18614b8af53f070dbd28802c3c9baf6a590315184af3676bcc39260999a14ae6

Analysis

max time kernel
119s
max time network
18s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
31-10-2024 08:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18614b8af53f070dbd28802c3c9baf6a590315184af3676bcc39260999a14ae6N.exe
Size

468KB
MD5

80caa4f196097eb8f465cf9db1f4ece0
SHA1

7010dbcc9cfd652ff3b918ca4f7dc3fcda3e92d0
SHA256

18614b8af53f070dbd28802c3c9baf6a590315184af3676bcc39260999a14ae6
SHA512

b4d969ada273f653f3815413470dedc6191d1b4ad1c2c9be13297125899bf982694d3fe46af1e9d71a15aa041caa3ca93f4322b7edb03548c35dcbf581c1e0dd
SSDEEP

3072:C1TyogLtaO8Xn+/rPz5FapGKfDzWs8JgmHeAVpyG2w32acNWJle:C1uoN/XngP1Fap8lQ3G2OxcNW

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2940	Unicorn-3866.exe
2872	Unicorn-15132.exe
2780	Unicorn-18470.exe
1160	Unicorn-7810.exe
2904	Unicorn-5209.exe
2676	Unicorn-60348.exe
1848	Unicorn-52180.exe
2600	Unicorn-38422.exe
2228	Unicorn-16798.exe
2980	Unicorn-17064.exe
2596	Unicorn-49051.exe
772	Unicorn-62735.exe
2236	Unicorn-44182.exe
1740	Unicorn-8220.exe
2076	Unicorn-32724.exe
2452	Unicorn-51822.exe
2564	Unicorn-43654.exe
1232	Unicorn-61797.exe
2612	Unicorn-3114.exe
2096	Unicorn-22980.exe
2220	Unicorn-57956.exe
1356	Unicorn-38090.exe
372	Unicorn-51826.exe
1916	Unicorn-57956.exe
2244	Unicorn-49523.exe
1548	Unicorn-18385.exe
2292	Unicorn-49570.exe
1900	Unicorn-49570.exe
2736	Unicorn-52777.exe
2480	Unicorn-63113.exe
2888	Unicorn-9305.exe
2804	Unicorn-17857.exe
1076	Unicorn-47152.exe
2212	Unicorn-1717.exe
2400	Unicorn-8231.exe
2404	Unicorn-59470.exe
392	Unicorn-15632.exe
2788	Unicorn-15632.exe
2380	Unicorn-61303.exe
2296	Unicorn-23800.exe
2964	Unicorn-23800.exe
2544	Unicorn-38471.exe
2232	Unicorn-44448.exe
584	Unicorn-41671.exe
2972	Unicorn-61537.exe
756	Unicorn-36071.exe
2124	Unicorn-63492.exe
2424	Unicorn-53286.exe
1968	Unicorn-27230.exe
2552	Unicorn-20479.exe
540	Unicorn-24899.exe
1008	Unicorn-44957.exe
2120	Unicorn-10180.exe
2256	Unicorn-4050.exe
920	Unicorn-18467.exe
3040	Unicorn-19693.exe
1588	Unicorn-65364.exe
2792	Unicorn-36221.exe
3064	Unicorn-45842.exe
2768	Unicorn-12745.exe
2488	Unicorn-32992.exe
2224	Unicorn-20186.exe
1768	Unicorn-8872.exe
1664	Unicorn-38826.exe

