤵
        
        PID:4008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39175.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52309.exe
        5⤵
        
        PID:1788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50388.exe
        5⤵
        
        PID:2352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41241.exe
        5⤵
        
        PID:3540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32072.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22115.exe
        5⤵
        
        PID:4956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34124.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27957.exe
        5⤵
        
        PID:4236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16521.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3487.exe
      4⤵
      PID:3088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12352.exe
      4⤵
      PID:3116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53175.exe
      4⤵
      PID:4872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39255.exe
      4⤵
      PID:4224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35723.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35723.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44977.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31843.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61952.exe
        6⤵
        
        PID:1244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13470.exe
        6⤵
        
        PID:1952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
        6⤵
        
        PID:3260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11642.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35746.exe
        6⤵
        
        PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61796.exe
        5⤵
        
        PID:2296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46692.exe
        5⤵
        
        PID:2008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45381.exe
        5⤵
        
        PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51986.exe
        5⤵
        
        PID:3140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26483.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22582.exe
        5⤵
        
        PID:4812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54738.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48359.exe
        5⤵
        
        PID:3044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38924.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40240.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17304.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54.exe
        5⤵
        
        PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52309.exe
      4⤵
      PID:1492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50388.exe
      4⤵
      PID:1692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8568.exe
      4⤵
      PID:3568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23904.exe
      4⤵
      PID:3584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11196.exe
      4⤵
      PID:3688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39423.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39423.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43000.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18476.exe
        5⤵
        
        PID:1040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22619.exe
        5⤵
        
        PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41117.exe
        5⤵
        
        PID:3852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40906.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43422.exe
        5⤵
        
        PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
      4⤵
      PID:1324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21602.exe
      4⤵
      PID:3472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38124.exe
      4⤵
      PID:3940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14745.exe
      4⤵
      PID:4176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-387.exe
      4⤵
      PID:4532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43119.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43119.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49509.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49509.exe
    3⤵
    PID:2268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25187.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25187.exe
    3⤵
    PID:2608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32835.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32835.exe
    3⤵
    PID:3676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19439.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19439.exe
    3⤵
    PID:3352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33339.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33339.exe
    3⤵
    PID:4600
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37212.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37212.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47997.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47997.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52076.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31158.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10016.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6804.exe
        7⤵
        
        PID:584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49869.exe
        7⤵
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
        7⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11642.exe
        7⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35746.exe
        7⤵
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36355.exe
        6⤵
        
        PID:916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39626.exe
        6⤵
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48608.exe
        6⤵
        
        PID:1720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19211.exe
        6⤵
        
        PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28033.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42229.exe
        5⤵
        
        PID:2180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9324.exe
        5⤵
        
        PID:3768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54160.exe
        5⤵
        
        PID:3380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42148.exe
        5⤵
        
        PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12361.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7813.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8366.exe
        5⤵
        
        PID:4548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52309.exe
      4⤵
      PID:2056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42220.exe
      4⤵
      PID:1704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36715.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51979.exe
      4⤵
      PID:3912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36277.exe
      4⤵
      PID:4336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32018.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32018.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32227.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56965.exe
        5⤵
        
        PID:1740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41700.exe
        5⤵
        
        PID:1268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
        5⤵
        
        PID:3268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11642.exe
        5⤵
        
        PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18258.exe
        5⤵
        
        PID:4480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30275.exe
      4⤵
      PID:2596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46692.exe
      4⤵
      PID:2772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45381.exe
      4⤵
      PID:3216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51986.exe
      4⤵
      PID:3440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43646.exe
      4⤵
      PID:4764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18312.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18312.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17288.exe
      4⤵
      PID:4660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58174.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58174.exe
    3⤵
    PID:2256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33554.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33554.exe
    3⤵
    PID:2104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14425.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14425.exe
    3⤵
    PID:3524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49138.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49138.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14746.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14746.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4348
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23036.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23036.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6933.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6933.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18434.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47088.exe
        5⤵
        
        PID:2976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25780.exe
        5⤵
        
        PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54786.exe
        5⤵
        
        PID:3416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18755.exe
        5⤵
        
        PID:4488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62458.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6287.exe
      4⤵
      PID:3200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46790.exe
      4⤵
      PID:4044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24155.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51583.exe
      4⤵
      PID:4216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3285.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3285.exe
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31501.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17004.exe
      4⤵
      PID:1376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
      4⤵
      PID:3292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11642.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26580.exe
      4⤵
      PID:2992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52309.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52309.exe
    3⤵
    PID:2316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50388.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50388.exe
    3⤵
    PID:2372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32304.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32304.exe
    3⤵
    PID:3648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48915.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48915.exe
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47117.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47117.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4144
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14147.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14147.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18434.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18434.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25018.exe
      4⤵
      PID:2012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48861.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14444.exe
      4⤵
      PID:4936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62458.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62458.exe
    3⤵
    PID:1976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29831.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29831.exe
    3⤵
    PID:3148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46790.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46790.exe
    3⤵
    PID:4032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57641.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57641.exe
    3⤵
    PID:4864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-584.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-584.exe
    3⤵
    PID:4420
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46309.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46309.exe
  2⤵
  PID:2260
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2880
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1044.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1044.exe
  2⤵
  PID:3300
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11789.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11789.exe
  2⤵
  PID:3980
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60266.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60266.exe
  2⤵
  PID:4288
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18247.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18247.exe
  2⤵
  PID:5116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-23301.exe

