5cf516c5f28baa62d381e9a351e29ce4232e4151a7ffda0241b8e55700aadbfa

Analysis

max time kernel
150s
max time network
126s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 23:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5cf516c5f28baa62d381e9a351e29ce4232e4151a7ffda0241b8e55700aadbfa.exe
Size

468KB
MD5

e1d9e640a3bcc5eb5ffce0593626b24c
SHA1

b21d1305e111fd571dd8aaa713f61f9090b0af71
SHA256

5cf516c5f28baa62d381e9a351e29ce4232e4151a7ffda0241b8e55700aadbfa
SHA512

4d634f1bfb61f790fed0aad17084a338428e0d9b969ea3f9f6cce0837c5df09f77410f3455fa2bfc0689c08b595246bb24856f83ef980f2f23aad58fd4ec5a03
SSDEEP

3072:4JNio3ldI03YtbYHPzejNfT/rYh7TIpqD3HCNVbUwhLLMjtaSMlH:4J4oMOYtgPqjNfQ0PgwhPStaS

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2792	Unicorn-51913.exe
2784	Unicorn-45966.exe
2688	Unicorn-38928.exe
2676	Unicorn-44643.exe
2716	Unicorn-32945.exe
1700	Unicorn-22085.exe
1804	Unicorn-26068.exe
1800	Unicorn-1062.exe
1844	Unicorn-35550.exe
1716	Unicorn-5950.exe
2396	Unicorn-55416.exe
2216	Unicorn-63584.exe
2960	Unicorn-23106.exe
2764	Unicorn-42972.exe
2452	Unicorn-36842.exe
2160	Unicorn-30310.exe
1152	Unicorn-20972.exe
2240	Unicorn-64928.exe
1652	Unicorn-45696.exe
1848	Unicorn-45961.exe
2552	Unicorn-45961.exe
2560	Unicorn-64527.exe
564	Unicorn-5120.exe
1088	Unicorn-50792.exe
1552	Unicorn-13651.exe
296	Unicorn-60159.exe
1724	Unicorn-29433.exe
2992	Unicorn-36838.exe
1704	Unicorn-25349.exe
304	Unicorn-5483.exe
1564	Unicorn-14227.exe
1828	Unicorn-28255.exe
1292	Unicorn-25301.exe
2952	Unicorn-2572.exe
2920	Unicorn-28253.exe
2776	Unicorn-53719.exe
2104	Unicorn-35607.exe
2836	Unicorn-55473.exe
2864	Unicorn-35145.exe
2708	Unicorn-41275.exe
2476	Unicorn-34075.exe
2408	Unicorn-26392.exe
1856	Unicorn-57673.exe
868	Unicorn-38644.exe
2472	Unicorn-32614.exe
2196	Unicorn-32349.exe
2356	Unicorn-26200.exe
2352	Unicorn-22670.exe
2980	Unicorn-59064.exe
2344	Unicorn-62883.exe
2220	Unicorn-63148.exe
944	Unicorn-17809.exe
3048	Unicorn-6874.exe
2372	Unicorn-47352.exe
2128	Unicorn-38992.exe
1720	Unicorn-21648.exe
1624	Unicorn-35384.exe
976	Unicorn-18956.exe
912	Unicorn-18956.exe
3012	Unicorn-62681.exe
2596	Unicorn-62489.exe
1736	Unicorn-10687.exe
1120	Unicorn-55281.exe
2020	Unicorn-59365.exe

