31a688b1552210815688aa19296672e7dff3edabc85f5407e8cd878ace1ef03e

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 11:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31a688b1552210815688aa19296672e7dff3edabc85f5407e8cd878ace1ef03eN.exe
Size

468KB
MD5

91e1280b3375846603fc198bdefc57d0
SHA1

c0186601bf5c1698ea10d0487d422f6fa31d5700
SHA256

31a688b1552210815688aa19296672e7dff3edabc85f5407e8cd878ace1ef03e
SHA512

9edf3e9dc1e700e7a47bf752be223e69ca1e2e2f9726b76f05da8c1993a28ed4aa31b44d5c82f8d055375fa42868c4a003ac9c23dfe0e1bf582abc1781fc1f3f
SSDEEP

3072:1AoXoEXvt05RFbYKH5mwvf8buCy/ZYp3nLHeoVHd78ZFXffHdLlc:1A4oQ8RFZHIwvfvk6S78LvfHd

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2964	Unicorn-18752.exe
592	Unicorn-23002.exe
2168	Unicorn-64589.exe
2188	Unicorn-13930.exe
2864	Unicorn-59047.exe
2824	Unicorn-39181.exe
2784	Unicorn-40473.exe
3012	Unicorn-45856.exe
2932	Unicorn-5570.exe
1148	Unicorn-62192.exe
2480	Unicorn-15082.exe
2460	Unicorn-26780.exe
2468	Unicorn-26780.exe
2344	Unicorn-46743.exe
2288	Unicorn-40878.exe
1856	Unicorn-29686.exe
1028	Unicorn-64257.exe
2596	Unicorn-38814.exe
1408	Unicorn-55705.exe
1004	Unicorn-14117.exe
408	Unicorn-39176.exe
2260	Unicorn-42441.exe
1176	Unicorn-38622.exe
1668	Unicorn-30454.exe
1664	Unicorn-1163.exe
1980	Unicorn-60386.exe
1484	Unicorn-51456.exe
2240	Unicorn-16016.exe
1320	Unicorn-35882.exe
1916	Unicorn-5055.exe
3036	Unicorn-1694.exe
1804	Unicorn-22669.exe
2408	Unicorn-58679.exe
2292	Unicorn-19684.exe
2092	Unicorn-54958.exe
588	Unicorn-41959.exe
792	Unicorn-56302.exe
2244	Unicorn-18607.exe
2772	Unicorn-21736.exe
2748	Unicorn-30667.exe
2676	Unicorn-23053.exe
2764	Unicorn-36789.exe
2776	Unicorn-34751.exe
2728	Unicorn-34751.exe
2628	Unicorn-26945.exe
2616	Unicorn-40266.exe
2108	Unicorn-38643.exe
2300	Unicorn-51964.exe
2952	Unicorn-53863.exe
1636	Unicorn-8191.exe
2328	Unicorn-55346.exe
2556	Unicorn-44683.exe
1732	Unicorn-24528.exe
1196	Unicorn-24528.exe
1696	Unicorn-36323.exe
1128	Unicorn-35626.exe
1372	Unicorn-61092.exe
2840	Unicorn-26181.exe
848	Unicorn-28228.exe
1924	Unicorn-32866.exe
2640	Unicorn-45716.exe
832	Unicorn-1346.exe
2340	Unicorn-62052.exe
1660	Unicorn-31225.exe