Filesize
468KB

MD5
99e0bd615531e34b1b650a75ced2b048

SHA1
14d6537188a514863a13e267a3117988db6480af

SHA256
c9cdf01e15929e78446944f7c234e022e19ab45f2d11f702ddc8485f3e9a7fe0

SHA512
f259d7cd2af45d2cc95603935a326191fbef7f97fa0d199a6a7ada9a3d9db2d69ea61043edf71d2dcf28d92165a026f8a54aea27dae04073f3279d239dd1536b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36355.exe

Filesize
468KB

MD5
787ae7d30fed93648573019d3dd24b28

SHA1
a33ed6736fe726be05242e3534dbe71714db9d78

SHA256
b6cc6900f3294339e25fb70543e6eccf05b35685747f61c8fde4fbdd2d9da310

SHA512
4bbe3a6edef23789d3d6c0d4bd2c00d37633afcb2f19d35a14796fb69e7e0d21406b3f975df393161e411ba63eb7a85b588e2d4e996671143fea73ddade25ece

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47997.exe

Filesize
468KB

MD5
44157ac88135024404fc91cdb510cec9

SHA1
4a859283a2ee3870221ae66c375e5667b18f1b58

SHA256
f6690ed2724c75f1d4ff571f23a174776e655fd18f9adf196bf005df56f4ad38

SHA512
345541de39bc2fab3152ee5f50dde0913cd2d4e529dac80306b2e8c6e5d13cfc146dcd4fafe047b90c67ddbdc3515ec25bb5ca70cd9601251165f4cb46d5847b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48703.exe

Filesize
468KB

MD5
3f242d2c4638c79f6715596e82a31952

SHA1
ceab6a9a42cd6342d87c83ddbcbf85ae70a5b9b5

SHA256
5f2de6a4fda96a672254a58b5e4a04c9f9746893e3631b7a106d5ec96ea63038

SHA512
301122f8a97bb3a6d9b8bf41e102ef4d112234eb1c6e984ea9ca0fea819196dd14435c548e683c357c0a842cee727d9969008f98adc085052263719d179dd7ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51318.exe

Filesize
468KB

MD5
bd87eae93da4fbaa5f5af7a5d5ccdf0f

SHA1
34dd7e70bee89ee8bc8a116045c4caf484bc8ab7

SHA256
bec58b98e9418510e1e20f00fe94fc627d6ff62e21ce49cde1b82c674daffec6

SHA512
c6c51d26e9a6710ca4afe6ad1225b64f7d1a0d05b48eba4547563085ff982736e42a747afd1d9604f926cfbde298ff17b800fbccbeb3d37da30841312f18b647

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17170.exe

Filesize
468KB

MD5
ed9ae9d31efd8db7bd01952916c12b6a

SHA1
f19fab4e9aa745517bc5f2ecc573e7902e7268aa

SHA256
c21d2c44d55945967cf984afb20465851478d4c85770b59c6b1d2c5cadeaf972

SHA512
4af92b912485d47273079abbbf2f7bfd76b0e257f78d78b61de4dc040792ce6241cbed655ab880f37fea366b839af2e5508129938c531a24d090883dc141ca5a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1925.exe

Filesize
468KB

MD5
922b680b721fc482a08cad729a8ee0e2

SHA1
af1c616314023a4e11cc8a7fed1f50f38a5a8f6a

SHA256
c7b26360b9042f9b79da1a37426b318376d912b14f0419774ffe77834df19691

SHA512
de6b39adb8ff2cf2d23466eed2e75dd057ddfafd11d7db3430dab0e7dd66fd7a8b63a0be9a40fd6c8f0b22b3201def13f4bda148b9d3aebf07490d800ecfd7c2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23036.exe

Filesize
468KB

MD5
75c0d4f77dc8c1787f4fad8a6fd3aa29

SHA1
d5df0079be99292fd9ccb45cd6893ba291e585e2

SHA256
8e51bb12512ac6e0bb69ecc36425b316880c5fbd39fa0a4357c40d732f11044c

SHA512
1c143be64ef65e973ec3d68e26eb5c92983496f3f12d3d6b4c3821627b7ccf9428ff006572d873358e936bac1c80e87192e53174d796e6f31a2d27b722462b19