Loads dropped DLL 64 IoCs

pid	Process
2904	5cf516c5f28baa62d381e9a351e29ce4232e4151a7ffda0241b8e55700aadbfa.exe
2904	5cf516c5f28baa62d381e9a351e29ce4232e4151a7ffda0241b8e55700aadbfa.exe
2792	Unicorn-51913.exe
2792	Unicorn-51913.exe
2904	5cf516c5f28baa62d381e9a351e29ce4232e4151a7ffda0241b8e55700aadbfa.exe
2904	5cf516c5f28baa62d381e9a351e29ce4232e4151a7ffda0241b8e55700aadbfa.exe
2784	Unicorn-45966.exe
2784	Unicorn-45966.exe
2792	Unicorn-51913.exe
2688	Unicorn-38928.exe
2688	Unicorn-38928.exe
2792	Unicorn-51913.exe
2904	5cf516c5f28baa62d381e9a351e29ce4232e4151a7ffda0241b8e55700aadbfa.exe
2904	5cf516c5f28baa62d381e9a351e29ce4232e4151a7ffda0241b8e55700aadbfa.exe
2676	Unicorn-44643.exe
2676	Unicorn-44643.exe
2784	Unicorn-45966.exe
2784	Unicorn-45966.exe
2904	5cf516c5f28baa62d381e9a351e29ce4232e4151a7ffda0241b8e55700aadbfa.exe
2904	5cf516c5f28baa62d381e9a351e29ce4232e4151a7ffda0241b8e55700aadbfa.exe
1804	Unicorn-26068.exe
1700	Unicorn-22085.exe
1700	Unicorn-22085.exe
1804	Unicorn-26068.exe
2688	Unicorn-38928.exe
2716	Unicorn-32945.exe
2792	Unicorn-51913.exe
2688	Unicorn-38928.exe
2716	Unicorn-32945.exe
2792	Unicorn-51913.exe
1844	Unicorn-35550.exe
1844	Unicorn-35550.exe
2784	Unicorn-45966.exe
2784	Unicorn-45966.exe
2452	Unicorn-36842.exe
2452	Unicorn-36842.exe
2792	Unicorn-51913.exe
2792	Unicorn-51913.exe
2960	Unicorn-23106.exe
1800	Unicorn-1062.exe
2960	Unicorn-23106.exe
1800	Unicorn-1062.exe
2688	Unicorn-38928.exe
2688	Unicorn-38928.exe
2396	Unicorn-55416.exe
2676	Unicorn-44643.exe
2396	Unicorn-55416.exe
2676	Unicorn-44643.exe
1804	Unicorn-26068.exe
1716	Unicorn-5950.exe
1804	Unicorn-26068.exe
1716	Unicorn-5950.exe
2216	Unicorn-63584.exe
2216	Unicorn-63584.exe
2904	5cf516c5f28baa62d381e9a351e29ce4232e4151a7ffda0241b8e55700aadbfa.exe
2904	5cf516c5f28baa62d381e9a351e29ce4232e4151a7ffda0241b8e55700aadbfa.exe
2764	Unicorn-42972.exe
2764	Unicorn-42972.exe
1700	Unicorn-22085.exe
1700	Unicorn-22085.exe
2716	Unicorn-32945.exe
2716	Unicorn-32945.exe
2160	Unicorn-30310.exe
2160	Unicorn-30310.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43061.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28255.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29939.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29939.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17261.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36838.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22176.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43688.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29815.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38928.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20972.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50041.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4798.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45958.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64577.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5641.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14907.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28623.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36842.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60159.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19113.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42574.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33467.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12105.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58685.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59365.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9592.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29867.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16282.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2234.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54191.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57625.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39649.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37653.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2455.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4490.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22157.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54551.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59228.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35956.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45961.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21273.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61378.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11241.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56156.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26622.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26112.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22029.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29939.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49612.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37979.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48045.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2679.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44058.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44058.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2904	5cf516c5f28baa62d381e9a351e29ce4232e4151a7ffda0241b8e55700aadbfa.exe
2792	Unicorn-51913.exe
2784	Unicorn-45966.exe
2688	Unicorn-38928.exe
2676	Unicorn-44643.exe
1804	Unicorn-26068.exe
1700	Unicorn-22085.exe
2716	Unicorn-32945.exe
1800	Unicorn-1062.exe
1844	Unicorn-35550.exe
2452	Unicorn-36842.exe
2960	Unicorn-23106.exe
2216	Unicorn-63584.exe
2396	Unicorn-55416.exe
1716	Unicorn-5950.exe
2764	Unicorn-42972.exe