Loads dropped DLL 64 IoCs

pid	Process
2304	31a688b1552210815688aa19296672e7dff3edabc85f5407e8cd878ace1ef03eN.exe
2304	31a688b1552210815688aa19296672e7dff3edabc85f5407e8cd878ace1ef03eN.exe
2964	Unicorn-18752.exe
2964	Unicorn-18752.exe
2304	31a688b1552210815688aa19296672e7dff3edabc85f5407e8cd878ace1ef03eN.exe
2304	31a688b1552210815688aa19296672e7dff3edabc85f5407e8cd878ace1ef03eN.exe
592	Unicorn-23002.exe
592	Unicorn-23002.exe
2168	Unicorn-64589.exe
2168	Unicorn-64589.exe
2964	Unicorn-18752.exe
2304	31a688b1552210815688aa19296672e7dff3edabc85f5407e8cd878ace1ef03eN.exe
2964	Unicorn-18752.exe
2304	31a688b1552210815688aa19296672e7dff3edabc85f5407e8cd878ace1ef03eN.exe
2188	Unicorn-13930.exe
2188	Unicorn-13930.exe
592	Unicorn-23002.exe
592	Unicorn-23002.exe
2864	Unicorn-59047.exe
2864	Unicorn-59047.exe
2168	Unicorn-64589.exe
2168	Unicorn-64589.exe
2824	Unicorn-39181.exe
2784	Unicorn-40473.exe
2824	Unicorn-39181.exe
2784	Unicorn-40473.exe
2304	31a688b1552210815688aa19296672e7dff3edabc85f5407e8cd878ace1ef03eN.exe
2964	Unicorn-18752.exe
2964	Unicorn-18752.exe
2304	31a688b1552210815688aa19296672e7dff3edabc85f5407e8cd878ace1ef03eN.exe
3012	Unicorn-45856.exe
3012	Unicorn-45856.exe
2188	Unicorn-13930.exe
2188	Unicorn-13930.exe
1148	Unicorn-62192.exe
1148	Unicorn-62192.exe
2864	Unicorn-59047.exe
2864	Unicorn-59047.exe
2288	Unicorn-40878.exe
2288	Unicorn-40878.exe
2784	Unicorn-40473.exe
2784	Unicorn-40473.exe
2964	Unicorn-18752.exe
2964	Unicorn-18752.exe
2480	Unicorn-15082.exe
2480	Unicorn-15082.exe
2344	Unicorn-46743.exe
2344	Unicorn-46743.exe
2168	Unicorn-64589.exe
2168	Unicorn-64589.exe
2460	Unicorn-26780.exe
2460	Unicorn-26780.exe
2304	31a688b1552210815688aa19296672e7dff3edabc85f5407e8cd878ace1ef03eN.exe
2304	31a688b1552210815688aa19296672e7dff3edabc85f5407e8cd878ace1ef03eN.exe
2824	Unicorn-39181.exe
2824	Unicorn-39181.exe
2932	Unicorn-5570.exe
2932	Unicorn-5570.exe
592	Unicorn-23002.exe
592	Unicorn-23002.exe
1856	Unicorn-29686.exe
1856	Unicorn-29686.exe
3012	Unicorn-45856.exe
3012	Unicorn-45856.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63057.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15780.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35626.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21732.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54012.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63844.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28837.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43927.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58976.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41959.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58085.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57936.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33327.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37807.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36380.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39148.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5049.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55485.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33004.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22897.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-538.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33327.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54583.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53353.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32921.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50060.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40878.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4068.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64778.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52220.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3952.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5055.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36227.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10649.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42340.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53611.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5106.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21584.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58085.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28340.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31725.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60659.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3134.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32884.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52220.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26866.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22114.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23092.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14237.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28228.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5272.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9652.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13682.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22850.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14714.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60659.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43944.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14069.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2304	31a688b1552210815688aa19296672e7dff3edabc85f5407e8cd878ace1ef03eN.exe
2964	Unicorn-18752.exe
592	Unicorn-23002.exe
2168	Unicorn-64589.exe
2188	Unicorn-13930.exe
2864	Unicorn-59047.exe
2824	Unicorn-39181.exe
2784	Unicorn-40473.exe
3012	Unicorn-45856.exe
2932	Unicorn-5570.exe
2480	Unicorn-15082.exe
1148	Unicorn-62192.exe
