9112294dd124229e0c34ab0bf4b1af9e6c4013872b289c91f443517b68b50bb4

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 02:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9112294dd124229e0c34ab0bf4b1af9e6c4013872b289c91f443517b68b50bb4N.exe
Size

468KB
MD5

56dfd563c388f4387099d6f917735bd0
SHA1

c50d5f57224d6a12dea9ed2cf2033c066a832da1
SHA256

9112294dd124229e0c34ab0bf4b1af9e6c4013872b289c91f443517b68b50bb4
SHA512

c6f03c0f5fda1f14674d6ab02f6841a36b26555680daf7657f23781670c046ac75e313ab763162a081530f56f8f6e04deda7d9a0ed6db9eb99b4cca17594aca3
SSDEEP

3072:FTOdovI76q5yubYjPYmhff8gEEb4P3pAPmHexV9Tmn777djcrSlt:FTkoVuyuIPrhff2ZiJmnP5jcr

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2536	Unicorn-2397.exe
2000	Unicorn-20623.exe
2260	Unicorn-33429.exe
2424	Unicorn-34689.exe
2868	Unicorn-30967.exe
2872	Unicorn-50833.exe
2904	Unicorn-28174.exe
2600	Unicorn-34440.exe
2324	Unicorn-30718.exe
1640	Unicorn-999.exe
1804	Unicorn-26472.exe
2688	Unicorn-807.exe
1632	Unicorn-158.exe
812	Unicorn-423.exe
2576	Unicorn-46095.exe
2768	Unicorn-5374.exe
2184	Unicorn-54383.exe
2544	Unicorn-34517.exe
2360	Unicorn-31724.exe
1144	Unicorn-20943.exe
1692	Unicorn-46609.exe
1608	Unicorn-14009.exe
1868	Unicorn-43152.exe
2836	Unicorn-13817.exe
1376	Unicorn-23831.exe
900	Unicorn-29962.exe
2468	Unicorn-25171.exe
1600	Unicorn-36106.exe
1532	Unicorn-45037.exe
2464	Unicorn-45457.exe
1688	Unicorn-2432.exe
2352	Unicorn-15047.exe
2188	Unicorn-34913.exe
1044	Unicorn-44927.exe
2516	Unicorn-51057.exe
1848	Unicorn-19262.exe
2348	Unicorn-63288.exe
2728	Unicorn-33953.exe
2880	Unicorn-3511.exe
2896	Unicorn-18660.exe
2784	Unicorn-48680.exe
2908	Unicorn-1939.exe
2664	Unicorn-50948.exe
2652	Unicorn-50948.exe
2416	Unicorn-28097.exe
1344	Unicorn-26717.exe
756	Unicorn-46053.exe
1628	Unicorn-52183.exe
2648	Unicorn-53060.exe
1156	Unicorn-138.exe
984	Unicorn-46546.exe
2140	Unicorn-18551.exe
2588	Unicorn-18285.exe
2960	Unicorn-18551.exe
2284	Unicorn-12308.exe
1404	Unicorn-40760.exe
2092	Unicorn-40760.exe
536	Unicorn-35048.exe
840	Unicorn-15867.exe
960	Unicorn-2868.exe
1324	Unicorn-17752.exe
1776	Unicorn-63423.exe
1552	Unicorn-11429.exe
1108	Unicorn-27573.exe

Loads dropped DLL 64 IoCs

pid	Process
2200	9112294dd124229e0c34ab0bf4b1af9e6c4013872b289c91f443517b68b50bb4N.exe
2200	9112294dd124229e0c34ab0bf4b1af9e6c4013872b289c91f443517b68b50bb4N.exe
2536	Unicorn-2397.exe
2536	Unicorn-2397.exe
2200	9112294dd124229e0c34ab0bf4b1af9e6c4013872b289c91f443517b68b50bb4N.exe
2200	9112294dd124229e0c34ab0bf4b1af9e6c4013872b289c91f443517b68b50bb4N.exe
2000	Unicorn-20623.exe
2000	Unicorn-20623.exe
2536	Unicorn-2397.exe
2260	Unicorn-33429.exe
2536	Unicorn-2397.exe
2260	Unicorn-33429.exe
2200	9112294dd124229e0c34ab0bf4b1af9e6c4013872b289c91f443517b68b50bb4N.exe
2200	9112294dd124229e0c34ab0bf4b1af9e6c4013872b289c91f443517b68b50bb4N.exe
2424	Unicorn-34689.exe
2424	Unicorn-34689.exe
2000	Unicorn-20623.exe
2000	Unicorn-20623.exe
2868	Unicorn-30967.exe
2536	Unicorn-2397.exe
2868	Unicorn-30967.exe
2872	Unicorn-50833.exe
2872	Unicorn-50833.exe
2536	Unicorn-2397.exe
2200	9112294dd124229e0c34ab0bf4b1af9e6c4013872b289c91f443517b68b50bb4N.exe
2904	Unicorn-28174.exe
2260	Unicorn-33429.exe
2200	9112294dd124229e0c34ab0bf4b1af9e6c4013872b289c91f443517b68b50bb4N.exe
2904	Unicorn-28174.exe
2260	Unicorn-33429.exe
2600	Unicorn-34440.exe
2600	Unicorn-34440.exe
2324	Unicorn-30718.exe
2324	Unicorn-30718.exe
2424	Unicorn-34689.exe
2424	Unicorn-34689.exe
2000	Unicorn-20623.exe
2000	Unicorn-20623.exe
1804	Unicorn-26472.exe
1804	Unicorn-26472.exe
2536	Unicorn-2397.exe
2536	Unicorn-2397.exe
1640	Unicorn-999.exe
1640	Unicorn-999.exe
2868	Unicorn-30967.exe
2868	Unicorn-30967.exe
2576	Unicorn-46095.exe
2576	Unicorn-46095.exe
2260	Unicorn-33429.exe
812	Unicorn-423.exe
2260	Unicorn-33429.exe
812	Unicorn-423.exe
2688	Unicorn-807.exe
2904	Unicorn-28174.exe
2200	9112294dd124229e0c34ab0bf4b1af9e6c4013872b289c91f443517b68b50bb4N.exe
2904	Unicorn-28174.exe
2200	9112294dd124229e0c34ab0bf4b1af9e6c4013872b289c91f443517b68b50bb4N.exe
2688	Unicorn-807.exe
2872	Unicorn-50833.exe
2872	Unicorn-50833.exe
2184	Unicorn-54383.exe
2184	Unicorn-54383.exe
2544	Unicorn-34517.exe
2324	Unicorn-30718.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3776	1776	WerFault.exe	92