Loads dropped DLL 64 IoCs

pid	Process
1132	18614b8af53f070dbd28802c3c9baf6a590315184af3676bcc39260999a14ae6N.exe
1132	18614b8af53f070dbd28802c3c9baf6a590315184af3676bcc39260999a14ae6N.exe
2940	Unicorn-3866.exe
1132	18614b8af53f070dbd28802c3c9baf6a590315184af3676bcc39260999a14ae6N.exe
1132	18614b8af53f070dbd28802c3c9baf6a590315184af3676bcc39260999a14ae6N.exe
2940	Unicorn-3866.exe
2780	Unicorn-18470.exe
2940	Unicorn-3866.exe
2940	Unicorn-3866.exe
1132	18614b8af53f070dbd28802c3c9baf6a590315184af3676bcc39260999a14ae6N.exe
1132	18614b8af53f070dbd28802c3c9baf6a590315184af3676bcc39260999a14ae6N.exe
2780	Unicorn-18470.exe
2872	Unicorn-15132.exe
2872	Unicorn-15132.exe
1132	18614b8af53f070dbd28802c3c9baf6a590315184af3676bcc39260999a14ae6N.exe
2872	Unicorn-15132.exe
1160	Unicorn-7810.exe
1160	Unicorn-7810.exe
1132	18614b8af53f070dbd28802c3c9baf6a590315184af3676bcc39260999a14ae6N.exe
2872	Unicorn-15132.exe
1848	Unicorn-52180.exe
1848	Unicorn-52180.exe
2780	Unicorn-18470.exe
2780	Unicorn-18470.exe
2940	Unicorn-3866.exe
2940	Unicorn-3866.exe
2676	Unicorn-60348.exe
2904	Unicorn-5209.exe
2676	Unicorn-60348.exe
2904	Unicorn-5209.exe
2228	Unicorn-16798.exe
2980	Unicorn-17064.exe
2228	Unicorn-16798.exe
2980	Unicorn-17064.exe
1132	18614b8af53f070dbd28802c3c9baf6a590315184af3676bcc39260999a14ae6N.exe
1132	18614b8af53f070dbd28802c3c9baf6a590315184af3676bcc39260999a14ae6N.exe
1848	Unicorn-52180.exe
1848	Unicorn-52180.exe
2596	Unicorn-49051.exe
2596	Unicorn-49051.exe
1160	Unicorn-7810.exe
772	Unicorn-62735.exe
2872	Unicorn-15132.exe
2236	Unicorn-44182.exe
2940	Unicorn-3866.exe
1160	Unicorn-7810.exe
2872	Unicorn-15132.exe
772	Unicorn-62735.exe
2236	Unicorn-44182.exe
2940	Unicorn-3866.exe
2780	Unicorn-18470.exe
2780	Unicorn-18470.exe
2564	Unicorn-43654.exe
2076	Unicorn-32724.exe
2564	Unicorn-43654.exe
2076	Unicorn-32724.exe
2600	Unicorn-38422.exe
2600	Unicorn-38422.exe
2904	Unicorn-5209.exe
2904	Unicorn-5209.exe
2228	Unicorn-16798.exe
2228	Unicorn-16798.exe
2980	Unicorn-17064.exe
2980	Unicorn-17064.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24087.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3002.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24347.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2493.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62646.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19244.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5178.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50518.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14834.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19774.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19769.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58354.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24768.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49272.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16798.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1717.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15632.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20479.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31757.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59767.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42962.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2509.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35226.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36302.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49570.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18467.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8872.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60274.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14354.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18441.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51120.