2344	Unicorn-46743.exe
2460	Unicorn-26780.exe
2468	Unicorn-26780.exe
2288	Unicorn-40878.exe
1856	Unicorn-29686.exe
1028	Unicorn-64257.exe
2596	Unicorn-38814.exe
1004	Unicorn-14117.exe
1408	Unicorn-55705.exe
2260	Unicorn-42441.exe
408	Unicorn-39176.exe
1176	Unicorn-38622.exe
1668	Unicorn-30454.exe
1664	Unicorn-1163.exe
1980	Unicorn-60386.exe
1484	Unicorn-51456.exe
2240	Unicorn-16016.exe
1320	Unicorn-35882.exe
1916	Unicorn-5055.exe
3036	Unicorn-1694.exe
1804	Unicorn-22669.exe
2408	Unicorn-58679.exe
2292	Unicorn-19684.exe
2092	Unicorn-54958.exe
588	Unicorn-41959.exe
792	Unicorn-56302.exe
2244	Unicorn-18607.exe
2748	Unicorn-30667.exe
2676	Unicorn-23053.exe
2772	Unicorn-21736.exe
2764	Unicorn-36789.exe
2728	Unicorn-34751.exe
2776	Unicorn-34751.exe
2108	Unicorn-38643.exe
2628	Unicorn-26945.exe
1636	Unicorn-8191.exe
2300	Unicorn-51964.exe
2952	Unicorn-53863.exe
2616	Unicorn-40266.exe
2328	Unicorn-55346.exe
2556	Unicorn-44683.exe
1196	Unicorn-24528.exe
1732	Unicorn-24528.exe
1696	Unicorn-36323.exe
1128	Unicorn-35626.exe
2840	Unicorn-26181.exe
1372	Unicorn-61092.exe
848	Unicorn-28228.exe
1924	Unicorn-32866.exe
2640	Unicorn-45716.exe
832	Unicorn-1346.exe
2340	Unicorn-62052.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2964	2304	31a688b1552210815688aa19296672e7dff3edabc85f5407e8cd878ace1ef03eN.exe	31
PID 2304 wrote to memory of 2964	2304	31a688b1552210815688aa19296672e7dff3edabc85f5407e8cd878ace1ef03eN.exe	31
PID 2304 wrote to memory of 2964	2304	31a688b1552210815688aa19296672e7dff3edabc85f5407e8cd878ace1ef03eN.exe	31
PID 2304 wrote to memory of 2964	2304	31a688b1552210815688aa19296672e7dff3edabc85f5407e8cd878ace1ef03eN.exe	31
PID 2964 wrote to memory of 592	2964	Unicorn-18752.exe	32
PID 2964 wrote to memory of 592	2964	Unicorn-18752.exe	32
PID 2964 wrote to memory of 592	2964	Unicorn-18752.exe	32
PID 2964 wrote to memory of 592	2964	Unicorn-18752.exe	32
PID 2304 wrote to memory of 2168	2304	31a688b1552210815688aa19296672e7dff3edabc85f5407e8cd878ace1ef03eN.exe	33
PID 2304 wrote to memory of 2168	2304	31a688b1552210815688aa19296672e7dff3edabc85f5407e8cd878ace1ef03eN.exe	33
PID 2304 wrote to memory of 2168	2304	31a688b1552210815688aa19296672e7dff3edabc85f5407e8cd878ace1ef03eN.exe	33
PID 2304 wrote to memory of 2168	2304	31a688b1552210815688aa19296672e7dff3edabc85f5407e8cd878ace1ef03eN.exe	33
PID 592 wrote to memory of 2188	592	Unicorn-23002.exe	34
PID 592 wrote to memory of 2188	592	Unicorn-23002.exe	34
PID 592 wrote to memory of 2188	592	Unicorn-23002.exe	34
PID 592 wrote to memory of 2188	592	Unicorn-23002.exe	34
PID 2168 wrote to memory of 2864	2168	Unicorn-64589.exe	35
PID 2168 wrote to memory of 2864	2168	Unicorn-64589.exe	35
PID 2168 wrote to memory of 2864	2168	Unicorn-64589.exe	35
PID 2168 wrote to memory of 2864	2168	Unicorn-64589.exe	35
PID 2964 wrote to memory of 2824	2964	Unicorn-18752.exe	36
PID 2964 wrote to memory of 2824	2964	Unicorn-18752.exe	36
PID 2964 wrote to memory of 2824	2964	Unicorn-18752.exe	36
PID 2964 wrote to memory of 2824	2964	Unicorn-18752.exe	36
PID 2304 wrote to memory of 2784	2304	31a688b1552210815688aa19296672e7dff3edabc85f5407e8cd878ace1ef03eN.exe	37
PID 2304 wrote to memory of 2784	2304	31a688b1552210815688aa19296672e7dff3edabc85f5407e8cd878ace1ef03eN.exe	37
PID 2304 wrote to memory of 2784	2304	31a688b1552210815688aa19296672e7dff3edabc85f5407e8cd878ace1ef03eN.exe	37
PID 2304 wrote to memory of 2784	2304	31a688b1552210815688aa19296672e7dff3edabc85f5407e8cd878ace1ef03eN.exe	37
PID 2188 wrote to memory of 3012	2188	Unicorn-13930.exe	38
PID 2188 wrote to memory of 3012	2188	Unicorn-13930.exe	38
PID 2188 wrote to memory of 3012	2188	Unicorn-13930.exe	38
PID 2188 wrote to memory of 3012	2188	Unicorn-13930.exe	38
PID 592 wrote to memory of 2932	592	Unicorn-23002.exe	39
PID 592 wrote to memory of 2932	592	Unicorn-23002.exe	39
PID 592 wrote to memory of 2932	592	Unicorn-23002.exe	39
PID 592 wrote to memory of 2932	592	Unicorn-23002.exe	39
PID 2864 wrote to memory of 1148	2864	Unicorn-59047.exe	40
PID 2864 wrote to memory of 1148	2864	Unicorn-59047.exe	40
PID 2864 wrote to memory of 1148	2864	Unicorn-59047.exe	40
PID 2864 wrote to memory of 1148	2864	Unicorn-59047.exe	40
PID 2168 wrote to memory of 2480	2168	Unicorn-64589.exe	41
PID 2168 wrote to memory of 2480	2168	Unicorn-64589.exe	41
PID 2168 wrote to memory of 2480	2168	Unicorn-64589.exe	41
PID 2168 wrote to memory of 2480	2168	Unicorn-64589.exe	41
PID 2824 wrote to memory of 2460	2824	Unicorn-39181.exe	42
PID 2824 wrote to memory of 2460	2824	Unicorn-39181.exe	42
PID 2824 wrote to memory of 2460	2824	Unicorn-39181.exe	42
PID 2824 wrote to memory of 2460	2824	Unicorn-39181.exe	42
PID 2784 wrote to memory of 2468	2784	Unicorn-40473.exe	43
PID 2784 wrote to memory of 2468	2784	Unicorn-40473.exe	43
PID 2784 wrote to memory of 2468	2784	Unicorn-40473.exe	43
PID 2784 wrote to memory of 2468	2784	Unicorn-40473.exe	43
PID 2964 wrote to memory of 2288	2964	Unicorn-18752.exe	45
PID 2964 wrote to memory of 2288	2964	Unicorn-18752.exe	45
PID 2964 wrote to memory of 2288	2964	Unicorn-18752.exe	45
PID 2964 wrote to memory of 2288	2964	Unicorn-18752.exe	45
PID 2304 wrote to memory of 2344	2304	31a688b1552210815688aa19296672e7dff3edabc85f5407e8cd878ace1ef03eN.exe	44
PID 2304 wrote to memory of 2344	2304	31a688b1552210815688aa19296672e7dff3edabc85f5407e8cd878ace1ef03eN.exe	44
PID 2304 wrote to memory of 2344	2304	31a688b1552210815688aa19296672e7dff3edabc85f5407e8cd878ace1ef03eN.exe	44
PID 2304 wrote to memory of 2344	2304	31a688b1552210815688aa19296672e7dff3edabc85f5407e8cd878ace1ef03eN.exe	44
PID 3012 wrote to memory of 1856	3012	Unicorn-45856.exe	46
PID 3012 wrote to memory of 1856	3012	Unicorn-45856.exe	46
PID 3012 wrote to memory of 1856	3012	Unicorn-45856.exe	46
PID 3012 wrote to memory of 1856	3012	Unicorn-45856.exe	46