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29962.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2868.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61388.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62631.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45396.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59878.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49281.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16782.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1415.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26717.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8421.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31732.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48757.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14525.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17763.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3999.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27446.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5759.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63423.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49135.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19946.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20613.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64589.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16623.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34689.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31732.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53486.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58365.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15150.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58588.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33429.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29810.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61429.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23630.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49991.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12397.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22757.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5759.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55467.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20613.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14009.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15622.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53161.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42670.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9112294dd124229e0c34ab0bf4b1af9e6c4013872b289c91f443517b68b50bb4N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30282.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17763.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26667.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31732.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11281.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20613.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2200	9112294dd124229e0c34ab0bf4b1af9e6c4013872b289c91f443517b68b50bb4N.exe
2536	Unicorn-2397.exe
2000	Unicorn-20623.exe
2260	Unicorn-33429.exe
2424	Unicorn-34689.exe
2868	Unicorn-30967.exe
2872	Unicorn-50833.exe
2904	Unicorn-28174.exe
2600	Unicorn-34440.exe
2324	Unicorn-30718.exe
1804	Unicorn-26472.exe
1640	Unicorn-999.exe
2688	Unicorn-807.exe
812	Unicorn-423.exe
2576	Unicorn-46095.exe
1632	Unicorn-158.exe
2184	Unicorn-54383.exe
2544	Unicorn-34517.exe
2768	Unicorn-5374.exe
2360	Unicorn-31724.exe
1144	Unicorn-20943.exe
1692	Unicorn-46609.exe
1868	Unicorn-43152.exe
1608	Unicorn-14009.exe
2836	Unicorn-13817.exe
1376	Unicorn-23831.exe
1600	Unicorn-36106.exe
900	Unicorn-29962.exe
2468	Unicorn-25171.exe
1532	Unicorn-45037.exe
2464	Unicorn-45457.exe
1688	Unicorn-2432.exe
2188	Unicorn-34913.exe
2352	Unicorn-15047.exe
1044	Unicorn-44927.exe
2516	Unicorn-51057.exe
1848	Unicorn-19262.exe
2348	Unicorn-63288.exe
2728	Unicorn-33953.exe
2880	Unicorn-3511.exe
2896	Unicorn-18660.exe
2784	Unicorn-48680.exe
2652	Unicorn-50948.exe
2664	Unicorn-50948.exe
2908	Unicorn-1939.exe
2416	Unicorn-28097.exe
756	Unicorn-46053.exe
1628	Unicorn-52183.exe
2648	Unicorn-53060.exe
1344	Unicorn-26717.exe
1156	Unicorn-138.exe
984	Unicorn-46546.exe
2960	Unicorn-18551.exe
2588	Unicorn-18285.exe
2284	Unicorn-12308.exe
1404	Unicorn-40760.exe
2092	Unicorn-40760.exe
536	Unicorn-35048.exe
840	Unicorn-15867.exe
960	Unicorn-2868.exe
1552	Unicorn-11429.exe
2196	Unicorn-46790.exe
1324	Unicorn-17752.exe