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31068.exe

Filesize
468KB

MD5
2c938ba221ef79159779342ee4b36a24

SHA1
5ce91195525b051f29c8c13b47b486bd03ced0f5

SHA256
601607999205959cbc3b357c6806f64375e58b3f09b49e23d9336148a66fa4d7

SHA512
7776a331b42c80e4e7c3a23fd4dbbd318473cab987d02dfcd90103090d73570d15088aca13460c8d671c3101479d0bbcd143939a81dc08daa5693533e0d2e8c2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-35723.exe

Filesize
468KB

MD5
c6910976416ec9807966bd6e308b37b5

SHA1
c270d24dc69da321a81118a431bcf6557718eea2

SHA256
74e6e629d2c8a28a835c2ece146de401347eb4c2e630143643f84f6b99fd4c7e

SHA512
f96a736063cda76edc308de840b5ba2104b74db9d2704134865ab0eb0285df343f75b5ddb7716ca72b2f88610fdd2f9bf23d5b44b7d1904dc983a782e79dbbd1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37212.exe

Filesize
468KB

MD5
82f34d20b7889f799e531d0881d728e4

SHA1
d5bb38580cbeb57387e72aca48d1eef3b0e7025b

SHA256
cf42edd00484a739d22752ac6cdb383ead1fdba716a5af92f5e5cd426e2f4862

SHA512
bf4d50fe76b653d941a1eebd9046b3a029a23da6903173ed54b63b1e23915f157f25fb9a3f32d43043a2d12a46532d5c3d9a597a03885d23bb9c8b538ab079eb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4141.exe

Filesize
468KB

MD5
66b9e4861e6884f8d46c5ceceb7f7da5

SHA1
4cbb6f182ddcde890b65f32c795d9d764b5ff3e2

SHA256
b54b3a65828f16803fec3c385c5709341180ee35b21a91d5de11daa773b53bb5

SHA512
2e362aa5ded5b69253ae2f93facd49720fe1f6e69acc19043b568ed8e842043d498ed34437bb41d2db376ef44380a3f3f077d51bfe181e3a89a015273522f4ef

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-50848.exe

Filesize
468KB

MD5
32bec256ae0bbfdffc6d56d7ca933ef1

SHA1
3d9ad5af58c780f92b2c3e18964b68b6e5682434

SHA256
b92b8e978b93efea4067f73a0ed166095e8a012aa9cbe47c63a94b9ef3f38c09

SHA512
82660267b50ef15fad2dc04e72d1a85dde13f4b4d48483055d648924cdca52ece680b6478f513097ad85dfca671cf866d7efa0c982774d02f31e949ed20d0dde

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52076.exe

Filesize
468KB

MD5
2170fb0de9dd9c820e730419da64f548

SHA1
91d5166172676f5a062c8a77c060d4721753a217

SHA256
667bf717522abbc0acd9a4a30a2d01c106f4223ff4c24b37f270b087729acd5d

SHA512
5708a1cda889b91bf717e45d291eab193eca7570df2a3c6e7a1e51875f4860f7656b7f4142495814de425f203f831ccb91e6059adc638421148e128ea1d0c368

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-5812.exe

Filesize
468KB

MD5
9eb5c1b3a68fdf69a17a4f26392c09d7

SHA1
88f3f3daef18bb24d0dcba21afd3c62ad1911ffb

SHA256
bea79b5e7a03abe389478318bad27f63542a05ce7f7e6368c7c6a626be2061a1

SHA512
f9560891d6fd1ae670e331383de09dc7977bf232672073ff9dd4b651869c84f66c1cce600502c263cef4870605233c32e4738530ed7dd64536b44d59be62def0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59076.exe

Filesize
468KB

MD5
16b94dd721b24064b08cec349ebd913f

SHA1
f7e71283110c01795a995ad9b616226c57146e73

SHA256
ff043fae1e6d5e211d0014a166b9d81ebce5801f6f4260b0e71e616ce7bd2880

SHA512
e12a374337fa862469325707e9c403f66011c4deb37f91593589741e74937f56cbaf27a7726c333af32b088bae9c945ce8d0d0b18d55a068019c0113a6955b62

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61943.exe

Filesize
468KB

MD5
2a8517d8fc0ee8cdee37564849579e5a

SHA1
e126779b835a8922a07e8ce28f8e61b555d71fc9

SHA256
1ecb8c23220a46180a988955a6a402686d538582385f7bc3792a6b698b1ebe82

SHA512
e1be159497261588076dd40797cc5195315af1df4f5dc34dee079d07081c9d280f608eb8e5cfd3896bca41eff4297ed0c0411f867a2635f7103f4497c93d1618

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9405.exe

Filesize
468KB

MD5
fb18519767d0192958ad340b52cda845

SHA1
f3f840c3ce968f3d6a06975969460b06cbd44c48

SHA256
d5d3ea34586598d6475ec63daf1a8ccee56b9b24a12afaef7cc2747f9d973380

SHA512
d6cf65c078d7ae696060c1b2835966fe11eba4eeea4e3c806d16adb9015b60f7085aa900e161d3184ba719997fa988954e729da1b1a67df3a6b9268409df4c40

Download Submit