C:\Users\Admin\AppData\Local\Temp\31a688b1552210815688aa19296672e7dff3edabc85f5407e8cd878ace1ef03eN.exe
"C:\Users\Admin\AppData\Local\Temp\31a688b1552210815688aa19296672e7dff3edabc85f5407e8cd878ace1ef03eN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18752.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18752.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13930.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45856.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29686.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1694.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45716.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10145.exe
        9⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3134.exe
        9⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5396.exe
        9⤵
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7587.exe
        9⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30087.exe
        9⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53954.exe
        8⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58350.exe
        9⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36227.exe
        9⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2379.exe
        9⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26381.exe
        8⤵
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26866.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15642.exe
        8⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50060.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1346.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62564.exe
        8⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11360.exe
        8⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21320.exe
        8⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47840.exe
        7⤵
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21442.exe
        7⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6529.exe
        8⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13013.exe
        8⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29679.exe
        7⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63186.exe
        7⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60659.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22669.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62052.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12839.exe
        8⤵
        
        PID:852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9357.exe
        8⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53111.exe
        8⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34104.exe
        7⤵
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11493.exe
        7⤵
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9518.exe
        8⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1337.exe
        8⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43297.exe
        7⤵
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52766.exe
        7⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35273.exe
        7⤵
        
        PID:5352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31225.exe
        6⤵
        Executes dropped EXE
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62813.exe
        7⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10649.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62929.exe
        7⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5272.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62756.exe
        7⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22688.exe
        7⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33572.exe
        7⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49420.exe
        6⤵
        
        PID:3112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58466.exe
        6⤵
        
        PID:4968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18324.exe
        6⤵
        
        PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64257.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58679.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8575.exe
        7⤵
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54583.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23092.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58976.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55485.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
        7⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41931.exe
        7⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20868.exe
        7⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34351.exe
        7⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-962.exe
        6⤵
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22897.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19282.exe
        7⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54036.exe
        6⤵
        
        PID:2736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58085.exe
        6⤵
        
        PID:4064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41400.exe
        6⤵
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31303.exe
        6⤵
        
        PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19684.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12467.exe
        6⤵
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3134.exe
        7⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21732.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64956.exe
        7⤵
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42340.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6476.exe
        6⤵
        
        PID:920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
        6⤵
        
        PID:4048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41931.exe
        6⤵
        
        PID:4192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49457.exe
        6⤵
        
        PID:4620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34351.exe
        6⤵
        
        PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58663.exe
        5⤵
        
        PID:2504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36197.exe
        6⤵
        
        PID:3628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21064.exe
        6⤵
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47169.exe
        6⤵
        
        PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14069.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32884.exe
        5⤵
        
        PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33796.exe
        5⤵
        
        PID:3636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28456.exe
        5⤵
        
        PID:4660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24551.exe
        5⤵
        
        PID:5684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5570.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35882.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34751.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22625.exe
        7⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38380.exe
        7⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33327.exe
        7⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23240.exe
        7⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9217.exe
        7⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4068.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16869.exe
        6⤵
        
        PID:2732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60462.exe
        6⤵
        
        PID:3640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60759.exe
        6⤵
        
        PID:4592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50060.exe
        6⤵
        
        PID:4948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40266.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23005.exe
        6⤵
        
        PID:2960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5926.exe
        6⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32479.exe
        6⤵
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22850.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33775.exe
        6⤵
        
        PID:6112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16874.exe
        5⤵
        
        PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25527.exe
        5⤵
        
        PID:3536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3576.exe
        6⤵
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13013.exe
        6⤵
        
        PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29679.exe
        5⤵
        
        PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63186.exe
        5⤵
        
        PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60659.exe
        5⤵
        
        PID:5988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5055.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8191.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24427.exe
        6⤵
        
        PID:2856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57763.exe
        6⤵
        
        PID:1652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25816.exe
        6⤵
        
        PID:3688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
        6⤵
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30087.exe
        6⤵
        
        PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59382.exe
        5⤵
        
        PID:704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42464.exe
        5⤵
        
        PID:1440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33327.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21001.exe
        5⤵
        
        PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60659.exe
        5⤵
        
        PID:5996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44683.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8056.exe
        5⤵
        
        PID:2944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32268.exe
        6⤵
        
        PID:2552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28728.exe
        6⤵
        
        PID:2592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27461.exe
        6⤵
        
        PID:3492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30961.exe
        6⤵
        
        PID:5112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30772.exe
        6⤵
        
        PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32630.exe
        5⤵
        
        PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27471.exe
        5⤵
        
        PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33327.exe
        5⤵
        
        PID:3212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21001.exe
        5⤵
        
        PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29310.exe
        5⤵
        
        PID:6096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38548.exe
      4⤵
      PID:1620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
      4⤵
      PID:1436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49950.exe
      4⤵
      PID:3096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12265.exe
      4⤵
      PID:3776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23121.exe
      4⤵
      PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28751.exe
      4⤵
      PID:5728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39181.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39181.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26780.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60386.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38643.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48129.exe
        7⤵
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1348.exe
        8⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3134.exe
        7⤵
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31999.exe
        7⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31725.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23987.exe
        6⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2315.exe
        7⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54181.exe
        7⤵
        
        PID:4956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52605.exe
        6⤵
        
        PID:2500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24661.exe
        6⤵
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5760.exe
        6⤵
        
        PID:4124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19050.exe
        6⤵
        
        PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53863.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65267.exe
        6⤵
        
        PID:1896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33004.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28340.exe
        6⤵
        
        PID:3892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21584.exe
        6⤵
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56230.exe
        6⤵
        
        PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32961.exe
        5⤵
        
        PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52413.exe
        5⤵
        
        PID:2760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3139.exe
        5⤵
        
        PID:3880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22114.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23975.exe
        5⤵
        