1108	Unicorn-27573.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2536	2200	9112294dd124229e0c34ab0bf4b1af9e6c4013872b289c91f443517b68b50bb4N.exe	30
PID 2200 wrote to memory of 2536	2200	9112294dd124229e0c34ab0bf4b1af9e6c4013872b289c91f443517b68b50bb4N.exe	30
PID 2200 wrote to memory of 2536	2200	9112294dd124229e0c34ab0bf4b1af9e6c4013872b289c91f443517b68b50bb4N.exe	30
PID 2200 wrote to memory of 2536	2200	9112294dd124229e0c34ab0bf4b1af9e6c4013872b289c91f443517b68b50bb4N.exe	30
PID 2536 wrote to memory of 2000	2536	Unicorn-2397.exe	31
PID 2536 wrote to memory of 2000	2536	Unicorn-2397.exe	31
PID 2536 wrote to memory of 2000	2536	Unicorn-2397.exe	31
PID 2536 wrote to memory of 2000	2536	Unicorn-2397.exe	31
PID 2200 wrote to memory of 2260	2200	9112294dd124229e0c34ab0bf4b1af9e6c4013872b289c91f443517b68b50bb4N.exe	32
PID 2200 wrote to memory of 2260	2200	9112294dd124229e0c34ab0bf4b1af9e6c4013872b289c91f443517b68b50bb4N.exe	32
PID 2200 wrote to memory of 2260	2200	9112294dd124229e0c34ab0bf4b1af9e6c4013872b289c91f443517b68b50bb4N.exe	32
PID 2200 wrote to memory of 2260	2200	9112294dd124229e0c34ab0bf4b1af9e6c4013872b289c91f443517b68b50bb4N.exe	32
PID 2000 wrote to memory of 2424	2000	Unicorn-20623.exe	33
PID 2000 wrote to memory of 2424	2000	Unicorn-20623.exe	33
PID 2000 wrote to memory of 2424	2000	Unicorn-20623.exe	33
PID 2000 wrote to memory of 2424	2000	Unicorn-20623.exe	33
PID 2536 wrote to memory of 2868	2536	Unicorn-2397.exe	34
PID 2536 wrote to memory of 2868	2536	Unicorn-2397.exe	34
PID 2536 wrote to memory of 2868	2536	Unicorn-2397.exe	34
PID 2536 wrote to memory of 2868	2536	Unicorn-2397.exe	34
PID 2260 wrote to memory of 2872	2260	Unicorn-33429.exe	35
PID 2260 wrote to memory of 2872	2260	Unicorn-33429.exe	35
PID 2260 wrote to memory of 2872	2260	Unicorn-33429.exe	35
PID 2260 wrote to memory of 2872	2260	Unicorn-33429.exe	35
PID 2200 wrote to memory of 2904	2200	9112294dd124229e0c34ab0bf4b1af9e6c4013872b289c91f443517b68b50bb4N.exe	36
PID 2200 wrote to memory of 2904	2200	9112294dd124229e0c34ab0bf4b1af9e6c4013872b289c91f443517b68b50bb4N.exe	36
PID 2200 wrote to memory of 2904	2200	9112294dd124229e0c34ab0bf4b1af9e6c4013872b289c91f443517b68b50bb4N.exe	36
PID 2200 wrote to memory of 2904	2200	9112294dd124229e0c34ab0bf4b1af9e6c4013872b289c91f443517b68b50bb4N.exe	36
PID 2424 wrote to memory of 2600	2424	Unicorn-34689.exe	38
PID 2424 wrote to memory of 2600	2424	Unicorn-34689.exe	38
PID 2424 wrote to memory of 2600	2424	Unicorn-34689.exe	38
PID 2424 wrote to memory of 2600	2424	Unicorn-34689.exe	38
PID 2000 wrote to memory of 2324	2000	Unicorn-20623.exe	39
PID 2000 wrote to memory of 2324	2000	Unicorn-20623.exe	39
PID 2000 wrote to memory of 2324	2000	Unicorn-20623.exe	39
PID 2000 wrote to memory of 2324	2000	Unicorn-20623.exe	39
PID 2868 wrote to memory of 1640	2868	Unicorn-30967.exe	40
PID 2868 wrote to memory of 1640	2868	Unicorn-30967.exe	40
PID 2868 wrote to memory of 1640	2868	Unicorn-30967.exe	40
PID 2868 wrote to memory of 1640	2868	Unicorn-30967.exe	40
PID 2872 wrote to memory of 2688	2872	Unicorn-50833.exe	42
PID 2872 wrote to memory of 2688	2872	Unicorn-50833.exe	42
PID 2872 wrote to memory of 2688	2872	Unicorn-50833.exe	42
PID 2872 wrote to memory of 2688	2872	Unicorn-50833.exe	42
PID 2536 wrote to memory of 1804	2536	Unicorn-2397.exe	41
PID 2536 wrote to memory of 1804	2536	Unicorn-2397.exe	41
PID 2536 wrote to memory of 1804	2536	Unicorn-2397.exe	41
PID 2536 wrote to memory of 1804	2536	Unicorn-2397.exe	41
PID 2200 wrote to memory of 1632	2200	9112294dd124229e0c34ab0bf4b1af9e6c4013872b289c91f443517b68b50bb4N.exe	43
PID 2200 wrote to memory of 1632	2200	9112294dd124229e0c34ab0bf4b1af9e6c4013872b289c91f443517b68b50bb4N.exe	43
PID 2200 wrote to memory of 1632	2200	9112294dd124229e0c34ab0bf4b1af9e6c4013872b289c91f443517b68b50bb4N.exe	43
PID 2200 wrote to memory of 1632	2200	9112294dd124229e0c34ab0bf4b1af9e6c4013872b289c91f443517b68b50bb4N.exe	43
PID 2904 wrote to memory of 812	2904	Unicorn-28174.exe	44
PID 2904 wrote to memory of 812	2904	Unicorn-28174.exe	44
PID 2904 wrote to memory of 812	2904	Unicorn-28174.exe	44
PID 2904 wrote to memory of 812	2904	Unicorn-28174.exe	44
PID 2260 wrote to memory of 2576	2260	Unicorn-33429.exe	45
PID 2260 wrote to memory of 2576	2260	Unicorn-33429.exe	45
PID 2260 wrote to memory of 2576	2260	Unicorn-33429.exe	45
PID 2260 wrote to memory of 2576	2260	Unicorn-33429.exe	45
PID 2600 wrote to memory of 2768	2600	Unicorn-34440.exe	46
PID 2600 wrote to memory of 2768	2600	Unicorn-34440.exe	46
PID 2600 wrote to memory of 2768	2600	Unicorn-34440.exe	46
PID 2600 wrote to memory of 2768	2600	Unicorn-34440.exe	46