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4769.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55301.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43817.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4206.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7810.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49570.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32992.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59354.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19613.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59547.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35473.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4830.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29570.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63492.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59821.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29893.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61846.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49148.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13565.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61671.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18385.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61537.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38504.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34950.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18822.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56184.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1132	18614b8af53f070dbd28802c3c9baf6a590315184af3676bcc39260999a14ae6N.exe
2940	Unicorn-3866.exe
2780	Unicorn-18470.exe
2872	Unicorn-15132.exe
1160	Unicorn-7810.exe
2904	Unicorn-5209.exe
2676	Unicorn-60348.exe
1848	Unicorn-52180.exe
2980	Unicorn-17064.exe
2596	Unicorn-49051.exe
2228	Unicorn-16798.exe
2600	Unicorn-38422.exe
772	Unicorn-62735.exe
2236	Unicorn-44182.exe
2076	Unicorn-32724.exe
2452	Unicorn-51822.exe
2564	Unicorn-43654.exe
1740	Unicorn-8220.exe
2096	Unicorn-22980.exe
1356	Unicorn-38090.exe
1232	Unicorn-61797.exe
1916	Unicorn-57956.exe
2220	Unicorn-57956.exe
2244	Unicorn-49523.exe
372	Unicorn-51826.exe
2612	Unicorn-3114.exe
1548	Unicorn-18385.exe
1900	Unicorn-49570.exe
2292	Unicorn-49570.exe
2736	Unicorn-52777.exe
2480	Unicorn-63113.exe
2212	Unicorn-1717.exe
2804	Unicorn-17857.exe
2888	Unicorn-9305.exe
1076	Unicorn-47152.exe
2296	Unicorn-23800.exe
392	Unicorn-15632.exe
2404	Unicorn-59470.exe
2400	Unicorn-8231.exe
2380	Unicorn-61303.exe
2788	Unicorn-15632.exe
2964	Unicorn-23800.exe
2544	Unicorn-38471.exe
2124	Unicorn-63492.exe
584	Unicorn-41671.exe
756	Unicorn-36071.exe
2232	Unicorn-44448.exe
2972	Unicorn-61537.exe
2424	Unicorn-53286.exe
1968	Unicorn-27230.exe
2552	Unicorn-20479.exe
540	Unicorn-24899.exe
1008	Unicorn-44957.exe
920	Unicorn-18467.exe
2120	Unicorn-10180.exe
2256	Unicorn-4050.exe
3040	Unicorn-19693.exe
1588	Unicorn-65364.exe
2792	Unicorn-36221.exe
2768	Unicorn-12745.exe
3064	Unicorn-45842.exe
2488	Unicorn-32992.exe
2224	Unicorn-20186.exe
1664	Unicorn-38826.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 2940	1132	18614b8af53f070dbd28802c3c9baf6a590315184af3676bcc39260999a14ae6N.exe	30
PID 1132 wrote to memory of 2940	1132	18614b8af53f070dbd28802c3c9baf6a590315184af3676bcc39260999a14ae6N.exe	30
PID 1132 wrote to memory of 2940	1132	18614b8af53f070dbd28802c3c9baf6a590315184af3676bcc39260999a14ae6N.exe	30
PID 1132 wrote to memory of 2940	1132	18614b8af53f070dbd28802c3c9baf6a590315184af3676bcc39260999a14ae6N.exe	30
PID 1132 wrote to memory of 2872	1132	18614b8af53f070dbd28802c3c9baf6a590315184af3676bcc39260999a14ae6N.exe	32
PID 1132 wrote to memory of 2872	1132	18614b8af53f070dbd28802c3c9baf6a590315184af3676bcc39260999a14ae6N.exe	32
PID 1132 wrote to memory of 2872	1132	18614b8af53f070dbd28802c3c9baf6a590315184af3676bcc39260999a14ae6N.exe	32