2160	Unicorn-30310.exe
1152	Unicorn-20972.exe
1848	Unicorn-45961.exe
2240	Unicorn-64928.exe
2552	Unicorn-45961.exe
1652	Unicorn-45696.exe
564	Unicorn-5120.exe
2560	Unicorn-64527.exe
1088	Unicorn-50792.exe
1552	Unicorn-13651.exe
1724	Unicorn-29433.exe
296	Unicorn-60159.exe
2992	Unicorn-36838.exe
1704	Unicorn-25349.exe
304	Unicorn-5483.exe
1564	Unicorn-14227.exe
1828	Unicorn-28255.exe
1292	Unicorn-25301.exe
2952	Unicorn-2572.exe
2776	Unicorn-53719.exe
2708	Unicorn-41275.exe
2864	Unicorn-35145.exe
2104	Unicorn-35607.exe
2920	Unicorn-28253.exe
2476	Unicorn-34075.exe
2408	Unicorn-26392.exe
2836	Unicorn-55473.exe
1856	Unicorn-57673.exe
868	Unicorn-38644.exe
2196	Unicorn-32349.exe
2352	Unicorn-22670.exe
2472	Unicorn-32614.exe
2356	Unicorn-26200.exe
2344	Unicorn-62883.exe
2220	Unicorn-63148.exe
2980	Unicorn-59064.exe
944	Unicorn-17809.exe
3048	Unicorn-6874.exe
2372	Unicorn-47352.exe
2128	Unicorn-38992.exe
1720	Unicorn-21648.exe
976	Unicorn-18956.exe
1624	Unicorn-35384.exe
3012	Unicorn-62681.exe
912	Unicorn-18956.exe
2596	Unicorn-62489.exe
1736	Unicorn-10687.exe
1120	Unicorn-55281.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2792	2904	5cf516c5f28baa62d381e9a351e29ce4232e4151a7ffda0241b8e55700aadbfa.exe	30
PID 2904 wrote to memory of 2792	2904	5cf516c5f28baa62d381e9a351e29ce4232e4151a7ffda0241b8e55700aadbfa.exe	30
PID 2904 wrote to memory of 2792	2904	5cf516c5f28baa62d381e9a351e29ce4232e4151a7ffda0241b8e55700aadbfa.exe	30
PID 2904 wrote to memory of 2792	2904	5cf516c5f28baa62d381e9a351e29ce4232e4151a7ffda0241b8e55700aadbfa.exe	30
PID 2792 wrote to memory of 2784	2792	Unicorn-51913.exe	31
PID 2792 wrote to memory of 2784	2792	Unicorn-51913.exe	31
PID 2792 wrote to memory of 2784	2792	Unicorn-51913.exe	31
PID 2792 wrote to memory of 2784	2792	Unicorn-51913.exe	31
PID 2904 wrote to memory of 2688	2904	5cf516c5f28baa62d381e9a351e29ce4232e4151a7ffda0241b8e55700aadbfa.exe	32
PID 2904 wrote to memory of 2688	2904	5cf516c5f28baa62d381e9a351e29ce4232e4151a7ffda0241b8e55700aadbfa.exe	32
PID 2904 wrote to memory of 2688	2904	5cf516c5f28baa62d381e9a351e29ce4232e4151a7ffda0241b8e55700aadbfa.exe	32
PID 2904 wrote to memory of 2688	2904	5cf516c5f28baa62d381e9a351e29ce4232e4151a7ffda0241b8e55700aadbfa.exe	32
PID 2784 wrote to memory of 2676	2784	Unicorn-45966.exe	33
PID 2784 wrote to memory of 2676	2784	Unicorn-45966.exe	33
PID 2784 wrote to memory of 2676	2784	Unicorn-45966.exe	33
PID 2784 wrote to memory of 2676	2784	Unicorn-45966.exe	33
PID 2688 wrote to memory of 1700	2688	Unicorn-38928.exe	35
PID 2688 wrote to memory of 1700	2688	Unicorn-38928.exe	35
PID 2688 wrote to memory of 1700	2688	Unicorn-38928.exe	35
PID 2688 wrote to memory of 1700	2688	Unicorn-38928.exe	35
PID 2792 wrote to memory of 2716	2792	Unicorn-51913.exe	34
PID 2792 wrote to memory of 2716	2792	Unicorn-51913.exe	34
PID 2792 wrote to memory of 2716	2792	Unicorn-51913.exe	34
PID 2792 wrote to memory of 2716	2792	Unicorn-51913.exe	34
PID 2904 wrote to memory of 1804	2904	5cf516c5f28baa62d381e9a351e29ce4232e4151a7ffda0241b8e55700aadbfa.exe	36
PID 2904 wrote to memory of 1804	2904	5cf516c5f28baa62d381e9a351e29ce4232e4151a7ffda0241b8e55700aadbfa.exe	36
PID 2904 wrote to memory of 1804	2904	5cf516c5f28baa62d381e9a351e29ce4232e4151a7ffda0241b8e55700aadbfa.exe	36
PID 2904 wrote to memory of 1804	2904	5cf516c5f28baa62d381e9a351e29ce4232e4151a7ffda0241b8e55700aadbfa.exe	36
PID 2676 wrote to memory of 1800	2676	Unicorn-44643.exe	37
PID 2676 wrote to memory of 1800	2676	Unicorn-44643.exe	37
PID 2676 wrote to memory of 1800	2676	Unicorn-44643.exe	37
PID 2676 wrote to memory of 1800	2676	Unicorn-44643.exe	37
PID 2784 wrote to memory of 1844	2784	Unicorn-45966.exe	38
PID 2784 wrote to memory of 1844	2784	Unicorn-45966.exe	38
PID 2784 wrote to memory of 1844	2784	Unicorn-45966.exe	38
PID 2784 wrote to memory of 1844	2784	Unicorn-45966.exe	38
PID 2904 wrote to memory of 1716	2904	5cf516c5f28baa62d381e9a351e29ce4232e4151a7ffda0241b8e55700aadbfa.exe	39
PID 2904 wrote to memory of 1716	2904	5cf516c5f28baa62d381e9a351e29ce4232e4151a7ffda0241b8e55700aadbfa.exe	39
PID 2904 wrote to memory of 1716	2904	5cf516c5f28baa62d381e9a351e29ce4232e4151a7ffda0241b8e55700aadbfa.exe	39
PID 2904 wrote to memory of 1716	2904	5cf516c5f28baa62d381e9a351e29ce4232e4151a7ffda0241b8e55700aadbfa.exe	39
PID 1700 wrote to memory of 2216	1700	Unicorn-22085.exe	41
PID 1700 wrote to memory of 2216	1700	Unicorn-22085.exe	41
PID 1700 wrote to memory of 2216	1700	Unicorn-22085.exe	41
PID 1700 wrote to memory of 2216	1700	Unicorn-22085.exe	41
PID 1804 wrote to memory of 2396	1804	Unicorn-26068.exe	40
PID 1804 wrote to memory of 2396	1804	Unicorn-26068.exe	40
PID 1804 wrote to memory of 2396	1804	Unicorn-26068.exe	40
PID 1804 wrote to memory of 2396	1804	Unicorn-26068.exe	40
PID 2688 wrote to memory of 2960	2688	Unicorn-38928.exe	42
PID 2688 wrote to memory of 2960	2688	Unicorn-38928.exe	42
PID 2688 wrote to memory of 2960	2688	Unicorn-38928.exe	42
PID 2688 wrote to memory of 2960	2688	Unicorn-38928.exe	42
PID 2716 wrote to memory of 2764	2716	Unicorn-32945.exe	43
PID 2716 wrote to memory of 2764	2716	Unicorn-32945.exe	43
PID 2716 wrote to memory of 2764	2716	Unicorn-32945.exe	43
PID 2716 wrote to memory of 2764	2716	Unicorn-32945.exe	43
PID 2792 wrote to memory of 2452	2792	Unicorn-51913.exe	44
PID 2792 wrote to memory of 2452	2792	Unicorn-51913.exe	44
PID 2792 wrote to memory of 2452	2792	Unicorn-51913.exe	44
PID 2792 wrote to memory of 2452	2792	Unicorn-51913.exe	44
PID 1844 wrote to memory of 2160	1844	Unicorn-35550.exe	45
PID 1844 wrote to memory of 2160	1844	Unicorn-35550.exe	45
PID 1844 wrote to memory of 2160	1844	Unicorn-35550.exe	45
PID 1844 wrote to memory of 2160	1844	Unicorn-35550.exe	45