C:\Users\Admin\AppData\Local\Temp\9112294dd124229e0c34ab0bf4b1af9e6c4013872b289c91f443517b68b50bb4N.exe
"C:\Users\Admin\AppData\Local\Temp\9112294dd124229e0c34ab0bf4b1af9e6c4013872b289c91f443517b68b50bb4N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2397.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2397.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20623.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20623.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34689.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34440.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5374.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19262.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15622.exe
        8⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-733.exe
        9⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31732.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14525.exe
        9⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51418.exe
        8⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61429.exe
        9⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15150.exe
        9⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23629.exe
        9⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60151.exe
        8⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1716.exe
        8⤵
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11948.exe
        8⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19985.exe
        7⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20459.exe
        8⤵
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17997.exe
        8⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55467.exe
        8⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42203.exe
        8⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53161.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1716.exe
        7⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11948.exe
        7⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11429.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-733.exe
        7⤵
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31732.exe
        7⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5759.exe
        7⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7655.exe
        7⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12964.exe
        6⤵
        
        PID:292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37863.exe
        7⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52957.exe
        7⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50628.exe
        7⤵
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45782.exe
        6⤵
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64466.exe
        6⤵
        
        PID:3480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12478.exe
        6⤵
        
        PID:4856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34517.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34913.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2868.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39943.exe
        8⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20891.exe
        8⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14748.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61429.exe
        7⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60402.exe
        7⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20613.exe
        7⤵
        
        PID:1132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63423.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1776
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 220
        7⤵
        Program crash
        
        PID:3776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9627.exe
        6⤵
        
        PID:3156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21015.exe
        6⤵
        
        PID:3896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47828.exe
        6⤵
        
        PID:4788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44927.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2266.exe
        6⤵
        
        PID:608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20459.exe
        7⤵
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17997.exe
        7⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55467.exe
        7⤵
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42203.exe
        7⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63245.exe
        6⤵
        
        PID:2780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61388.exe
        6⤵
        
        PID:3768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3469.exe
        6⤵
        
        PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18145.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14988.exe
        6⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22353.exe
        7⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48765.exe
        7⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8421.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33676.exe
        7⤵
        
        PID:5564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1034.exe
        6⤵
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45396.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65293.exe
        6⤵
        
        PID:4952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63965.exe
        6⤵
        
        PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56987.exe
        5⤵
        
        PID:2592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39783.exe
        6⤵
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20834.exe
        6⤵
        
        PID:4820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14748.exe
        6⤵
        
        PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11182.exe
        5⤵
        
        PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15994.exe
        5⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63392.exe
        5⤵
        
        PID:5728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30718.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54383.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2432.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35048.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36980.exe
        8⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31067.exe
        8⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14748.exe
        8⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22757.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60402.exe
        7⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56493.exe
        7⤵
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15867.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32202.exe
        7⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-853.exe
        8⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59878.exe
        8⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20613.exe
        8⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13084.exe
        7⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61388.exe
        7⤵
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20613.exe
        7⤵
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43451.exe
        6⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28544.exe
        7⤵
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36383.exe
        6⤵
        
        PID:3192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15464.exe
        6⤵
        
        PID:4200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24720.exe
        6⤵
        
        PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15047.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17752.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16422.exe
        7⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47653.exe
        7⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
        7⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64589.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61388.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40157.exe
        6⤵
        
        PID:5000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46790.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35638.exe
        6⤵
        
        PID:348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47653.exe
        6⤵
        
        PID:3380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
        6⤵
        
        PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16623.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58588.exe
        5⤵
        
        PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60950.exe
        5⤵
        
        PID:5072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31724.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33953.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50891.exe
        6⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63186.exe
        7⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20891.exe
        7⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45003.exe
        7⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61429.exe
        6⤵
        
        PID:3136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15150.exe
        6⤵
        
        PID:3444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20613.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47170.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29810.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17997.exe
        6⤵
        
        PID:4076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55467.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42203.exe
        6⤵
        
        PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44806.exe
        5⤵
        
        PID:1768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37598.exe
        5⤵
        
        PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62631.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24720.exe
        5⤵
        
        PID:5632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3511.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15622.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33225.exe
        6⤵
        
        PID:2132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47653.exe
        6⤵
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14748.exe
        6⤵
        
        PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22757.exe
        5⤵
        
        PID:2096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15150.exe
        5⤵
        
        PID:3684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23629.exe
        5⤵
        
        PID:5204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64553.exe
      4⤵
      PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18316.exe
        5⤵
        
        PID:1932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1415.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
        5⤵
        
        PID:5312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17157.exe
      4⤵
      PID:2088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26337.exe
      4⤵
      PID:3588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59499.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30967.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30967.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-999.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14009.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18551.exe
        6⤵
        Executes dropped EXE
        
        PID:2140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19985.exe
        6⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52996.exe
        7⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49424.exe
        7⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18264.exe
        7⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23629.exe
        7⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62403.exe
        6⤵
        
        PID:1160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37598.exe
        6⤵
        
        PID:3848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62631.exe
        6⤵
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60950.exe
        6⤵
        