PID 1132 wrote to memory of 2872	1132	18614b8af53f070dbd28802c3c9baf6a590315184af3676bcc39260999a14ae6N.exe	32
PID 2940 wrote to memory of 2780	2940	Unicorn-3866.exe	31
PID 2940 wrote to memory of 2780	2940	Unicorn-3866.exe	31
PID 2940 wrote to memory of 2780	2940	Unicorn-3866.exe	31
PID 2940 wrote to memory of 2780	2940	Unicorn-3866.exe	31
PID 2940 wrote to memory of 1160	2940	Unicorn-3866.exe	34
PID 2940 wrote to memory of 1160	2940	Unicorn-3866.exe	34
PID 2940 wrote to memory of 1160	2940	Unicorn-3866.exe	34
PID 2940 wrote to memory of 1160	2940	Unicorn-3866.exe	34
PID 1132 wrote to memory of 2904	1132	18614b8af53f070dbd28802c3c9baf6a590315184af3676bcc39260999a14ae6N.exe	35
PID 1132 wrote to memory of 2904	1132	18614b8af53f070dbd28802c3c9baf6a590315184af3676bcc39260999a14ae6N.exe	35
PID 1132 wrote to memory of 2904	1132	18614b8af53f070dbd28802c3c9baf6a590315184af3676bcc39260999a14ae6N.exe	35
PID 1132 wrote to memory of 2904	1132	18614b8af53f070dbd28802c3c9baf6a590315184af3676bcc39260999a14ae6N.exe	35
PID 2780 wrote to memory of 2676	2780	Unicorn-18470.exe	33
PID 2780 wrote to memory of 2676	2780	Unicorn-18470.exe	33
PID 2780 wrote to memory of 2676	2780	Unicorn-18470.exe	33
PID 2780 wrote to memory of 2676	2780	Unicorn-18470.exe	33
PID 2872 wrote to memory of 1848	2872	Unicorn-15132.exe	36
PID 2872 wrote to memory of 1848	2872	Unicorn-15132.exe	36
PID 2872 wrote to memory of 1848	2872	Unicorn-15132.exe	36
PID 2872 wrote to memory of 1848	2872	Unicorn-15132.exe	36
PID 1160 wrote to memory of 2596	1160	Unicorn-7810.exe	39
PID 1160 wrote to memory of 2596	1160	Unicorn-7810.exe	39
PID 1160 wrote to memory of 2596	1160	Unicorn-7810.exe	39
PID 1160 wrote to memory of 2596	1160	Unicorn-7810.exe	39
PID 1132 wrote to memory of 2228	1132	18614b8af53f070dbd28802c3c9baf6a590315184af3676bcc39260999a14ae6N.exe	37
PID 1132 wrote to memory of 2228	1132	18614b8af53f070dbd28802c3c9baf6a590315184af3676bcc39260999a14ae6N.exe	37
PID 1132 wrote to memory of 2228	1132	18614b8af53f070dbd28802c3c9baf6a590315184af3676bcc39260999a14ae6N.exe	37
PID 1132 wrote to memory of 2228	1132	18614b8af53f070dbd28802c3c9baf6a590315184af3676bcc39260999a14ae6N.exe	37
PID 2872 wrote to memory of 2600	2872	Unicorn-15132.exe	38
PID 2872 wrote to memory of 2600	2872	Unicorn-15132.exe	38
PID 2872 wrote to memory of 2600	2872	Unicorn-15132.exe	38
PID 2872 wrote to memory of 2600	2872	Unicorn-15132.exe	38
PID 1848 wrote to memory of 2980	1848	Unicorn-52180.exe	40
PID 1848 wrote to memory of 2980	1848	Unicorn-52180.exe	40
PID 1848 wrote to memory of 2980	1848	Unicorn-52180.exe	40
PID 1848 wrote to memory of 2980	1848	Unicorn-52180.exe	40
PID 2780 wrote to memory of 772	2780	Unicorn-18470.exe	41
PID 2780 wrote to memory of 772	2780	Unicorn-18470.exe	41
PID 2780 wrote to memory of 772	2780	Unicorn-18470.exe	41
PID 2780 wrote to memory of 772	2780	Unicorn-18470.exe	41
PID 2940 wrote to memory of 2236	2940	Unicorn-3866.exe	42
PID 2940 wrote to memory of 2236	2940	Unicorn-3866.exe	42
PID 2940 wrote to memory of 2236	2940	Unicorn-3866.exe	42
PID 2940 wrote to memory of 2236	2940	Unicorn-3866.exe	42
PID 2676 wrote to memory of 1740	2676	Unicorn-60348.exe	43
PID 2676 wrote to memory of 1740	2676	Unicorn-60348.exe	43
PID 2676 wrote to memory of 1740	2676	Unicorn-60348.exe	43
PID 2676 wrote to memory of 1740	2676	Unicorn-60348.exe	43
PID 2904 wrote to memory of 2076	2904	Unicorn-5209.exe	44
PID 2904 wrote to memory of 2076	2904	Unicorn-5209.exe	44
PID 2904 wrote to memory of 2076	2904	Unicorn-5209.exe	44
PID 2904 wrote to memory of 2076	2904	Unicorn-5209.exe	44
PID 2228 wrote to memory of 2452	2228	Unicorn-16798.exe	45
PID 2228 wrote to memory of 2452	2228	Unicorn-16798.exe	45
PID 2228 wrote to memory of 2452	2228	Unicorn-16798.exe	45
PID 2228 wrote to memory of 2452	2228	Unicorn-16798.exe	45