        PID:6012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16016.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61092.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48599.exe
        6⤵
        
        PID:2032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38484.exe
        6⤵
        
        PID:3160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36066.exe
        6⤵
        
        PID:1796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33618.exe
        6⤵
        
        PID:5080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50887.exe
        6⤵
        
        PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34104.exe
        5⤵
        
        PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58085.exe
        5⤵
        
        PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22114.exe
        5⤵
        
        PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23975.exe
        5⤵
        
        PID:6036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26181.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26181.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27089.exe
        5⤵
        
        PID:1548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5926.exe
        5⤵
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47188.exe
        6⤵
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16984.exe
        6⤵
        
        PID:4440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3257.exe
        6⤵
        
        PID:5888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60575.exe
        5⤵
        
        PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30250.exe
        5⤵
        
        PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60129.exe
        5⤵
        
        PID:5900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22740.exe
      4⤵
      PID:2636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62564.exe
        5⤵
        
        PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15444.exe
        5⤵
        
        PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43927.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32884.exe
      4⤵
      PID:4056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33796.exe
      4⤵
      PID:2160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49553.exe
      4⤵
      PID:5436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40878.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40878.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14117.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28228.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49886.exe
        6⤵
        
        PID:1308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38484.exe
        6⤵
        
        PID:3148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36066.exe
        6⤵
        
        PID:4136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54038.exe
        6⤵
        
        PID:4812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50887.exe
        6⤵
        
        PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34104.exe
        5⤵
        
        PID:1888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58085.exe
        5⤵
        
        PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33265.exe
        5⤵
        
        PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32921.exe
        5⤵
        
        PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51417.exe
        5⤵
        
        PID:5700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32866.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54406.exe
        5⤵
        
        PID:3380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22662.exe
        5⤵
        
        PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34799.exe
        5⤵
        
        PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57118.exe
        5⤵
        
        PID:5632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43756.exe
      4⤵
      PID:1972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5106.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53493.exe
        5⤵
        
        PID:3824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14733.exe
        5⤵
        
        PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62929.exe
        5⤵
        
        PID:5872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29679.exe
      4⤵
      PID:3816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10259.exe
      4⤵
      PID:4892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30748.exe
      4⤵
      PID:5372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42441.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42441.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18607.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47478.exe
        5⤵
        
        PID:1844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46740.exe
        5⤵
        
        PID:2704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19674.exe
        5⤵
        
        PID:3668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5049.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60659.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6808.exe
      4⤵
      PID:2432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16861.exe
      4⤵
      PID:3520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4697.exe
        5⤵
        
        PID:2388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23092.exe
        5⤵
        
        PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28214.exe
        5⤵
        
        PID:5488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13144.exe
      4⤵
      PID:3680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14714.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23975.exe
      4⤵
      PID:6052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62003.exe
      4⤵
      PID:272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38484.exe
      4⤵
      PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36066.exe
      4⤵
      PID:4116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29534.exe
      4⤵
      PID:4228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50887.exe
      4⤵
      PID:5624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63076.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63076.exe
    3⤵
    PID:2492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17391.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17391.exe
    3⤵
    PID:3504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3550.exe
      4⤵
      PID:3456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45548.exe
      4⤵
      PID:4584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3858.exe
      4⤵
      PID:5024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30085.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30085.exe
    3⤵
    PID:3432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5664.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5664.exe
    3⤵
    PID:4512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50821.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50821.exe
    3⤵
    PID:5692
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64589.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64589.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59047.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59047.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62192.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38814.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41959.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58928.exe
        7⤵
        
        PID:716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58350.exe
        8⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36227.exe
        8⤵
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2379.exe
        8⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3134.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4472.exe
        7⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24308.exe
        7⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1058.exe
        7⤵
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52192.exe
        6⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23005.exe
        7⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5926.exe
        7⤵
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31257.exe
        8⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8762.exe
        8⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32479.exe
        7⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22850.exe
        7⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33775.exe
        7⤵
        
        PID:6120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-538.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25527.exe
        6⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52227.exe
        7⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58366.exe
        7⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32306.exe
        7⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29679.exe
        6⤵
        
        PID:3788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63186.exe
        6⤵
        
        PID:4316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60659.exe
        6⤵
        
        PID:5980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56302.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3780.exe
        6⤵
        
        PID:2316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3134.exe
        6⤵
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-388.exe
        6⤵
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24308.exe
        6⤵
        
        PID:4556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17259.exe
        6⤵
        
        PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41348.exe
        5⤵
        
        PID:2028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27451.exe
        6⤵
        
        PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43940.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8126.exe
        5⤵
        
        PID:3388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22825.exe
        5⤵
        
        PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63057.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55705.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30667.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43944.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24644.exe
        6⤵
        
        PID:2668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28340.exe
        6⤵
        
        PID:3352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21584.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50841.exe
        6⤵
        
        PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34550.exe
        5⤵
        
        PID:1572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58085.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22114.exe
        5⤵
        
        PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39128.exe
        5⤵
        
        PID:6024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36789.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6904.exe
        5⤵
        
        PID:2708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3134.exe
        5⤵
        
        PID:2804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28208.exe
        5⤵
        
        PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31132.exe
        5⤵
        
        PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54343.exe
        5⤵
        
        PID:4308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36380.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33804.exe
        5⤵
        
        PID:796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
        5⤵
        
        PID:3992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41931.exe
        5⤵
        
        PID:4104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24952.exe
        5⤵
        
        PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34351.exe
        5⤵
        
        PID:5792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62699.exe
      4⤵
      PID:3064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-326.exe
      4⤵
      PID:3512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11531.exe
        5⤵
        
        PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2379.exe
        5⤵
        
        PID:4616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30210.exe
      4⤵
      PID:3848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5794.exe
      4⤵
      PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3882.exe
      4⤵
      PID:5364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15082.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15082.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38622.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34751.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48220.exe
        6⤵
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58085.exe
        6⤵
        
        PID:3088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33265.exe
        6⤵
        
        PID:4168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8417.exe
        6⤵
        
        PID:4248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51417.exe
        6⤵
        
        PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41758.exe
        5⤵
        
        PID:948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54012.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23420.exe
        6⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42125.exe
        6⤵
        
        PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58085.exe
        5⤵
        
        PID:3080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33265.exe
        5⤵
        
        PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4333.exe
        5⤵
        
        PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51417.exe
        5⤵
        
        PID:5584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26945.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47478.exe
        5⤵
        
        PID:1616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39148.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
        6⤵
        
        PID:4032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41931.exe
        6⤵
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49457.exe
        6⤵
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34351.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42272.exe
        5⤵
        
        PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64778.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58350.exe
        6⤵
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36227.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3858.exe
        6⤵
        
        PID:5084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34074.exe
        5⤵
        
        PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22466.exe
        5⤵
        
        PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44496.exe
        5⤵
        
        PID:4896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12567.exe
      4⤵
      PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22735.exe
      4⤵
      PID:2308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49420.exe
      4⤵
      PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58466.exe
      4⤵
      PID:4992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9772.exe
      4⤵
      PID:5340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1163.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1163.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24528.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36645.exe
        5⤵
        
        PID:2136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39148.exe
        6⤵
        
        PID:2236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
        6⤵
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57936.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33972.exe
        6⤵
        
        PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3139.exe
        5⤵
        
        PID:2720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58085.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33265.exe
        5⤵
        
        PID:4144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28837.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20384.exe
        5⤵
        
        PID:5784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16395.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27145.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16869.exe
      4⤵
      PID:2600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58085.exe
      4⤵
      PID:4080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41400.exe
      4⤵
      PID:5004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14261.exe
      4⤵
      PID:5748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36323.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36323.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23005.exe
      4⤵
      PID:2912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5926.exe
      4⤵
      PID:3552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32479.exe
      4⤵
      PID:3676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22850.exe
      4⤵
      PID:4320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28745.exe
      4⤵
      PID:5500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40956.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40956.exe
    3⤵
    PID:1944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53611.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53611.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37733.exe
      4⤵
      PID:3820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14349.exe
      4⤵
      PID:4964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62929.exe
      4⤵
      PID:5936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22296.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22296.exe
    3⤵
    PID:2180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42965.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42965.exe
    3⤵
    PID:4836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7371.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7371.exe
    3⤵
    PID:5212
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40473.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40473.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26780.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26780.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54958.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58928.exe
        5⤵
        
        PID:2036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40052.exe
        6⤵
        
        PID:2620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19661.exe
        6⤵
        
        PID:3600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38345.exe
        6⤵
        
        PID:3844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26794.exe
        6⤵
        
        PID:5052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13682.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24078.exe
        5⤵
        
        PID:1852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63844.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33327.exe
        5⤵
        
        PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22295.exe
        5⤵
        
        PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14237.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24702.exe
      4⤵
      PID:2416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43654.exe
        5⤵
        
        PID:3624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15859.exe
        5⤵
        
        PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33017.exe
        5⤵
        
        PID:5336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22735.exe
      4⤵
      PID:2456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49420.exe
      4⤵
      PID:1552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58466.exe
      4⤵
      PID:4976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8926.exe
      4⤵
      PID:5800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39176.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39176.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51964.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44520.exe
        5⤵
        
        PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13736.exe
        5⤵
        
        PID:1472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28340.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21584.exe
        5⤵
        
        PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43593.exe
        5⤵
        
        PID:5908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65495.exe
      4⤵
      PID:2296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46548.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33327.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26379.exe
      4⤵
      PID:3780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35792.exe
      4⤵
      PID:5752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55346.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55346.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23716.exe
      4⤵
      PID:2948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9652.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27461.exe
      4⤵
      PID:3416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35045.exe
      4⤵
      PID:5104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18726.exe
      4⤵
      PID:5740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28687.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28687.exe
    3⤵
    PID:1180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32884.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32884.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33796.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33796.exe
    3⤵
    PID:940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3952.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3952.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24551.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24551.exe
    3⤵
    PID:5644
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46743.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46743.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30454.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30454.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10967.exe
      4⤵
      PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35673.exe
        5⤵
        
        PID:4388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2240.exe
        5⤵
        
        PID:4876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16869.exe
      4⤵
      PID:536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58085.exe
      4⤵
      PID:3976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33265.exe
      4⤵
      PID:4160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32921.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51417.exe
      4⤵
      PID:5128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23053.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23053.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22473.exe
      4⤵
      PID:2812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49402.exe
        5⤵
        