        PID:1304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40760.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31273.exe
        6⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15758.exe
        7⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53486.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
        7⤵
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49787.exe
        6⤵
        
        PID:3412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44803.exe
        6⤵
        
        PID:4720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23629.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4054.exe
        5⤵
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56678.exe
        6⤵
        
        PID:4412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7282.exe
        6⤵
        
        PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27717.exe
        5⤵
        
        PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64466.exe
        5⤵
        
        PID:5084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12478.exe
        5⤵
        
        PID:4456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43152.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20945.exe
        5⤵
        
        PID:2736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53515.exe
        6⤵
        
        PID:2316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17997.exe
        6⤵
        
        PID:3116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55467.exe
        6⤵
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42203.exe
        6⤵
        
        PID:5684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13752.exe
        5⤵
        
        PID:2068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24142.exe
        5⤵
        
        PID:3360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30266.exe
        5⤵
        
        PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42733.exe
        5⤵
        
        PID:5708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46546.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30282.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49945.exe
        6⤵
        
        PID:2864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47653.exe
        6⤵
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
        6⤵
        
        PID:5344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32191.exe
        5⤵
        
        PID:1596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15150.exe
        5⤵
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23629.exe
        5⤵
        
        PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30017.exe
      4⤵
      PID:1300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51758.exe
        5⤵
        
        PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-245.exe
        5⤵
        
        PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12397.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63161.exe
      4⤵
      PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56484.exe
      4⤵
      PID:4464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26472.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26472.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20943.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52920.exe
        6⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15758.exe
        7⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55406.exe
        7⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14748.exe
        7⤵
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61429.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60402.exe
        6⤵
        
        PID:3552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20613.exe
        6⤵
        
        PID:920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47938.exe
        5⤵
        
        PID:1788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15758.exe
        6⤵
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1415.exe
        6⤵
        
        PID:3476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14748.exe
        6⤵
        
        PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9627.exe
        5⤵
        
        PID:3180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19946.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11948.exe
        5⤵
        
        PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63288.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37598.exe
        5⤵
        
        PID:4032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58666.exe
      4⤵
      PID:2172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1508.exe
        5⤵
        
        PID:4580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52252.exe
      4⤵
      PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48757.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3190.exe
      4⤵
      PID:5736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46609.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46609.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19985.exe
      4⤵
      PID:2616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18534.exe
        5⤵
        
        PID:1972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47653.exe
        5⤵
        
        PID:3392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14748.exe
        5⤵
        
        PID:4500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13254.exe
      4⤵
      PID:2336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18052.exe
      4⤵
      PID:3912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14963.exe
      4⤵
      PID:4968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12308.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12308.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33852.exe
      4⤵
      PID:2388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63157.exe
        5⤵
        
        PID:3284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14081.exe
        5⤵
        
        PID:4144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23629.exe
        5⤵
        
        PID:5180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29088.exe
      4⤵
      PID:2528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15150.exe
      4⤵
      PID:4112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23629.exe
      4⤵
      PID:5164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10158.exe
      4⤵
      PID:5852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4816.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4816.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52057.exe
      4⤵
      PID:2220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1415.exe
      4⤵
      PID:3724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
      4⤵
      PID:5336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34223.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34223.exe
    3⤵
    PID:636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56886.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56886.exe
    3⤵
    PID:4152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51149.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51149.exe
    3⤵
    PID:4476
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33429.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33429.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50833.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50833.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-807.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45037.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18660.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20900.exe
        7⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31660.exe
        7⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18264.exe
        7⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20613.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49275.exe
        6⤵
        
        PID:1644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63159.exe
        6⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24130.exe
        6⤵
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7655.exe
        6⤵
        
        PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48680.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30282.exe
        6⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42623.exe
        7⤵
        
        PID:796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1415.exe
        7⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14748.exe
        7⤵
        
        PID:4308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46001.exe
        6⤵
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15150.exe
        6⤵
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23629.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24151.exe
        5⤵
        
        PID:1700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42623.exe
        6⤵
        
        PID:2740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-346.exe
        6⤵
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14748.exe
        6⤵
        
        PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42358.exe
        5⤵
        
        PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11281.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60950.exe
        5⤵
        
        PID:4296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45457.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1939.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49498.exe
        6⤵
        
        PID:1824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39476.exe
        7⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31067.exe
        7⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
        7⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31732.exe
        6⤵
        
        PID:4088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5759.exe
        6⤵
        
        PID:4664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11948.exe
        6⤵
        
        PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12720.exe
        5⤵
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38440.exe
        6⤵
        
        PID:2496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17997.exe
        6⤵
        
        PID:3196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65431.exe
        6⤵
        
        PID:4708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20613.exe
        6⤵
        
        PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63145.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58588.exe
        5⤵
        
        PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60950.exe
        5⤵
        
        PID:4284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28097.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53.exe
        5⤵
        
        PID:664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42623.exe
        6⤵
        
        PID:2252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1415.exe
        6⤵
        
        PID:3580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
        6⤵
        
        PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61429.exe
        5⤵
        
        PID:3144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60402.exe
        5⤵
        
        PID:3548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23629.exe
        5⤵
        
        PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31008.exe
      4⤵
      PID:1036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18754.exe
        5⤵
        
        PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39269.exe
        5⤵
        
        PID:5532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23630.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61352.exe
      4⤵
      PID:3448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15493.exe
      4⤵
      PID:4324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46095.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46095.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13817.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52183.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30282.exe
        6⤵
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45748.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3769.exe
        7⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31732.exe
        6⤵
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5759.exe
        6⤵
        