C:\Users\Admin\AppData\Local\Temp\18614b8af53f070dbd28802c3c9baf6a590315184af3676bcc39260999a14ae6N.exe
"C:\Users\Admin\AppData\Local\Temp\18614b8af53f070dbd28802c3c9baf6a590315184af3676bcc39260999a14ae6N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3866.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3866.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18470.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18470.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60348.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8220.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47152.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10751.exe
        7⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26013.exe
        8⤵
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54080.exe
        8⤵
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35566.exe
        8⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51495.exe
        8⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47632.exe
        8⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12479.exe
        7⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38504.exe
        7⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2509.exe
        7⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19244.exe
        7⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53063.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30823.exe
        6⤵
        
        PID:2856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11601.exe
        6⤵
        
        PID:2704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28617.exe
        6⤵
        
        PID:3824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23091.exe
        6⤵
        
        PID:3648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3023.exe
        6⤵
        
        PID:4256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34653.exe
        6⤵
        
        PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1717.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35427.exe
        6⤵
        
        PID:1252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35468.exe
        6⤵
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32483.exe
        6⤵
        
        PID:3952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33937.exe
        6⤵
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61671.exe
        6⤵
        
        PID:4968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24087.exe
        6⤵
        
        PID:4872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53527.exe
        5⤵
        
        PID:296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64462.exe
        6⤵
        
        PID:2744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24768.exe
        6⤵
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14455.exe
        6⤵
        
        PID:1388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19244.exe
        6⤵
        
        PID:4724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53063.exe
        6⤵
        
        PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45654.exe
        5⤵
        
        PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34950.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4769.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9022.exe
        5⤵
        
        PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33518.exe
        5⤵
        
        PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62735.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57956.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23800.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10154.exe
        7⤵
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43293.exe
        8⤵
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52515.exe
        8⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14354.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36428.exe
        7⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38504.exe
        7⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19613.exe
        7⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19244.exe
        7⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53063.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41985.exe
        6⤵
        
        PID:112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5318.exe
        6⤵
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34419.exe
        6⤵
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9234.exe
        6⤵
        
        PID:3076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35888.exe
        6⤵
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34653.exe
        6⤵
        
        PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44448.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51120.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24768.exe
        6⤵
        
        PID:3236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13748.exe
        6⤵
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27910.exe
        6⤵
        
        PID:4612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23557.exe
        6⤵
        
        PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3002.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28417.exe
        5⤵
        
        PID:1672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42962.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46914.exe
        5⤵
        
        PID:4104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12084.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18385.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10180.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5178.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33730.exe
        6⤵
        
        PID:1092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29570.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47419.exe
        6⤵
        
        PID:4224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11746.exe
        6⤵
        
        PID:4192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4830.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38504.exe
        5⤵
        
        PID:3340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19613.exe
        5⤵
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18822.exe
        5⤵
        
        PID:4464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56184.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18467.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59821.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8117.exe
        5⤵
        
        PID:4448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48039.exe
        5⤵
        
        PID:5080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1349.exe
      4⤵
      PID:868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24347.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53969.exe
      4⤵
      PID:3736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51870.exe
      4⤵
      PID:4960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1422.exe
      4⤵
      PID:4820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7810.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7810.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49051.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22980.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15632.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59547.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44981.exe
        7⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32483.exe
        7⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9608.exe
        7⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11295.exe
        7⤵
        
        PID:4640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41985.exe
        6⤵
        
