70f0303742ac3a744c94e17e20f77cb6c17aa019c4e7f41ea9af5445490b3883

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 11:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70f0303742ac3a744c94e17e20f77cb6c17aa019c4e7f41ea9af5445490b3883N.exe
Size

468KB
MD5

18fb1c560649699fdd10b53afbe5d030
SHA1

e1873d95888033f3a070f62ffce7c9a5efe009ab
SHA256

70f0303742ac3a744c94e17e20f77cb6c17aa019c4e7f41ea9af5445490b3883
SHA512

0a3debe9c6a56dc739c8373645ea67a1d344b4fd01358e6e5f5994009ac988a84a3822446be441e21bb080133e6607a8a56ad187343e01719bfefaf70c631989
SSDEEP

3072:FCANoSzVId5UtbY2Pzajcf8/SCMvPgpwVmHxWvs0tODP673aQ8lH:FCqoVbUtlP2jcfbcretOrQ3aQ

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2716	Unicorn-3761.exe
2944	Unicorn-43663.exe
2800	Unicorn-31965.exe
2504	Unicorn-5811.exe
2572	Unicorn-63927.exe
2640	Unicorn-18256.exe
2428	Unicorn-20293.exe
948	Unicorn-2049.exe
2880	Unicorn-16008.exe
2904	Unicorn-60570.exe
2004	Unicorn-3201.exe
1716	Unicorn-11732.exe
296	Unicorn-27249.exe
1472	Unicorn-25467.exe
712	Unicorn-27514.exe
2128	Unicorn-47607.exe
2144	Unicorn-48354.exe
1964	Unicorn-51307.exe
2168	Unicorn-64306.exe
1900	Unicorn-22527.exe
1744	Unicorn-34779.exe
868	Unicorn-16065.exe
1812	Unicorn-50413.exe
2188	Unicorn-24748.exe
1708	Unicorn-38846.exe
2108	Unicorn-49060.exe
1712	Unicorn-49060.exe
2912	Unicorn-11541.exe
2204	Unicorn-32724.exe
1816	Unicorn-32459.exe
1328	Unicorn-41254.exe
996	Unicorn-5671.exe
1752	Unicorn-10502.exe
2216	Unicorn-30368.exe
2316	Unicorn-52634.exe
1572	Unicorn-54488.exe
2788	Unicorn-10118.exe
2928	Unicorn-24193.exe
2580	Unicorn-24193.exe
2736	Unicorn-26230.exe
2884	Unicorn-4135.exe
2596	Unicorn-24001.exe
3004	Unicorn-24555.exe
2588	Unicorn-56289.exe
1252	Unicorn-43335.exe
2272	Unicorn-53549.exe
2664	Unicorn-5095.exe
592	Unicorn-24961.exe
2676	Unicorn-24961.exe
2040	Unicorn-29045.exe
1624	Unicorn-57996.exe
292	Unicorn-48816.exe
1480	Unicorn-40151.exe
1056	Unicorn-16409.exe
2008	Unicorn-40648.exe
2444	Unicorn-61141.exe
1604	Unicorn-61141.exe
1084	Unicorn-28851.exe
1160	Unicorn-48187.exe
2180	Unicorn-17561.exe
1288	Unicorn-17561.exe
2300	Unicorn-10632.exe
2916	Unicorn-31244.exe
300	Unicorn-49849.exe