C:\Users\Admin\AppData\Local\Temp\5cf516c5f28baa62d381e9a351e29ce4232e4151a7ffda0241b8e55700aadbfa.exe
"C:\Users\Admin\AppData\Local\Temp\5cf516c5f28baa62d381e9a351e29ce4232e4151a7ffda0241b8e55700aadbfa.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51913.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51913.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45966.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45966.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44643.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1062.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45961.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38992.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29867.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2679.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22029.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57625.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38651.exe
        7⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5373.exe
        7⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41261.exe
        7⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57227.exe
        7⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14425.exe
        7⤵
        
        PID:1516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62681.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48242.exe
        7⤵
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
        7⤵
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18552.exe
        7⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51823.exe
        7⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55642.exe
        7⤵
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52387.exe
        6⤵
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15304.exe
        6⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65341.exe
        7⤵
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56156.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45958.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6640.exe
        7⤵
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22176.exe
        6⤵
        
        PID:1408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64754.exe
        6⤵
        
        PID:4612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43688.exe
        6⤵
        
        PID:4996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58685.exe
        6⤵
        
        PID:5348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50792.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18956.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20661.exe
        7⤵
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48045.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38097.exe
        7⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65197.exe
        7⤵
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32424.exe
        7⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38651.exe
        6⤵
        
        PID:2096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9439.exe
        6⤵
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30842.exe
        6⤵
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53143.exe
        6⤵
        
        PID:4792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14425.exe
        6⤵
        
        PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10687.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58252.exe
        5⤵
        
        PID:1360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6639.exe
        5⤵
        
        PID:3572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5641.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16282.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22157.exe
        5⤵
        
        PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53350.exe
        5⤵
        
        PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35550.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30310.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28255.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20767.exe
        7⤵
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19824.exe
        7⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24976.exe
        7⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36077.exe
        7⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48208.exe
        7⤵
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61093.exe
        6⤵
        
        PID:980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27062.exe
        6⤵
        
        PID:1296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14038.exe
        6⤵
        
        PID:3368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57797.exe
        6⤵
        
        PID:3480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36077.exe
        6⤵
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35956.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25301.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17952.exe
        6⤵
        
        PID:2280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33467.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61780.exe
        6⤵
        
        PID:828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36077.exe
        6⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35956.exe
        6⤵
        
        PID:1528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1097.exe
        5⤵
        
        PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49923.exe
        5⤵
        
        PID:1260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22176.exe
        5⤵
        
        PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34027.exe
        5⤵
        
        PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43688.exe
        5⤵
        
        PID:4664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58685.exe
        5⤵
        
        PID:5320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20972.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38644.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12009.exe
        6⤵
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9439.exe
        6⤵
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30842.exe
        6⤵
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58913.exe
        6⤵
        
        PID:4160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50041.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52387.exe
        5⤵
        
        PID:2620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28258.exe
        5⤵
        
        PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42444.exe
        5⤵
        
        PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4030.exe
        5⤵
        
        PID:4656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22157.exe
        5⤵
        
        PID:4328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10372.exe
        5⤵
        
        PID:5304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32349.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4988.exe
        5⤵
        
        PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21163.exe
        5⤵
        
        PID:3844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64162.exe
        5⤵
        
        PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55715.exe
        5⤵
        
        PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48960.exe
        5⤵
        
        PID:5700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40975.exe
      4⤵
      PID:2028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24530.exe
      4⤵
      PID:3144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13667.exe
      4⤵
      PID:2084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54953.exe
      4⤵
      PID:4724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21022.exe
      4⤵
      PID:4780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29815.exe
      4⤵
      PID:5772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32945.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32945.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42972.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25349.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53719.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7227.exe
        7⤵
        
        PID:436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42574.exe
        7⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24976.exe
        7⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59228.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43158.exe
        7⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7170.exe
        7⤵
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29939.exe
        6⤵
        
        PID:1816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44403.exe
        6⤵
        
        PID:3828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42444.exe
        6⤵
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51093.exe
        6⤵
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22157.exe
        6⤵
        
        PID:4340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53350.exe
        6⤵
        
        PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35607.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7227.exe
        6⤵
        
        PID:1952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42574.exe
        6⤵
        
        PID:1812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24976.exe
        6⤵
        
        PID:4052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12165.exe
        6⤵
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43158.exe
        6⤵
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7170.exe
        6⤵
        
        PID:5224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1097.exe
        5⤵
        
        PID:2148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49731.exe
        5⤵
        
        PID:3184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22176.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64754.exe
        5⤵
        
        PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43688.exe
        5⤵
        
        PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58685.exe
        5⤵
        
        PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14227.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41275.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36252.exe
        6⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22545.exe
        7⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45902.exe
        7⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21417.exe
        7⤵
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10338.exe
        6⤵
        
        PID:1544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16476.exe
        6⤵
        
        PID:4032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2108.exe
        6⤵
        
        PID:3208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15752.exe
        6⤵
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26622.exe
        6⤵
        
        PID:4896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49490.exe
        6⤵
        
        PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55281.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24073.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14173.exe
        5⤵
        
        PID:3868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49728.exe
        5⤵
        
        PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63003.exe
        5⤵
        
        PID:4880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43061.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57198.exe
        5⤵
        
        PID:6012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34075.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19807.exe
        5⤵
        
        PID:2004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12009.exe
        6⤵
        
        PID:1776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5373.exe
        6⤵
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14619.exe
        6⤵
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53143.exe
        6⤵
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61488.exe
        6⤵
        
        PID:5124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52899.exe
        5⤵
        
        PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44058.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30842.exe
        5⤵
        
        PID:3124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24956.exe
        5⤵
        
        PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28623.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34316.exe
      4⤵
      PID:1092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17626.exe
        5⤵
        
        PID:5868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22124.exe
      4⤵
      PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54375.exe
      4⤵
      PID:3412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58327.exe
      4⤵
      PID:4108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9054.exe
      4⤵
      PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12105.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36842.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36842.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64928.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59064.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60922.exe
        6⤵
        