        PID:876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33443.exe
        6⤵
        
        PID:1488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23817.exe
        6⤵
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35226.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55301.exe
        6⤵
        
        PID:4688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41671.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21312.exe
        6⤵
        
        PID:2524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64990.exe
        6⤵
        
        PID:2900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43085.exe
        6⤵
        
        PID:3416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21694.exe
        6⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2557.exe
        6⤵
        
        PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29893.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15930.exe
        5⤵
        
        PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51280.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51398.exe
        5⤵
        
        PID:3220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19774.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2557.exe
        5⤵
        
        PID:2168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38090.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61537.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4477.exe
        6⤵
        
        PID:2104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51255.exe
        6⤵
        
        PID:2152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37220.exe
        6⤵
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58816.exe
        6⤵
        
        PID:3632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59767.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16132.exe
        5⤵
        
        PID:3028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64990.exe
        5⤵
        
        PID:852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2052.exe
        5⤵
        
        PID:3440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25769.exe
        5⤵
        
        PID:3652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18822.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45624.exe
        5⤵
        
        PID:2192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63492.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64628.exe
        5⤵
        
        PID:1872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15264.exe
        5⤵
        
        PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9171.exe
        5⤵
        
        PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10661.exe
        5⤵
        
        PID:4284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53063.exe
        5⤵
        
        PID:5004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16267.exe
      4⤵
      PID:1884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19751.exe
      4⤵
      PID:2748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26426.exe
      4⤵
      PID:3676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6803.exe
      4⤵
      PID:4136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56090.exe
      4⤵
      PID:4932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44182.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44182.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57956.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19693.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23840.exe
        6⤵
        
        PID:2952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23484.exe
        6⤵
        
        PID:3300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28569.exe
        6⤵
        
        PID:3932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44023.exe
        6⤵
        
        PID:4416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55654.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52360.exe
        5⤵
        
        PID:2976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32483.exe
        5⤵
        
        PID:4004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9433.exe
        5⤵
        
        PID:3756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26414.exe
        5⤵
        
        PID:5040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24087.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65364.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44192.exe
        5⤵
        
        PID:1568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31001.exe
        6⤵
        
        PID:2472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24768.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28849.exe
        6⤵
        
        PID:3848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29555.exe
        6⤵
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36302.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19708.exe
        5⤵
        
        PID:1288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38504.exe
        5⤵
        
        PID:3372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19613.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19244.exe
        5⤵
        
        PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60032.exe
        5⤵
        
        PID:5072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51575.exe
      4⤵
      PID:2536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31390.exe
      4⤵
      PID:612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51280.exe
      4⤵
      PID:3536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26300.exe
      4⤵
      PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14357.exe
      4⤵
      PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60174.exe
      4⤵
      PID:4984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49523.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49523.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23800.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45842.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17249.exe
        6⤵
        
        PID:2836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58354.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61724.exe
        6⤵
        
        PID:3432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34435.exe
        6⤵
        
        PID:3992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35357.exe
        6⤵
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39118.exe
        6⤵
        
        PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15831.exe
        5⤵
        
        PID:3008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40657.exe
        6⤵
        
        PID:4064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32014.exe
        6⤵
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58454.exe
        6⤵
        
        PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64990.exe
        5⤵
        
        PID:2036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28192.exe
        5⤵
        
        PID:2420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46722.exe
        5⤵
        
        PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11295.exe
        5⤵
        
        PID:4564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32992.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25490.exe
        5⤵
        
        PID:2936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65116.exe
        5⤵
        
        PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45762.exe
        5⤵
        
        PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6578.exe
        5⤵
        
        PID:4112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11554.exe
        5⤵
        
        PID:4956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2037.exe
      4⤵
      PID:2016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57080.exe
      4⤵
      PID:3620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25532.exe
      4⤵
      PID:3920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55301.exe
      4⤵
      PID:4664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38471.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38471.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18344.exe
      4⤵
      PID:1852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65484.exe
        5⤵
        
        PID:784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50731.exe
        5⤵
        
        PID:3012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19674.exe
        5⤵
        