Loads dropped DLL 64 IoCs

pid	Process
2152	70f0303742ac3a744c94e17e20f77cb6c17aa019c4e7f41ea9af5445490b3883N.exe
2152	70f0303742ac3a744c94e17e20f77cb6c17aa019c4e7f41ea9af5445490b3883N.exe
2716	Unicorn-3761.exe
2152	70f0303742ac3a744c94e17e20f77cb6c17aa019c4e7f41ea9af5445490b3883N.exe
2152	70f0303742ac3a744c94e17e20f77cb6c17aa019c4e7f41ea9af5445490b3883N.exe
2716	Unicorn-3761.exe
2944	Unicorn-43663.exe
2944	Unicorn-43663.exe
2716	Unicorn-3761.exe
2716	Unicorn-3761.exe
2800	Unicorn-31965.exe
2800	Unicorn-31965.exe
2152	70f0303742ac3a744c94e17e20f77cb6c17aa019c4e7f41ea9af5445490b3883N.exe
2152	70f0303742ac3a744c94e17e20f77cb6c17aa019c4e7f41ea9af5445490b3883N.exe
2640	Unicorn-18256.exe
2640	Unicorn-18256.exe
2800	Unicorn-31965.exe
2800	Unicorn-31965.exe
2428	Unicorn-20293.exe
2572	Unicorn-63927.exe
2572	Unicorn-63927.exe
2428	Unicorn-20293.exe
2944	Unicorn-43663.exe
2944	Unicorn-43663.exe
2716	Unicorn-3761.exe
2716	Unicorn-3761.exe
2152	70f0303742ac3a744c94e17e20f77cb6c17aa019c4e7f41ea9af5445490b3883N.exe
2152	70f0303742ac3a744c94e17e20f77cb6c17aa019c4e7f41ea9af5445490b3883N.exe
2504	Unicorn-5811.exe
2504	Unicorn-5811.exe
948	Unicorn-2049.exe
948	Unicorn-2049.exe
2640	Unicorn-18256.exe
2640	Unicorn-18256.exe
2904	Unicorn-60570.exe
2904	Unicorn-60570.exe
2428	Unicorn-20293.exe
2428	Unicorn-20293.exe
2004	Unicorn-3201.exe
2004	Unicorn-3201.exe
2880	Unicorn-16008.exe
2880	Unicorn-16008.exe
2572	Unicorn-63927.exe
2572	Unicorn-63927.exe
2800	Unicorn-31965.exe
2800	Unicorn-31965.exe
1716	Unicorn-11732.exe
1716	Unicorn-11732.exe
2944	Unicorn-43663.exe
2944	Unicorn-43663.exe
1472	Unicorn-25467.exe
296	Unicorn-27249.exe
1472	Unicorn-25467.exe
296	Unicorn-27249.exe
2152	70f0303742ac3a744c94e17e20f77cb6c17aa019c4e7f41ea9af5445490b3883N.exe
2152	70f0303742ac3a744c94e17e20f77cb6c17aa019c4e7f41ea9af5445490b3883N.exe
2716	Unicorn-3761.exe
2716	Unicorn-3761.exe
712	Unicorn-27514.exe
712	Unicorn-27514.exe
2504	Unicorn-5811.exe
2504	Unicorn-5811.exe
2128	Unicorn-47607.exe
2128	Unicorn-47607.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2016	2040	WerFault.exe	79