        PID:1732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44054.exe
        6⤵
        
        PID:1028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8173.exe
        6⤵
        
        PID:3404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13230.exe
        6⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13470.exe
        6⤵
        
        PID:4184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53350.exe
        6⤵
        
        PID:5500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4108.exe
        5⤵
        
        PID:2248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9164.exe
        5⤵
        
        PID:3036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19575.exe
        5⤵
        
        PID:3624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31154.exe
        5⤵
        
        PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30706.exe
        5⤵
        
        PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51176.exe
        5⤵
        
        PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6874.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29939.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44403.exe
      4⤵
      PID:3836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19520.exe
      4⤵
      PID:3580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22162.exe
      4⤵
      PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43061.exe
      4⤵
      PID:5024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29815.exe
      4⤵
      PID:5756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45696.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45696.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63148.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25069.exe
        5⤵
        
        PID:2944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7227.exe
        6⤵
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30130.exe
        6⤵
        
        PID:3168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24976.exe
        6⤵
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18933.exe
        6⤵
        
        PID:3460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48661.exe
        6⤵
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51176.exe
        6⤵
        
        PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29939.exe
        5⤵
        
        PID:2192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9592.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21705.exe
        5⤵
        
        PID:4200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21022.exe
        5⤵
        
        PID:4924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29815.exe
        5⤵
        
        PID:5748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50320.exe
      4⤵
      PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38782.exe
        5⤵
        
        PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17261.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1444.exe
        5⤵
        
        PID:4140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14149.exe
        5⤵
        
        PID:5676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24073.exe
      4⤵
      PID:2480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53068.exe
      4⤵
      PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
      4⤵
      PID:3980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15745.exe
      4⤵
      PID:4848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43688.exe
      4⤵
      PID:4920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58685.exe
      4⤵
      PID:5468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17809.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17809.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38665.exe
      4⤵
      PID:600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15395.exe
        5⤵
        
        PID:2176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42574.exe
        5⤵
        
        PID:800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24976.exe
        5⤵
        
        PID:4048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14907.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58685.exe
        5⤵
        
        PID:5484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12009.exe
      4⤵
      PID:1352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36924.exe
      4⤵
      PID:3748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2455.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43693.exe
      4⤵
      PID:4372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
      4⤵
      PID:4488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22624.exe
      4⤵
      PID:5684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39649.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39649.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2234.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2234.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49909.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49909.exe
    3⤵
    PID:3356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31461.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31461.exe
    3⤵
    PID:3472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
    3⤵
    PID:4552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51091.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51091.exe
    3⤵
    PID:3220
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38928.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38928.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22085.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22085.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63584.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29433.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47352.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26112.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65050.exe
        7⤵
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57457.exe
        7⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4490.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43158.exe
        7⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7170.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18498.exe
        6⤵
        
        PID:108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37753.exe
        6⤵
        
        PID:1020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50302.exe
        6⤵
        
        PID:3588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13607.exe
        6⤵
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43688.exe
        6⤵
        
        PID:4888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8006.exe
        6⤵
        
        PID:6040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21648.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29939.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13676.exe
        5⤵
        
        PID:4004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50247.exe
        5⤵
        
        PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48804.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60376.exe
        5⤵
        
        PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22306.exe
        5⤵
        
        PID:5172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5483.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55473.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52899.exe
        6⤵
        
        PID:876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44058.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30842.exe
        6⤵
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2398.exe
        6⤵
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59349.exe
        6⤵
        
        PID:5044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33573.exe
        5⤵
        
        PID:520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13248.exe
        5⤵
        
        PID:984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19575.exe
        5⤵
        
        PID:3632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1751.exe
        5⤵
        
        PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56259.exe
        5⤵
        
        PID:4220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-190.exe
        5⤵
        
        PID:5104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58685.exe
        5⤵
        
        PID:5440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35145.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34991.exe
        5⤵
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60922.exe
        6⤵
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60966.exe
        6⤵
        
        PID:2600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8173.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10416.exe
        6⤵
        
        PID:3532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36077.exe
        6⤵
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48208.exe
        6⤵
        
        PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35026.exe
        5⤵
        
        PID:2064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4504.exe
        5⤵
        
        PID:2504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28014.exe
        5⤵
        
        PID:3916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50364.exe
        5⤵
        
        PID:4224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19759.exe
        5⤵
        
        PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58685.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10605.exe
      4⤵
      PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7227.exe
        5⤵
        
        PID:2644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42574.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24976.exe
        5⤵
        
        PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29431.exe
        5⤵
        
        PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48661.exe
        5⤵
        
        PID:5028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51176.exe
        5⤵
        
        PID:5220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63834.exe
      4⤵
      PID:2744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24722.exe
      4⤵
      PID:2284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22706.exe
      4⤵
      PID:3256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60288.exe
      4⤵
      PID:4716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
      4⤵
      PID:4768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9861.exe
      4⤵
      PID:6024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23106.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23106.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45961.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18956.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7170.exe
        6⤵
        
        PID:2788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10338.exe
        6⤵
        
        PID:2132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31058.exe
        6⤵
        
        PID:3772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2108.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50563.exe
        6⤵
        
        PID:4708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58846.exe
        6⤵
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58685.exe
        6⤵
        
        PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18223.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37653.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30322.exe
        6⤵
        
        PID:2404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24976.exe
        6⤵
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40946.exe
        6⤵
        
        PID:4816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43158.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63151.exe
        6⤵
        
        PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24073.exe
        5⤵
        
        PID:1792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30510.exe
        5⤵
        
        PID:4056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2455.exe
        5⤵
        
        PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4798.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-175.exe
        5⤵
        
        PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53350.exe
        5⤵
        
        PID:5364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62489.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29939.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44403.exe
      4⤵
      PID:3820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28197.exe
      4⤵
      PID:1916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57667.exe
      4⤵
      PID:4868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64577.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29815.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64527.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64527.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26200.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60346.exe
        5⤵
        
        PID:2056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17411.exe
        5⤵
        
        PID:1048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8173.exe
        5⤵
        
        PID:3388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39389.exe
        5⤵
        
        PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53744.exe
        5⤵
        
        PID:4164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48661.exe
        5⤵
        
        PID:5084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14679.exe
        5⤵
        
        PID:5632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24720.exe
      4⤵
      PID:1568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57789.exe
      4⤵
      PID:2832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28014.exe
      4⤵
      PID:3924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44826.exe
      4⤵
      PID:4260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43688.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58685.exe
      4⤵
      PID:5408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62883.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62883.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9609.exe
      4⤵
      PID:2512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10338.exe
      4⤵
      PID:2324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55371.exe
      4⤵
      PID:3988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2108.exe
      4⤵
      PID:836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15752.exe
      4⤵
      PID:4748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26622.exe
      4⤵
      PID:4916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36174.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36174.exe
    3⤵
    PID:1328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4738.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4738.exe
    3⤵
    PID:1508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6038.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6038.exe
    3⤵
    PID:3800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37979.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37979.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24227.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24227.exe
    3⤵
    PID:4688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21022.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21022.exe
    3⤵
    PID:4956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29815.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29815.exe
    3⤵
    PID:5764
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26068.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26068.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55416.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55416.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5120.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32614.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37744.exe
        6⤵
        
        PID:3092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11453.exe
        6⤵
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51823.exe
        6⤵
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55642.exe
        6⤵
        
        PID:6136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36261.exe
        5⤵
        
        PID:3060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56310.exe
        5⤵
        
        PID:2812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30842.exe
        5⤵
        
        PID:3216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32280.exe
        5⤵
        
        PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26622.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51176.exe
        5⤵
        
        PID:5212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22670.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20191.exe
        5⤵
        
        PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56306.exe
        5⤵
        
        PID:2272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8173.exe
        5⤵
        
        PID:3400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4381.exe
        5⤵
        
        PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60262.exe
        5⤵
        
        PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7170.exe
        5⤵
        
        PID:6128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57615.exe
      4⤵
      PID:2448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63654.exe
      4⤵
      PID:2120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11479.exe
      4⤵
      PID:3756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61892.exe
      4⤵
      PID:4252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22157.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53350.exe
      4⤵
      PID:5340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13651.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13651.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59365.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24073.exe
      4⤵
      PID:2260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11479.exe
      4⤵
      PID:3852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34757.exe
      4⤵
      PID:4416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22157.exe
      4⤵
      PID:4500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53350.exe
      4⤵
      PID:5492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35384.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35384.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49612.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
      4⤵
      PID:3084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53363.exe
      4⤵
      PID:4672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51823.exe
      4⤵
      PID:4644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55642.exe
      4⤵
      PID:5132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21273.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21273.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54510.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54510.exe
    3⤵
    PID:3860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59510.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59510.exe
    3⤵
    PID:1996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29562.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29562.exe
    3⤵
    PID:4796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
    3⤵
    PID:4528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57551.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57551.exe
    3⤵
    PID:5656
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5950.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5950.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60159.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60159.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26392.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61223.exe
        5⤵
        
        PID:2168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11189.exe
        5⤵
        
        PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8173.exe
        5⤵
        
        PID:3428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10416.exe
        5⤵
        
        PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37407.exe
        5⤵
        
        PID:1280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48661.exe
        5⤵
        
        PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51176.exe
        5⤵
        
        PID:5188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29105.exe
      4⤵
      PID:2456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24924.exe
      4⤵
      PID:1492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28014.exe
      4⤵
      PID:3904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54191.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44196.exe
      4⤵
      PID:4116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53350.exe
      4⤵
      PID:5424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57673.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57673.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63745.exe
      4⤵
      PID:1316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50660.exe
      4⤵
      PID:2700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54551.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8653.exe
      4⤵
      PID:4404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25722.exe
      4⤵
      PID:4192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53350.exe
      4⤵
      PID:5476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52270.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52270.exe
    3⤵
    PID:1680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19113.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19113.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47475.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47475.exe
    3⤵
    PID:3600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50753.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50753.exe
    3⤵
    PID:3584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7787.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7787.exe
    3⤵
    PID:4212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54014.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54014.exe
    3⤵
    PID:4484
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36838.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36838.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2572.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2572.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7227.exe
      4⤵
      PID:2424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30130.exe
      4⤵
      PID:3160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24976.exe
      4⤵
      PID:4012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24418.exe
      4⤵
      PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43158.exe
      4⤵
      PID:4580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7170.exe
      4⤵
      PID:6084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25744.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25744.exe
    3⤵
    PID:808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19388.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19388.exe
    3⤵
    PID:3548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22176.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22176.exe
    3⤵
    PID:1388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64754.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64754.exe
    3⤵
    PID:4604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43688.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43688.exe
    3⤵
    PID:4932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58685.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58685.exe
    3⤵
    PID:5416
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28253.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28253.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7227.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7227.exe
    3⤵
    PID:1132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31058.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31058.exe
    3⤵
    PID:3764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49717.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49717.exe
    3⤵
    PID:3524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53270.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53270.exe
    3⤵
    PID:4384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21705.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21705.exe
    3⤵
    PID:4232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58685.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58685.exe
    3⤵
    PID:5392
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64364.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64364.exe
  2⤵
  PID:2696
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20065.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20065.exe
  2⤵
  PID:3152
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61378.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61378.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1760
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59154.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59154.exe
  2⤵
  PID:4680
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58823.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58823.exe
  2⤵
  PID:4700
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34172.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34172.exe
  2⤵
  PID:5284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-36842.exe