        PID:4656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11948.exe
        6⤵
        
        PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10416.exe
        5⤵
        
        PID:2476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54821.exe
        6⤵
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4529.exe
        6⤵
        
        PID:4224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37598.exe
        5⤵
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62631.exe
        5⤵
        
        PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60950.exe
        5⤵
        
        PID:952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-138.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17880.exe
        5⤵
        
        PID:2244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17997.exe
        5⤵
        
        PID:4056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31060.exe
        5⤵
        
        PID:4784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63446.exe
      4⤵
      PID:2164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58588.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3999.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23831.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23831.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53060.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30282.exe
        5⤵
        
        PID:1040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4039.exe
        6⤵
        
        PID:1648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61388.exe
        6⤵
        
        PID:3728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20613.exe
        6⤵
        
        PID:1744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49135.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31732.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14525.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10416.exe
      4⤵
      PID:1568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42623.exe
        5⤵
        
        PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-346.exe
        5⤵
        
        PID:4192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
        5⤵
        
        PID:5352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9627.exe
      4⤵
      PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21015.exe
      4⤵
      PID:3692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14963.exe
      4⤵
      PID:1380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18285.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18285.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34620.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15758.exe
        5⤵
        
        PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46667.exe
        5⤵
        
        PID:3512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
        5⤵
        
        PID:5328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61429.exe
      4⤵
      PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15150.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20613.exe
      4⤵
      PID:4336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9161.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9161.exe
    3⤵
    PID:1988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49281.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-346.exe
      4⤵
      PID:4212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
      4⤵
      PID:5360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26667.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26667.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15994.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15994.exe
    3⤵
    PID:4248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42670.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42670.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5468
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28174.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28174.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-423.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-423.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29962.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18551.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33852.exe
        6⤵
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26323.exe
        7⤵
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32267.exe
        6⤵
        
        PID:3944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18264.exe
        6⤵
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20613.exe
        6⤵
        
        PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10416.exe
        5⤵
        
        PID:836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37863.exe
        6⤵
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51696.exe
        6⤵
        
        PID:4684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14748.exe
        6⤵
        
        PID:4576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37598.exe
        5⤵
        
        PID:4040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62631.exe
        5⤵
        
        PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60950.exe
        5⤵
        
        PID:4704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40760.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31273.exe
        5⤵
        
        PID:264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52996.exe
        6⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32758.exe
        7⤵
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40435.exe
        7⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7655.exe
        7⤵
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64205.exe
        6⤵
        
        PID:1076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61388.exe
        6⤵
        
        PID:3752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20613.exe
        6⤵
        
        PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49244.exe
        5⤵
        
        PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31732.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5759.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11948.exe
        5⤵
        
        PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27446.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33225.exe
        5⤵
        
        PID:2140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59878.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23629.exe
        5⤵
        
        PID:5212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42358.exe
      4⤵
      PID:2640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13921.exe
      4⤵
      PID:4368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48005.exe
      4⤵
      PID:4844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25171.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25171.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50948.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49638.exe
        5⤵
        
        PID:2724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33718.exe
        6⤵
        
        PID:1564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47653.exe
        6⤵
        
        PID:3384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62477.exe
        5⤵
        
        PID:1764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61388.exe
        5⤵
        
        PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20613.exe
        5⤵
        
        PID:1800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45917.exe
      4⤵
      PID:2308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51526.exe
        5⤵
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2556.exe
        5⤵
        
        PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20613.exe
        5⤵
        
        PID:5032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49682.exe
      4⤵
      PID:3520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50668.exe
      4⤵
      PID:4728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11948.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46053.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46053.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34620.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54698.exe
        5⤵
        
        PID:5820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32267.exe
      4⤵
      PID:3936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8421.exe
      4⤵
      PID:4880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14963.exe
      4⤵
      PID:4780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33587.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33587.exe
    3⤵
    PID:2432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54506.exe
      4⤵
      PID:5800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43203.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43203.exe
    3⤵
    PID:3952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64466.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64466.exe
    3⤵
    PID:5036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12478.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12478.exe
    3⤵
    PID:4868
- C:\Users\Admin\AppData\Local\Temp\Unicorn-158.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-158.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27573.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27573.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15758.exe
      4⤵
      PID:3224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1415.exe
      4⤵
      PID:4120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14748.exe
      4⤵
      PID:4508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15492.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15492.exe
    3⤵
    PID:3172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12350.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12350.exe
    3⤵
    PID:3704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24720.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24720.exe
    3⤵
    PID:5692
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36106.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36106.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50948.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50948.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32669.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43768.exe
        5⤵
        
        PID:5256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31732.exe
      4⤵
      PID:3340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5759.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52471.exe
      4⤵
      PID:5428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49991.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49991.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44859.exe
      4⤵
      PID:4896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30517.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30517.exe
    3⤵
    PID:3312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65293.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65293.exe
    3⤵
    PID:4944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24720.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24720.exe
    3⤵
    PID:5700
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26717.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26717.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4319.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4319.exe
    3⤵
    PID:2820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20421.exe
      4⤵
      PID:3884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55467.exe
      4⤵
      PID:4364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42203.exe
      4⤵
      PID:5648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16782.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16782.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18264.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18264.exe
    3⤵
    PID:4188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20613.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20613.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4340
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4829.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4829.exe
  2⤵
  PID:1448
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24781.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24781.exe
  2⤵
  PID:3408
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54665.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54665.exe
  2⤵
  PID:4180
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58365.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58365.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-26472.exe