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37578.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24124.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35634.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35738.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60770.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41254.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62568.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23117.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3366.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64750.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26230.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45215.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64459.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40150.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56686.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57996.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45215.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34500.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47765.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24803.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34779.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29045.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53771.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23414.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17862.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37388.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10689.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57968.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46495.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25899.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34565.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49060.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54114.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8970.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-469.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39661.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13941.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-829.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4522.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57086.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34314.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26968.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35738.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40151.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1385.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61141.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21558.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42421.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62779.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56704.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12182.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51385.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63226.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37819.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11961.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11732.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38334.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2152	70f0303742ac3a744c94e17e20f77cb6c17aa019c4e7f41ea9af5445490b3883N.exe
2716	Unicorn-3761.exe
2944	Unicorn-43663.exe
2800	Unicorn-31965.exe
2640	Unicorn-18256.exe
2572	Unicorn-63927.exe
2428	Unicorn-20293.exe
2504	Unicorn-5811.exe
948	Unicorn-2049.exe
2880	Unicorn-16008.exe
2904	Unicorn-60570.exe
2004	Unicorn-3201.exe
1716	Unicorn-11732.exe
296	Unicorn-27249.exe
1472	Unicorn-25467.exe
712	Unicorn-27514.exe
2128	Unicorn-47607.exe
2144	Unicorn-48354.exe
1964	Unicorn-51307.exe
2168	Unicorn-64306.exe
1900	Unicorn-22527.exe
1744	Unicorn-34779.exe
868	Unicorn-16065.exe
2188	Unicorn-24748.exe
1812	Unicorn-50413.exe
1708	Unicorn-38846.exe
2108	Unicorn-49060.exe
1712	Unicorn-49060.exe
2912	Unicorn-11541.exe
2204	Unicorn-32724.exe
1816	Unicorn-32459.exe
1328	Unicorn-41254.exe
996	Unicorn-5671.exe
2216	Unicorn-30368.exe
2316	Unicorn-52634.exe
1752	Unicorn-10502.exe
1572	Unicorn-54488.exe
2788	Unicorn-10118.exe
2580	Unicorn-24193.exe
2928	Unicorn-24193.exe
2736	Unicorn-26230.exe
2596	Unicorn-24001.exe
2884	Unicorn-4135.exe
3004	Unicorn-24555.exe
2588	Unicorn-56289.exe
2272	Unicorn-53549.exe
1252	Unicorn-43335.exe
2676	Unicorn-24961.exe
592	Unicorn-24961.exe
2664	Unicorn-5095.exe
2040	Unicorn-29045.exe
1624	Unicorn-57996.exe
292	Unicorn-48816.exe
1480	Unicorn-40151.exe
1056	Unicorn-16409.exe
1288	Unicorn-17561.exe
2008	Unicorn-40648.exe