        PID:6140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3134.exe
      4⤵
      PID:1920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55828.exe
      4⤵
      PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33730.exe
      4⤵
      PID:4816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17686.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17686.exe
    3⤵
    PID:2852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39757.exe
      4⤵
      PID:4360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54181.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54181.exe
      4⤵
      PID:4912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22735.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22735.exe
    3⤵
    PID:1448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49420.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49420.exe
    3⤵
    PID:3120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16730.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16730.exe
    3⤵
    PID:3744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49987.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49987.exe
    3⤵
    PID:4700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29886.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29886.exe
    3⤵
    PID:5672
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51456.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51456.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24528.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24528.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53954.exe
      4⤵
      PID:2224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22297.exe
      4⤵
      PID:2420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10337.exe
      4⤵
      PID:3376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15642.exe
      4⤵
      PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37807.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27612.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27612.exe
    3⤵
    PID:1884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7374.exe
      4⤵
      PID:2992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38484.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36066.exe
      4⤵
      PID:4128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15780.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16869.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16869.exe
    3⤵
    PID:608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58085.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58085.exe
    3⤵
    PID:4016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33265.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33265.exe
    3⤵
    PID:4176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32921.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32921.exe
    3⤵
    PID:4824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51417.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51417.exe
    3⤵
    PID:5556
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35626.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35626.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6092.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6092.exe
    3⤵
    PID:1516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
    3⤵
    PID:4040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41931.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41931.exe
    3⤵
    PID:4200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49457.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49457.exe
    3⤵
    PID:4632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34351.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34351.exe
    3⤵
    PID:5820
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14604.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14604.exe
  2⤵
  PID:2648
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61398.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61398.exe
  2⤵
  PID:3576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53353.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53353.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54181.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54181.exe
    3⤵
    PID:4904
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3344.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3344.exe
  2⤵
  PID:3608
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57586.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57586.exe
  2⤵
  PID:4436
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10257.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10257.exe
  2⤵
  PID:5928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-5570.exe

Filesize
468KB

MD5
de2b84447431211ee7dbdfcc5b3d9ebf

SHA1
c2bd1ae5c1941bf1068449808c9c6072223c0f51

SHA256
6020fb27a85dcae8cd7ec05833e24fded6bf5034c7335faed558675d10fddea7

SHA512
c851cdd4a1e12fa0fceec8e724f0006e784eef7e60971f96171fc510e234c583323d9b8944f10c08723ac3c6bd9359de1ef6e49cd6b868545e1db2fad1be54e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64589.exe

Filesize
468KB

MD5
557f08ab5010b885713aeb6f2ef623c0

SHA1
cbfda3af9c7587dff63575350f7e53505392a2c8

SHA256
7e7df206e4cf329fdcd96567bf155a2dcf7d0e8ce140b360343dac3d029c5269

SHA512
514ef5135c4c28b56eade29c2f9efca5d7cc761be6da9b129690219d8bc4c0766881d43d654cbbf40cc2473e6d8e4300ca9c2405bbacbcb25968bcb30f77335b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7371.exe

Filesize
468KB

MD5
80ccd5a8eb0ecec5a529e30163b490ef

SHA1
b222b7f91f7de7a0ee437504fa4266bd910e79d4

SHA256
c2c2af87abf75162d98e3ffbb14808acd8d34cb984bbfd4a3648128e7ec68d16

SHA512
e5c8bb661ae7c5c943efe02164235b629f149de9b154accf07305bd33bfacf866e670d55ee8c77c588fc7bbf476bffb7070af0ff2a1a4a60f5fb1752b702a4f5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13930.exe

Filesize
468KB

MD5
d4475021c09a5834c754b3cc8fd7a6b3

SHA1
4c0835bfde29d8f25d99ababc40ddccc5b6536fc

SHA256
486189c1f4a09286bb2198a5fb83ac786af2e54dffab5c30b6fa4a0d8978890f

SHA512
f87b24d118f43b195c5d5d68902172ea419bcddee4de391bdf0c52ba954d3b9d5fd1963b6bc49a8f0694dadac99ad869d48e1e01ab9eeb9d6c1807be7efd1a26

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15082.exe

Filesize
468KB

MD5
edc3e1453f33291abbf158843d808c52

SHA1
2e6b2f3d70c123793ef8e7d95881415c3d847581

SHA256
847cf399dc3a036f38daa35c046517ac3d8d968e4e83e1819e463722a468071b

SHA512
f00caa8f6df81c1b68ad8324b8bd5eaebbc63ddde31b9b7d5a73eb30a7f3a1611b8b02668fb1c20970a076280e7db99b09cc45f532c01b3f229879a9feb671f2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18752.exe

Filesize
468KB

MD5
0a6e8ea8f181c649223e0b43cd452326

SHA1
00ceef20548804bbdc280ed23bfedcef1ecd378c

SHA256
0f13d223a0e9ce42e046ac669439291bb294e6045579331b2c2c521086078300

SHA512
98db8f147d2eef124e0b16b765d0390dab1cf114e4118eb94832854221370ac2184bc40ed9ba4ed89d20b501f6e4784c66215408cff787c3be0d6b66b3a877b8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe

Filesize
468KB

MD5
0d9396af4cfd930f90c0342bdf5e6115

SHA1
07b2270a0c795b7c729494b5b9a64a2e318f9a6d

SHA256
ad528fb8f435560ebb3665cc0c5c32314ec2aef379a32ccab697ec0d1ded08a4

SHA512
8da7775acb0153148884276f838880730d4926dde51af9c0d6d6a64564413ddb79162deb961446661743a801a829f330e2ab8cdd0e33fa1bdb6c47e2a9c94de2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26780.exe

Filesize
468KB

MD5
8351a9679185dd28819c9f484987753c

SHA1
0002b0dc0d929e81141d7f8f6cb2deb7c3363a42

SHA256
d229a27eebd7377de0b6302155e039b16cff71dd9481cbd994460b994a7ce603

SHA512
038446c5d876cd85aceb6d42fd20435d13f4cd7d2c1a0494276620d74acad8b54cee950ca14afc3aae1ee287f4c30506ca1183dac8ad54048d86e956a8c0ba65