        PID:3148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37806.exe
        5⤵
        
        PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4206.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63875.exe
      4⤵
      PID:1604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13314.exe
      4⤵
      PID:996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58068.exe
      4⤵
      PID:3840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30361.exe
      4⤵
      PID:5000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39447.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39447.exe
    3⤵
    PID:2928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33836.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33836.exe
    3⤵
    PID:2784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20658.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20658.exe
    3⤵
    PID:3768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45572.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45572.exe
    3⤵
    PID:3520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62646.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62646.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39223.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39223.exe
    3⤵
    PID:4924
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15132.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15132.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52180.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52180.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17064.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43654.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49570.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32831.exe
        7⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45088.exe
        7⤵
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19430.exe
        7⤵
        
        PID:4504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30823.exe
        6⤵
        
        PID:2680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19769.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28617.exe
        6⤵
        
        PID:3816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23091.exe
        6⤵
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22193.exe
        6⤵
        
        PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17857.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61846.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58354.exe
        6⤵
        
        PID:1600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61724.exe
        6⤵
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58816.exe
        6⤵
        
        PID:3872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59767.exe
        6⤵
        
        PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38420.exe
        5⤵
        
        PID:1004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5318.exe
        5⤵
        
        PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34419.exe
        5⤵
        
        PID:3324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59346.exe
        5⤵
        
        PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55301.exe
        5⤵
        
        PID:4628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3114.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8231.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39553.exe
        6⤵
        
        PID:692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24768.exe
        6⤵
        
        PID:3244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14455.exe
        6⤵
        
        PID:804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19244.exe
        6⤵
        
        PID:4772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6062.exe
        6⤵
        
        PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45619.exe
        5⤵
        
        PID:1976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64466.exe
        5⤵
        
        PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25540.exe
        5⤵
        
        PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6273.exe
        5⤵
        
        PID:4152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59470.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21312.exe
        5⤵
        
        PID:3068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50518.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16421.exe
        5⤵
        
        PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25752.exe
        5⤵
        
        PID:1416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11295.exe
        5⤵
        
        PID:4644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27207.exe
      4⤵
      PID:2504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61453.exe
      4⤵
      PID:1608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34744.exe
      4⤵
      PID:3528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2926.exe
      4⤵
      PID:3212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63781.exe
      4⤵
      PID:4592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51575.exe
      4⤵
      PID:4488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38422.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38422.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52777.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44957.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-833.exe
        6⤵
        
        PID:4012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16744.exe
        6⤵
        
        PID:3832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13565.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53839.exe
        5⤵
        
        PID:2988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38504.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2509.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43724.exe
        5⤵
        
        PID:5096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4050.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49148.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60274.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36858.exe
        5⤵
        
        PID:3892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6273.exe
        5⤵
        
        PID:4128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52388.exe
        5⤵
        
        PID:5032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65219.exe
      4⤵
      PID:2436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19564.exe
      4⤵
      PID:860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56089.exe
      4⤵
      PID:1864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
      4⤵
      PID:4368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15302.exe
      4⤵
      PID:4376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51826.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51826.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52531.exe
      4⤵
      PID:1964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36428.exe
      4⤵
      PID:2448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38504.exe
      4⤵
      PID:3404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2509.exe
      4⤵
      PID:3180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19244.exe
      4⤵
      PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63623.exe
      4⤵
      PID:4516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18441.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18441.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5371.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5371.exe
    3⤵
    PID:1072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19168.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19168.exe
    3⤵
    PID:3332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11478.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11478.exe
    3⤵
    PID:3904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49862.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49862.exe
    3⤵
    PID:4272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47462.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47462.exe
    3⤵
    PID:5116
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5209.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5209.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32724.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32724.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49570.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20479.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29735.exe
        6⤵
        
        PID:904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40344.exe
        6⤵
        
        PID:3556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29700.exe
        6⤵
        
        PID:3308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2493.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39118.exe
        6⤵
        
        PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35473.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47466.exe
        5⤵
        
        PID:2392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35436.exe
        5⤵
        
        PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22225.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37203.exe
        5⤵
        
        PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24899.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2037.exe
      4⤵
      PID:2592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44369.exe
      4⤵
      PID:3348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10948.exe
      4⤵
      PID:1272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2709.exe
      4⤵
      PID:4552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24087.exe
      4⤵
      PID:4848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63113.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63113.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53286.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38826.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43817.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39722.exe
        6⤵
        
        PID:4056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5293.exe
        6⤵
        
        PID:4248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64319.exe
        6⤵
        
        PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11540.exe
        5⤵
        
        PID:1712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32483.exe
        5⤵
        
        PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9433.exe
        5⤵
        
        PID:3788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61671.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24087.exe
        5⤵
        
        PID:4844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19152.exe
      4⤵
      PID:2720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25275.exe
      4⤵
      PID:1684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23817.exe
      4⤵
      PID:3944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58435.exe
      4⤵
      PID:3792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43480.exe
      4⤵
      PID:5012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2557.exe
      4⤵
      PID:4760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27230.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27230.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-205.exe
      4⤵
      PID:3184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14834.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51859.exe
      4⤵
      PID:5064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35095.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35095.exe
    3⤵
    PID:3052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59516.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59516.exe
    3⤵
    PID:1168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
    3⤵
    PID:3672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1225.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1225.exe
    3⤵
    PID:4160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27403.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27403.exe
    3⤵
    PID:4852
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16798.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16798.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51822.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51822.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61303.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24004.exe
        5⤵
        
        PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
        5⤵
        
        PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38158.exe
        5⤵
        
        PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61543.exe
        5⤵
        
        PID:3752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59354.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28230.exe
      4⤵
      PID:908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49272.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5690.exe
      4⤵
      PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5582.exe
      4⤵
      PID:4336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9305.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9305.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1549.exe
      4⤵
      PID:3588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
      4⤵
      PID:3088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45558.exe
      4⤵
      PID:4676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43018.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43018.exe
    3⤵
    PID:604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40103.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40103.exe
    3⤵
    PID:1632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34419.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34419.exe
    3⤵
    PID:3296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42818.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42818.exe
    3⤵
    PID:3916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55301.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55301.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4632
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61797.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61797.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15632.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15632.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20186.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10419.exe
        5⤵
        
        PID:1996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57446.exe
        5⤵
        
        PID:1532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60240.exe
        5⤵
        
        PID:4028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30891.exe
        5⤵
        
        PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11746.exe
        5⤵
        
        PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7824.exe
      4⤵
      PID:2808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22551.exe
      4⤵
      PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51627.exe
      4⤵
      PID:3656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63450.exe
      4⤵
      PID:4196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60556.exe
      4⤵
      PID:4900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8872.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8872.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27667.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27667.exe
    3⤵
    PID:2264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57080.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57080.exe
    3⤵
    PID:3624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25340.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25340.exe
    3⤵
    PID:3200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21757.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21757.exe
    3⤵
    PID:4684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26542.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26542.exe
    3⤵
    PID:3504
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36071.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36071.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36221.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36221.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50689.exe
      4⤵
      PID:2860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63403.exe
      4⤵
      PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22751.exe
      4⤵
      PID:3804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31757.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19244.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7022.exe
      4⤵
      PID:4748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13335.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13335.exe
    3⤵
    PID:2708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41643.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41643.exe
    3⤵
    PID:2956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8108.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8108.exe
    3⤵
    PID:3152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1056.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1056.exe
    3⤵
    PID:3812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11295.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11295.exe
    3⤵
    PID:4652
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2768
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52382.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52382.exe
  2⤵
  PID:1316
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9368.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9368.exe
  2⤵
  PID:3312
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54349.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54349.exe
  2⤵
  PID:3884
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34910.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34910.exe
  2⤵
  PID:4544
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9839.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9839.exe
  2⤵
  PID:4668

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network