2444	Unicorn-61141.exe
1604	Unicorn-61141.exe
1084	Unicorn-28851.exe
1160	Unicorn-48187.exe
2180	Unicorn-17561.exe
2300	Unicorn-10632.exe
2916	Unicorn-31244.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2716	2152	70f0303742ac3a744c94e17e20f77cb6c17aa019c4e7f41ea9af5445490b3883N.exe	30
PID 2152 wrote to memory of 2716	2152	70f0303742ac3a744c94e17e20f77cb6c17aa019c4e7f41ea9af5445490b3883N.exe	30
PID 2152 wrote to memory of 2716	2152	70f0303742ac3a744c94e17e20f77cb6c17aa019c4e7f41ea9af5445490b3883N.exe	30
PID 2152 wrote to memory of 2716	2152	70f0303742ac3a744c94e17e20f77cb6c17aa019c4e7f41ea9af5445490b3883N.exe	30
PID 2152 wrote to memory of 2800	2152	70f0303742ac3a744c94e17e20f77cb6c17aa019c4e7f41ea9af5445490b3883N.exe	32
PID 2152 wrote to memory of 2800	2152	70f0303742ac3a744c94e17e20f77cb6c17aa019c4e7f41ea9af5445490b3883N.exe	32
PID 2152 wrote to memory of 2800	2152	70f0303742ac3a744c94e17e20f77cb6c17aa019c4e7f41ea9af5445490b3883N.exe	32
PID 2152 wrote to memory of 2800	2152	70f0303742ac3a744c94e17e20f77cb6c17aa019c4e7f41ea9af5445490b3883N.exe	32
PID 2716 wrote to memory of 2944	2716	Unicorn-3761.exe	31
PID 2716 wrote to memory of 2944	2716	Unicorn-3761.exe	31
PID 2716 wrote to memory of 2944	2716	Unicorn-3761.exe	31
PID 2716 wrote to memory of 2944	2716	Unicorn-3761.exe	31
PID 2944 wrote to memory of 2504	2944	Unicorn-43663.exe	33
PID 2944 wrote to memory of 2504	2944	Unicorn-43663.exe	33
PID 2944 wrote to memory of 2504	2944	Unicorn-43663.exe	33
PID 2944 wrote to memory of 2504	2944	Unicorn-43663.exe	33
PID 2716 wrote to memory of 2572	2716	Unicorn-3761.exe	34
PID 2716 wrote to memory of 2572	2716	Unicorn-3761.exe	34
PID 2716 wrote to memory of 2572	2716	Unicorn-3761.exe	34
PID 2716 wrote to memory of 2572	2716	Unicorn-3761.exe	34
PID 2800 wrote to memory of 2640	2800	Unicorn-31965.exe	35
PID 2800 wrote to memory of 2640	2800	Unicorn-31965.exe	35
PID 2800 wrote to memory of 2640	2800	Unicorn-31965.exe	35
PID 2800 wrote to memory of 2640	2800	Unicorn-31965.exe	35
PID 2152 wrote to memory of 2428	2152	70f0303742ac3a744c94e17e20f77cb6c17aa019c4e7f41ea9af5445490b3883N.exe	36
PID 2152 wrote to memory of 2428	2152	70f0303742ac3a744c94e17e20f77cb6c17aa019c4e7f41ea9af5445490b3883N.exe	36
PID 2152 wrote to memory of 2428	2152	70f0303742ac3a744c94e17e20f77cb6c17aa019c4e7f41ea9af5445490b3883N.exe	36
PID 2152 wrote to memory of 2428	2152	70f0303742ac3a744c94e17e20f77cb6c17aa019c4e7f41ea9af5445490b3883N.exe	36
PID 2640 wrote to memory of 948	2640	Unicorn-18256.exe	37
PID 2640 wrote to memory of 948	2640	Unicorn-18256.exe	37
PID 2640 wrote to memory of 948	2640	Unicorn-18256.exe	37
PID 2640 wrote to memory of 948	2640	Unicorn-18256.exe	37
PID 2800 wrote to memory of 2880	2800	Unicorn-31965.exe	38
PID 2800 wrote to memory of 2880	2800	Unicorn-31965.exe	38
PID 2800 wrote to memory of 2880	2800	Unicorn-31965.exe	38
PID 2800 wrote to memory of 2880	2800	Unicorn-31965.exe	38
PID 2428 wrote to memory of 2904	2428	Unicorn-20293.exe	39
PID 2428 wrote to memory of 2904	2428	Unicorn-20293.exe	39
PID 2428 wrote to memory of 2904	2428	Unicorn-20293.exe	39
PID 2428 wrote to memory of 2904	2428	Unicorn-20293.exe	39
PID 2572 wrote to memory of 2004	2572	Unicorn-63927.exe	40
PID 2572 wrote to memory of 2004	2572	Unicorn-63927.exe	40
PID 2572 wrote to memory of 2004	2572	Unicorn-63927.exe	40
PID 2572 wrote to memory of 2004	2572	Unicorn-63927.exe	40
PID 2944 wrote to memory of 1716	2944	Unicorn-43663.exe	41
PID 2944 wrote to memory of 1716	2944	Unicorn-43663.exe	41
PID 2944 wrote to memory of 1716	2944	Unicorn-43663.exe	41
PID 2944 wrote to memory of 1716	2944	Unicorn-43663.exe	41
PID 2716 wrote to memory of 1472	2716	Unicorn-3761.exe	42
PID 2716 wrote to memory of 1472	2716	Unicorn-3761.exe	42
PID 2716 wrote to memory of 1472	2716	Unicorn-3761.exe	42
PID 2716 wrote to memory of 1472	2716	Unicorn-3761.exe	42
PID 2152 wrote to memory of 296	2152	70f0303742ac3a744c94e17e20f77cb6c17aa019c4e7f41ea9af5445490b3883N.exe	43
PID 2152 wrote to memory of 296	2152	70f0303742ac3a744c94e17e20f77cb6c17aa019c4e7f41ea9af5445490b3883N.exe	43
PID 2152 wrote to memory of 296	2152	70f0303742ac3a744c94e17e20f77cb6c17aa019c4e7f41ea9af5445490b3883N.exe	43
PID 2152 wrote to memory of 296	2152	70f0303742ac3a744c94e17e20f77cb6c17aa019c4e7f41ea9af5445490b3883N.exe	43
PID 2504 wrote to memory of 712	2504	Unicorn-5811.exe	44
PID 2504 wrote to memory of 712	2504	Unicorn-5811.exe	44
PID 2504 wrote to memory of 712	2504	Unicorn-5811.exe	44
PID 2504 wrote to memory of 712	2504	Unicorn-5811.exe	44
PID 948 wrote to memory of 2128	948	Unicorn-2049.exe	45
PID 948 wrote to memory of 2128	948	Unicorn-2049.exe	45
PID 948 wrote to memory of 2128	948	Unicorn-2049.exe	45
PID 948 wrote to memory of 2128	948	Unicorn-2049.exe	45