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29686.exe

Filesize
468KB

MD5
dfb91eb156afe209dc7bf79c16576c8a

SHA1
36a47b16f79c90d79667b0633a747a207f0ef749

SHA256
238dd39760c04ad0fd52111ef78b0cc568034a1ac9d0e31df42c28a0a6914554

SHA512
ff6c27b57a308a507b57d9efb880f9c7e7af6b524d852311ee34cfdb9fab309dfa1adaf9eec81226d59203565126c426846831f52dc264597f2dd2bc084aefe6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38814.exe

Filesize
468KB

MD5
547edf2b4ad59afa9ed559d925daedf7

SHA1
a112c5e4371a77ec8d9b2cca39ad7ca92a764ec1

SHA256
f8cb9231c98b34f0052ae0ecee613906da9e684b03e1adac3e3614de1876b79c

SHA512
9710332e8ef800d21eb4d0d1a5b6f19355ce947cc0e2acb4199e4d312d47a9f7cf67b036d902d545a588e8628090fd7267edec5b4784f3de301d01b3e0e1234a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-39181.exe

Filesize
468KB

MD5
989ac12aca0fe6be2ef8892042f195a6

SHA1
e2164a65264d8994a872a96f60010c602ad1dd25

SHA256
6772183862d1d447193c7a50209d219ebf76dada460e300ea11edaeb7a43afe0

SHA512
3fa0d7fef26ae78765a3492fb2a67a8c2beb14d501eb7d4f3a0574706013d9123d6856b208e3e6841ce7a7f64e26cd9f54735b09efa326ec13594936dcc2d708

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40473.exe

Filesize
468KB

MD5
3b0f4e726cfbdedf5c4fbb5fc1d86e37

SHA1
76ffe52733990c1c86e7cad188a4138b9fecee61

SHA256
b25c1fd97aaf75983079e42063e6f7218117146a6177a85565538d3df616acd9

SHA512
0c43931e10e95aead885ff69062827582b5be3772514a1d11aa93cc177f5288e67089fde0a33b4496fff103060c69b3c6ae2ec101d1ed0812447574c0b6243dc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40878.exe

Filesize
468KB

MD5
7a92a2def656baac450c765216e689de

SHA1
3ab121ace3a22181bc8b49529b33a9ce1473d526

SHA256
fe03f9d7410f3fc264a2948fb0b30f4c3e2300f657cdd6228675194127917699

SHA512
ed7ff902705ac5ad0593df65e7ae7f703057d8e18c6c9fc01d31a9b3fe8477b2c56323c694e3ceae5d16bafdfbfff314b24d8861ae3180ee8c4fc42216687640

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45856.exe

Filesize
468KB

MD5
48487ba94af937a4f6aaa063b74ecdfb

SHA1
02e0c8f2b6755456843ef0a8d77a9147ec01f613

SHA256
9fd424affac30e641855042ac39a29c61774bc25fe1edaaec65506937d6bab00

SHA512
10df6e300ecbc447403e7426cfdd3fd8a99d5d32c4c6ec2a5d26f68702dbec2c64a958328cdb3b9ea199095a3237dfb4ea5c550e6a5612295a2eba08b01b30fe

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46743.exe

Filesize
468KB

MD5
5818e766de74b9953820842debc3bfb5

SHA1
70d1be6be0520c571d8ac522b7a64085338f99e2

SHA256
3dff2fab2ba04a2af8a26757cf6901658fb46d1ed8a8a6d7ebfe9b4c8db02e86

SHA512
b42f28ee620f465be830469ebbe70393875dfe802b605e4b6144b9207916786ddf9b070ec879560236bb5b545ac25327f4e6ce22bbabc8e8e13cab87d3b7d904

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59047.exe

Filesize
468KB

MD5
dac18d2fe03912ca2b23089bcee6f70e

SHA1
ba9fb776be44bad270c578c3544079aa2fd8626e

SHA256
64eb51dcdc626bd8652d5e24ddbc93ab2bca4fa695804f214a1c6a00f500f66a

SHA512
7aa1cb4d95e681d2d2f76eaa2cbefbeb5c9734e23d62ed8dd733d74a91d6c732abbec373e355fe2f717401a75d55065cd019134f0258577f7ca9225662436aac

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62192.exe

Filesize
468KB

MD5
8eef8f6c07d27f4da7a1d87284477e4a

SHA1
477c0ff58d2339d42d0f0bf82a5a49cdd7ea5a5f

SHA256
d978930bb9a8d1872341de02df92cbf8cdadcda26d96aa982cf6ce184fb4ac80

SHA512
96f6e1fb23c4a677d8506e89525a30fd3e993133cf262b1b72b3b933a056e64e7e1c1fc0ff46edc1516f8aff4a8c8776d49f474e616bcdab1c9de2cf17d46d5a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64257.exe

Filesize
468KB

MD5
63e5fd82a3adb03bd918f48c2b2b75bf

SHA1
15eb09305e5acec0da5d7b2bf2b3ea2612eede4f

SHA256
355352d2f731e33062aeace473349c69a1dac81a1d6eff28ae1b7891d4f3cefe

SHA512
06e01f1e7c43209db2ccc18abcec9ef4c25895a67f48945edd190a2227b765b4e9e071d1e565675205d0110fed5519520ed5289ca24686919d691b71bbe66272

Download Submit