Filesize
468KB

MD5
dc549e3ce456d1641e34dbc7a6f75edb

SHA1
5abe17fa419c3b360a8dc04dfe48f2b2f444099d

SHA256
e4781500e3b2e4d8dc58ddcad52afc70d99ac6d13b6c42d8b5a740d6ab40d0b2

SHA512
0f1184a608cc64e2565721e2dc0f322b7cace37b5253deb85ab08e9acdc7e92498b684a56d6922d80d71b22c6f606f2eff5244ec32d3478d680dd092b06de8d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34440.exe

Filesize
468KB

MD5
f8f52ec408f7ae8414afc2fc41b01f0e

SHA1
c08e903255114ba86eb1e50c680127760c509f3f

SHA256
3d44d6e14740b662eea082bc032890fa4d76c82b55f9a62f30bddfbaa2f7a443

SHA512
136943d95280cdf0122d8e3f0389e4b21a65ad1d5ad580cd0218429e18dd0d3c32b4bc594adc14905ab33308acfdf8f721da51cd77849e6d3cd9e18232f216e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34517.exe

Filesize
468KB

MD5
6d13e1b5abcea971d1b995abe060e7ca

SHA1
673710a98ba2e53f01e3355869c26e06d55cb15e

SHA256
c6227e0a8cb2f04e770a15f6acc42c6b239262f95ee85ea2a6f7b5dcd3e5bcf2

SHA512
746883406d61e54d42d26b765154cd341b6cbd63a95535ff7896ce140edc9983045e04c5ac509a57027dfae3a20203a7940304e827cb0d596d411f0f5a5ef02a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34689.exe

Filesize
468KB

MD5
777900e518a50ae3de895f852429125c

SHA1
7b8a3b0a92b7434a579f3e1c678053fb68de5bd1

SHA256
ae9d280c7d44fed5c933f1b2b8a7f94fed189e74c2338dd24f8911827f0b51a6

SHA512
621249581deda9379478255d1da6d953cb80110b5e77d635a5394af1ace4142e3f3ac7a6340c39c5de69f73f37e8bdae4379892b698d987af3817e76fa790742

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37916.exe

Filesize
468KB

MD5
652a38343d4977e0cbb38603aac2805f

SHA1
07ec4c6a95f2729c4b8dbdf74678852ecb5982f2

SHA256
805c3e1a07f7d2001d804f8f2ce0c39162c33cb8ba69141aa3197941dfecb519

SHA512
33144992a702cefec1b42d3a4ada4f006e6096a07c3cbc2fce4c29a8a8d9e9e7d9f7e752500f409a2e550e4408816aa06836ab985962b5d84a2de10ab265abe3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46095.exe

Filesize
468KB

MD5
a9add18f5082a1c5c480ca67610c1a33

SHA1
2e6bdaa225c254f1c93c1dd56845a1b00f193cce

SHA256
4bc1a818b49f2c37c6313480d1aa3260a4484d0730d7a5197ac20e5626e9a4ed

SHA512
ff9c45ba433a84c6493c1b7e48b5f83ebbde082333ce186dee579065d575a921ddaa821a640e998e6c72a50f0ad8747df71f9881233df594cfd7271a9edb8390

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-158.exe

Filesize
468KB

MD5
c189528a7e635970f40f0d113f46b1fd

SHA1
43f979e6124590ab3ab7aa9a89de26708de4c09f

SHA256
f434187682d9e528cbd0f8a2f3706f2809baadabff9d47f3c9b869f18b554cfc

SHA512
eb4e976ceeb9a96b3e410c18a4afcd526adab5f07accd71eb4c161ce579e55b1a66d8f9eb8759d8dc00872f1e6b9d5cbb35f8617e06e8046a73a3e888ebccd37

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20623.exe

Filesize
468KB

MD5
d0b7ae90ad713cdd9b9cd747aab751af

SHA1
0b4b2b809fce6d397a239107f173c3f31fa8f679

SHA256
e1b459313801e64b24a365202ad7b042026066b2c7ce05c1b68115a7d8485cdf

SHA512
84e6189378af610141f88b68924b8ff30e58a21deaa7f90a42504f3ce989a13fa63bbba4ad6e5e0cecc9223c82c6432203aac02077cdc306659c0378ccb63b04

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-2397.exe

Filesize
468KB

MD5
48737672e6d9433dfa3fa8545b53f964

SHA1
4bdb652aea60a5e43ae5e888910afc9b4f34fcf2

SHA256
c3ece9797604a9c32286a38acba99f1c93cd787b4d56e4c74f79fa7cd2825c52

SHA512
c9802a3afd0fde1981c91f52adc898c4b1b177f924490f583041dd9869318babcf5813bb6d5eddb70a051d302a78faae5e10f159fee14e6312eddf16ce737be2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28174.exe

Filesize
468KB

MD5
a59fdd30860e9be6526fe34ab8820af9

SHA1
a68ac73b99146344e3ffd38afb08092e657d02d9

SHA256
81e038063dd37a7bd30e3aae02e52db847cbf0ad7ffe74c426c27be492c52043

SHA512
6dc2cb171b219dd4c1c76475078f8a9e613881cb1d561fecc174894d6a0ec6356c44f6aef639aaf26a0de4ec42d4e0464cc3b1481c1833c5ac508badb5b782da