C:\Users\Admin\AppData\Local\Temp\70f0303742ac3a744c94e17e20f77cb6c17aa019c4e7f41ea9af5445490b3883N.exe
"C:\Users\Admin\AppData\Local\Temp\70f0303742ac3a744c94e17e20f77cb6c17aa019c4e7f41ea9af5445490b3883N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3761.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3761.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43663.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43663.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5811.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27514.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32724.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17561.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45791.exe
        8⤵
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37485.exe
        8⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56914.exe
        8⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35634.exe
        8⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-469.exe
        8⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25925.exe
        7⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34692.exe
        7⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        7⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26968.exe
        7⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40150.exe
        7⤵
        
        PID:6132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31244.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32221.exe
        7⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4522.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21558.exe
        7⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64222.exe
        7⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-469.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62655.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24123.exe
        6⤵
        
        PID:3620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62806.exe
        6⤵
        
        PID:3948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47765.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36269.exe
        6⤵
        
        PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41254.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61141.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45791.exe
        7⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37485.exe
        7⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56914.exe
        7⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35634.exe
        7⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56686.exe
        7⤵
        
        PID:4124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21649.exe
        6⤵
        
        PID:484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6166.exe
        6⤵
        
        PID:4040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        6⤵
        
        PID:4612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25899.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40150.exe
        6⤵
        
        PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48187.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1774.exe
        6⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5452.exe
        7⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24803.exe
        7⤵
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18257.exe
        6⤵
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31783.exe
        6⤵
        
        PID:4236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50850.exe
        6⤵
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19203.exe
        6⤵
        
        PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56439.exe
        5⤵
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32556.exe
        6⤵
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12182.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29960.exe
        6⤵
        
        PID:1360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44404.exe
        6⤵
        
        PID:5844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35018.exe
        5⤵
        
        PID:1400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28953.exe
        5⤵
        
        PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41058.exe
        5⤵
        
        PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11732.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24748.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53549.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44665.exe
        7⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4522.exe
        7⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21558.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8970.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35738.exe
        7⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32775.exe
        6⤵
        
        PID:2652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18257.exe
        6⤵
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47844.exe
        6⤵
        
        PID:3780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62059.exe
        6⤵
        
        PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5095.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64312.exe
        6⤵
        
        PID:1756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34002.exe
        6⤵
        
        PID:580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5078.exe
        6⤵
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35738.exe
        6⤵
        
        PID:5828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65007.exe
        5⤵
        
        PID:1928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3366.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37578.exe
        5⤵
        
        PID:4384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27499.exe
        5⤵
        
        PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35685.exe
        5⤵
        
        PID:5248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38846.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16409.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5858.exe
        6⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50854.exe
        7⤵
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12032.exe
        7⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
        6⤵
        
        PID:1048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
        6⤵
        
        PID:3480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        6⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26968.exe
        6⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48318.exe
        6⤵
        
        PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36838.exe
        5⤵
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24124.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21627.exe
        6⤵
        
        PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37819.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52810.exe
        5⤵
        
        PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-829.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9364.exe
        5⤵
        
        PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61300.exe
        5⤵
        
        PID:6084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40648.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64312.exe
        5⤵
        
        PID:1820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49546.exe
        5⤵
        
        PID:2256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56914.exe
        5⤵
        
        PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34565.exe
        5⤵
        
        PID:5492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60770.exe
        5⤵
        
        PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36860.exe
      4⤵
      PID:2500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31885.exe
      4⤵
      PID:3172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41058.exe
      4⤵
      PID:4816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9403.exe
      4⤵
      PID:5996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63927.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63927.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3201.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22527.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24193.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26471.exe
        7⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10911.exe
        8⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21627.exe
        8⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40035.exe
        7⤵
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55113.exe
        7⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        7⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26968.exe
        7⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48318.exe
        7⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10689.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18888.exe
        7⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21627.exe
        7⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53771.exe
        6⤵
        
        PID:2956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56894.exe
        6⤵
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45523.exe
        6⤵
        
        PID:4848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36269.exe
        6⤵
        
        PID:5920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4135.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12760.exe
        6⤵
        
        PID:632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4522.exe
        6⤵
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25917.exe
        6⤵
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59515.exe
        6⤵
        
        PID:4568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35738.exe
        6⤵
        
        PID:5888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65007.exe
        5⤵
        
        PID:1760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60673.exe
        5⤵
        
        PID:944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37578.exe
        5⤵
        
        PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26430.exe
        5⤵
        
        PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39769.exe
        5⤵
        
        PID:5964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16065.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56289.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11613.exe
        6⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9413.exe
        7⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12513.exe
        7⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40294.exe
        7⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35738.exe
        7⤵
        
        PID:5836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31871.exe
        6⤵
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54154.exe
        6⤵
        
        PID:3356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45523.exe
        6⤵
        
        PID:4900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36269.exe
        6⤵
        
        PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38893.exe
        5⤵
        
        PID:1564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24388.exe
        6⤵
        
        PID:3656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7823.exe
        6⤵
        
        PID:3028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-988.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65351.exe
        6⤵
        
        PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58950.exe
        5⤵
        
        PID:700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30278.exe
        5⤵
        
        PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31967.exe
        5⤵
        
        PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14738.exe
        5⤵
        
        PID:5856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43335.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38334.exe
        5⤵
        