Filesize
468KB

MD5
0fdce5720cfb3ec8b1946c10fb960fa8

SHA1
e6f5a33343889360e90a243f3a463466bb35e542

SHA256
4ba27d6fef3f96532ddc98b57a0752431b4b86c295a5ee393188f650c8fee44f

SHA512
26c3a7f123f97c4e57c34fb39b6c1bc1d83e0ee1f2267debe68ebc21d4e4026d5b8106fa8131a0dd8967acebe26b4e3f5f7e7a880fcb5c8d2e57e23b80e7759f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42972.exe

Filesize
468KB

MD5
d8aeaea04479d3921319cc129277a456

SHA1
5dae45461ab024ee04de9cfbd9a7665131197fb2

SHA256
7264157724042db268101b5f35bcdcbe3db3339b3ed5e41969d53ab298db0a1c

SHA512
32836793a975e42afef4199f097a8b511e632403da9cb21e20dfc17c514a017754f6257ad23e22bd6e02a0b4b89048afa55206227515d71306727023187303cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44643.exe

Filesize
468KB

MD5
d2bbf67c174c525fff032f185b6148d3

SHA1
6e50beff9cb016179596b07a831932ad45601115

SHA256
6e0db87bd039d8457d6085dedaf24748ca58dab1cf10d7f7b432e4eeb9b0c11e

SHA512
2c9a6709df5fdfe053a40940a5fc95a5c7a0ade60f35553b2f877fd1723dc42b5a6a8d71d33dfad1a19ceb4d6f9792f04261e7e889fb5f58a55c27b3b559d527

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44826.exe

Filesize
468KB

MD5
b93b7c49469a70f93cd27b4935b8ee42

SHA1
4b2074c9c5f5936fe5e5b2d243afce043fc1514d

SHA256
7f89661bf17bf67ff1555353c190693e5911a5e50a7685ee632fc74ec42f7beb

SHA512
dd896467fb6ac487db7fd3f337d32fa304a40e1f548debc2f99cbb772bb1d5c1afc0d6f0735bc1015254875277670c53c1663c9a7b7ea58c36e09d353c9d2acf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5950.exe

Filesize
468KB

MD5
d24904c76e691530bd603fad44ab62d6

SHA1
61dfc0678749f2e5e7de4648476ce465202199f1

SHA256
d8bc0bee4d6c0346706d2762dbeda3733c784ca2d542ab4374ebd9b33771620a

SHA512
0069f2c64bf20f32c452cf02d4bba55870c8b75ed6b34090b75d86e27e0648884cb22bec6b03645a19565ae974b84e1a48110490f228789915ac7185d968578b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64577.exe

Filesize
468KB

MD5
6c2223be37dd1f1331af17c188f19996

SHA1
1b77beaf5b8d7e0554bdc1473b4fdfef0e1bd200

SHA256
b8ab570a408ee7c5224352e9fa52f6443f3d9aa0265e2888f2f1a9ed35c11d9e

SHA512
3cb7b01270dbf5f521b0ce18d40aa37d59803b35694113c864510d7780e2a44b7e29cc94a5cc9a3940f311b306d082d9c0309e10a45f304fdf2e337838db5997

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1062.exe

Filesize
468KB

MD5
bc2581d0586c03763a80ac881bcb5d23

SHA1
eab9dcfc2211874a16d3d92fbe4d34402095931d

SHA256
cc9cd9c6e8b52c38507348067d2486d3eed0debc6403d04b522e0598aa7084e7

SHA512
5f7eec01ce77d3b943d302275f8b021fccc85e873f2869bf2e5a9a714fb7c6034c15567ee2040e1c5ede43078e28efa7dc04d86dd6696fb0ed2beb55b64a4136

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20972.exe

Filesize
468KB

MD5
725d9204fbcec35031d35bc6eadafab6

SHA1
399be74cdf6539cf59abf3bdb54354b25b91b07b

SHA256
2193bdce35c4bcf3a7c1b7495d1d771941b0487b97da5345ed4b50f5e987edbd

SHA512
8932b098dbf30ca867f4496a863073d49e365c338a101edc9ac4bbdf8086145761a42243a4af004cbe948b9f32473d7c7c06cd100b984b77159666210a8eeae6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22085.exe

Filesize
468KB

MD5
afd0ba4369ec906e8d88b4888189f1bd

SHA1
f337f1548b9f7cd47ce1d5de28d914c369121884

SHA256
62e6c65107bd642980e118921047c9c2b5a44503899ee3ca6e0c8b3f6a8120f6

SHA512
ce9d250692ce2dd7aad5f3731893892216257f7d1ebed11624397f611d484669c23c182a74e4c39a4e6ff4e494417d6ad8d4bfe009b625b8afa9dded98463c22

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23106.exe

Filesize
468KB

MD5
8ae0c646cae5716079c9977e6fc8c248

SHA1
4858e2ea6c939424d8e1c502108a43aab2663a68

SHA256
2297990be619b7470a31d240dd9ef5b91ece35c0cfee359d0cd3a57f2af07759

SHA512
c40f207e2ba3e101889e137d950a9908c826861f3d28f6ada00b366a0e6244f28fa0a4aa6d7acf32c0c047757fde34547e41e65e759b28057849a89425adabc2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26068.exe