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-30718.exe

Filesize
468KB

MD5
f3fb81a0f80d1c5bb9ab6887f68533b1

SHA1
d565208162c817c29f5b8a5f54459c9ba28cbf86

SHA256
251e063a547562185620f818b6fb9d284f751c4e16ba22dec4af61fe55efcf23

SHA512
f3364ed973253d14e19dae3344a603a03134d6e5c9163bbe4e1497a302fec655a434cd4314ff28bb871593f35bc41538a6ded90a99ce929922277cdbbab7a4b0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-30967.exe

Filesize
468KB

MD5
e6903581e53dce7299aae4ac04354ba9

SHA1
2157fbb5ceacde4e11eac92fbb8b8aa2a582d52f

SHA256
942f8eed2473734a197a1978892e50046bdaa83168393c658fa77c17ca41e28a

SHA512
bf90426fdd97d3155e863e2d120e69cb1ae3367fc792e5997e399535a0188688b7830d1999045b2097432fbc5b876a273ec184f99c8c7ddf50005c6585273978

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31724.exe

Filesize
468KB

MD5
595abc9f9840e090bfd6644b67460be0

SHA1
5a58c068c7814fe161557d82c34724cc7d2ff313

SHA256
6432a3c993b4f2b83e70f8d01193dbe91cf612f9e4bd6f9e943e8dd5fa7bf6b0

SHA512
919d38406e348145edb5d3b39c4807db2aa2cc1223aefbc2c0a6e8707e55f5dc19c10c5ca6f36bf11bd614fdea31472348e872c8e34e9516c136732ab2973ad1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33429.exe

Filesize
468KB

MD5
552286e1dc3ab21e8a682f0f5596e7bb

SHA1
a23de8cf13ea603af6b908b9980d6e53ce94f700

SHA256
4d70d939ffe250975a924b9e2efbe8b97d7b85fc1b435443354900bbb5d078fc

SHA512
5c02a6564b061d5241de72ef48a5b3454660b10f9858565da098be5a109ee59b3cb55a0d9f6b846ba9dc37360ae93414e7c4558ff28201259a20c37be7929ca0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-423.exe

Filesize
468KB

MD5
e27c7eeb30a41561ac3aef8aafaa07d0

SHA1
fe74a5d8d0c46478b2847dab6f6f509a1ba83d0e

SHA256
dc4f6d241f775ebc980f9b22ea8cdb66c0fd2f8898788495a4bda922f5b6c8ab

SHA512
33b829c71802cbd860995f606e2c55d195c3eb17324d42a1b0043d59a183c2148b9fea339944d3dc6500bd4ec98a63a07a6d4378cde59c097dee8f5166fe40f0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-50833.exe

Filesize
468KB

MD5
ffca89b914507ae5bb15569d327a2e5f

SHA1
78a99436038f7b07d0005974fba3b3dbd97f69a4

SHA256
ee3fb2b47ad5c59e5221f21ff55aa2e19b7f293398c8c30ac5d34aa0ee6f6b18

SHA512
fc7e97bcb66196be97a3212ed5b5fa97b4785ae88ad41bc588f4ba9559c15666c0ba78924fc1eaef41541af182a941a50ae96578eaa662a9dd37fc6421e75fca

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-5374.exe

Filesize
468KB

MD5
60951fae2c4caa4034434691836fe57d

SHA1
49e3dd3011e0e27db588060b86267a90ef9198f3

SHA256
111983a4fc68aa6035ed05363801102f1a829e89026ed11949c05f05ab3e5f3d

SHA512
c6633e3c5692f472259fdfbac3a8c404e9577dcd5a7457bb4225ded4972fbe503c42176ceff6033252633ea5860593b722a2d32ff7d0fbd3bad82799c05eb601

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54383.exe

Filesize
468KB

MD5
71b31d98675585a7c6ca7762a5dbb9f7

SHA1
f7d1775e0ee6ac0ebe6ec43396468d7397370916

SHA256
fdfb9799e9121219353ca7bc7abc11324c46854b3055d932a137209333dcf89c

SHA512
bd82397a6d3eb5be88f87373c46b067d52bf60cc67e3555ce24cf59330155e0c9ed0d49d70f765bb11592d1dda1c1bcf1b125467f10eb70a07a786013ddfa1c3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-807.exe

Filesize
468KB

MD5
193202f88c64ccde2c6a46d35cfb5ffb

SHA1
30652c9c7a87502ff0f583fb8d39dbb247768b9d

SHA256
8aafa4238f947cbf0d4bc63ed262251689f39f24ee4113bc7d4d2baa19a31154

SHA512
2251a86c1665647a357b6732e4fea114af80585b1f6ec0dc10f147fdb3c63189a40d5d3403bfa5d06d776748147159087d61f2c3073f9eab5423124cf96f0cbc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-999.exe

Filesize
468KB

MD5
dea6303a931fc228e82f879666822ccc

SHA1
f0db39be8f19bb115faa40b99388923a10bcdd5f

SHA256
4b8d930accc23509683c4849edd7702b011167b86a34f12b89885cba18467fff

SHA512
9464e7afb786cae00052343031a267a2da828ad2e751c055a4ff1fd9ebf34ef994b6dcc05ee086538563f9912244a09fa007afa9e7f3231a97b635b5fc15d346

Download Submit