Filesize
468KB

MD5
767e6eca549dcf7678667db9b67eb726

SHA1
4bb1fe887e8e54cc4cae0e55f9e54a26282a0a44

SHA256
9e87e4ec628d9730c33a85094bc4e9b4ed605ca9eecb69862ebb19e093f412bc

SHA512
33b73b1c5758f54d2bd5ae417c0b84d4b54dfdae5d50bfa9fb2e14e5f03f4a09d0913f29a5850cae36f28c503ca2c54f7289c70d74a450e854c8a1a3a54c02c7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-30310.exe

Filesize
468KB

MD5
3cedd2abe468095fddb04a123b0d5ac4

SHA1
2bf09cdd603479cd608c2bc53ff4e09ce6203a69

SHA256
98f5002feb8c6e66753e3679ebad93ef7fd9675a65ab402936743a22da7acf12

SHA512
16377e64410b941b8c829a6b380d3c83968d319f92155d391aabe7a889a0d2c08bc828bf56501a493c08b2bf227263742c829cb5f323c97d3f9f427f32542505

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32945.exe

Filesize
468KB

MD5
2ae0c5be56f166638f404718a3237d87

SHA1
861eb20fbbdd717b4f3dd2b94f1931f3964d2def

SHA256
d03a8b4efa7e200b50360114fc23d5dd8ebfd708484bbdd026529543092c05f1

SHA512
3888feec33b30adb25e2a802f83e27c836352ef3b48a123aca2b970607156ba30aaf51c56f373fc756147db629ad25c2f56f9df8991248aa148db811835916aa

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-35550.exe

Filesize
468KB

MD5
e3ed361be3d5e8a939c577a51ce9a216

SHA1
a94b40b24d68a5423b849bd2431e2acc68987505

SHA256
71476e3da7ddde8c78171ddde5682bff1c501601d5d360494310d08243f06180

SHA512
b3d79878c8ec73071f027c57d96c1d6489b059b8dc3df77e078e552425cfa62d8ef355d2510e3ac2ce29529738a46cd2d9d032421b16531cdcd97e180c78d3ad

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38928.exe

Filesize
468KB

MD5
ef4634cd2b2bad28852c87074afc53a2

SHA1
30067872168e67bf4280df885992b81e637f3b44

SHA256
d891569d437134996e36044fecdb4f0c484ea7a81e9a174b43cafa564c491409

SHA512
c6934121ed3f6946617e658113afdd7a02e4bb18867c4b3e37c959bb88f3b2ee5158aeff5b82285ffe87497abc4997a492c3f81264f2ed1f414169fe1a52ed41

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45696.exe

Filesize
468KB

MD5
c7ea7ee559af5f6238f432856a6483a4

SHA1
428c7acb3b32006ff2ebc7509244e46079225928

SHA256
b3c801db255897afb59209cf692c57c2d0e1a47eb0e5f0d565e1aa16ab323380

SHA512
5e434f3d18a8ca78ab1ebbbfe90f77de68d07f98a9032a40fbd5023f31f74fd59a0ce949c16ef363c4ea36e8bd214e7fea84a191d0a2d5d24a0ae127a19fc147

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45966.exe

Filesize
468KB

MD5
70715c49e4f083fa23b709e5ff1e16fa

SHA1
c42bfe36a981af57d73127c6c9408825b5fb0943

SHA256
679cf0b9e681ded99af5de6e6173b5ea470e70d60a0f4ce44786361797bf5a96

SHA512
9d8a383f1934fbd463f9cc76ea28609e3850f623981adf8cf5275e946f4a77b610e66171dd36e6dc2cbae544c60a38dd4b4d94cd838aebbeab4ccb6e3e908fa1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51913.exe

Filesize
468KB

MD5
d2c745ee5fce07c03d268cd0c2c04030

SHA1
2b41a3162aca903209e49f9cbf8a93042db1b3af

SHA256
1eb3b6a28d975fd4b0bc46e6b5b965f67a4d059dacdd49473a966336166b1c42

SHA512
3f0a9fb071a15c465fbe673d3acb7e6f1028b7466552f79dc5c8576fb012d8622a407dab8d0b8da3d4299782368ef5996c0a10a695c6778c332e1c0f3b2fdb9b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55416.exe

Filesize
468KB

MD5
1d83f11745a4e2951db3714247e88831

SHA1
83fb8a3cc15d40c79acf7c1ddbbf3a66fe00f62c

SHA256
c4a34108fa9afd2a657a54cf3862bc5c3ecc1845c3f48b53f860ef491347f0d9

SHA512
9d1127f4cd6dba39153f6896987f9abaab05076012ba198cb37ce4a4ae501b89a18fc781974e17a464984d68bfe664ee18f808983f2272575c87dc447245cca7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63584.exe

Filesize
468KB

MD5
c309eacb7bb4bea8d14dcae46512406e

SHA1
12c72b0ef7556590f2b98de0c72cc6d314162b32

SHA256
9b80a2212d4f75a1fee1c141a4ea123af845ea0f1f70abb3b692340a8ee724ff

SHA512
f6246a5c790d3bcd1deffeef80c45c536d9fb4b98bebef3b2f2f6475f1bfdcc44c98d75d72b808acf386fd05c143de18f20aa29122b743f8ef7fef038b1cde83

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64928.exe

Filesize
468KB

MD5
d0d172f7fadbc62db6577896c7ac5249

SHA1
7a227c57d612b1eac36b3334537d4dd658890158

SHA256
7724e45e975c21b3692722f308c536bf09b776f98075a35d67c1b2d2d40a7745

SHA512
3389bd64a62c66f1fa472220c2dcdf8277759afb5428227796ccaf260f053aceae7ef5212b471f0eaf75a9295255b4aaddbb8194d42ac99e15d29f73f3f23e1b

Download Submit