        PID:1296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4522.exe
        5⤵
        
        PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25917.exe
        5⤵
        
        PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59515.exe
        5⤵
        
        PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35738.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45526.exe
      4⤵
      PID:2672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3366.exe
      4⤵
      PID:4032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37578.exe
      4⤵
      PID:4408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23414.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35685.exe
      4⤵
      PID:5260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25467.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25467.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49060.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24961.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45791.exe
        6⤵
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20957.exe
        6⤵
        
        PID:3140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56914.exe
        6⤵
        
        PID:4180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35634.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56686.exe
        6⤵
        
        PID:1736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25925.exe
        5⤵
        
        PID:1808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51221.exe
        5⤵
        
        PID:3136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        5⤵
        
        PID:4472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26968.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48318.exe
        5⤵
        
        PID:5632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57996.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44665.exe
        5⤵
        
        PID:2628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4522.exe
        5⤵
        
        PID:3684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62674.exe
        5⤵
        
        PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46495.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35738.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9754.exe
      4⤵
      PID:576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24123.exe
      4⤵
      PID:3664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23117.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34314.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36269.exe
      4⤵
      PID:5904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32459.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32459.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29045.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2040
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 240
        5⤵
        Program crash
        
        PID:2016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11696.exe
      4⤵
      PID:3100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37578.exe
      4⤵
      PID:4416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27499.exe
      4⤵
      PID:5212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35685.exe
      4⤵
      PID:5588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40151.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40151.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11961.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59058.exe
      4⤵
      PID:3824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64750.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44404.exe
      4⤵
      PID:5880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20325.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20325.exe
    3⤵
    PID:2052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3896.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3896.exe
    3⤵
    PID:4072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45365.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45365.exe
    3⤵
    PID:4656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65101.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65101.exe
    3⤵
    PID:5448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38634.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38634.exe
    3⤵
    PID:5968
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31965.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31965.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18256.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18256.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2049.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47607.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5671.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49849.exe
        7⤵
        Executes dropped EXE
        
        PID:300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1385.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8330.exe
        8⤵
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42421.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55941.exe
        8⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34612.exe
        7⤵
        
        PID:836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6166.exe
        7⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        7⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26968.exe
        7⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40150.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31052.exe
        6⤵
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45791.exe
        7⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57968.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56914.exe
        7⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31550.exe
        7⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56686.exe
        7⤵
        
        PID:4340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39661.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12031.exe
        6⤵
        
        PID:3940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54114.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10433.exe
        6⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57216.exe
        6⤵
        
        PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10502.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6761.exe
        6⤵
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45791.exe
        7⤵
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57906.exe
        7⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56914.exe
        7⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34565.exe
        7⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60770.exe
        7⤵
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25925.exe
        6⤵
        
        PID:1688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51221.exe
        6⤵
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        6⤵
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26968.exe
        6⤵
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48318.exe
        6⤵
        
        PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37388.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24432.exe
        6⤵
        
        PID:2776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8513.exe
        6⤵
        
        PID:3464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56914.exe
        6⤵
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35634.exe
        6⤵
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56686.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64815.exe
        5⤵
        
        PID:1280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3366.exe
        5⤵
        
        PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37578.exe
        5⤵
        
        PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27499.exe
        5⤵
        
        PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35685.exe
        5⤵
        
        PID:5008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48354.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30368.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10689.exe
        6⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27482.exe
        7⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53771.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39179.exe
        6⤵
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39021.exe
        6⤵
        
        PID:4748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57216.exe
        6⤵
        
        PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28120.exe
        5⤵
        
        PID:616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60788.exe
        6⤵
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3243.exe
        7⤵
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24351.exe
        7⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64859.exe
        7⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44404.exe
        7⤵
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7171.exe
        6⤵
        
        PID:1980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51029.exe
        6⤵
        
        PID:3860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        6⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36447.exe
        6⤵
        
        PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34045.exe
        5⤵
        
        PID:1344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42413.exe
        6⤵
        
        PID:2548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20765.exe
        6⤵
        
        PID:3368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56914.exe
        6⤵
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35634.exe
        6⤵
        
        PID:4708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-469.exe
        6⤵
        
        PID:5500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43684.exe
        5⤵
        
        PID:2748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        5⤵
        
        PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37578.exe
        5⤵
        
        PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60570.exe
        5⤵
        
        PID:5788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52634.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17862.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55251.exe
        6⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5452.exe
        7⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24803.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40035.exe
        6⤵
        
        PID:2996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34500.exe
        6⤵
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        6⤵
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25899.exe
        6⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40150.exe
        6⤵
        
        PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47446.exe
        5⤵
        
        PID:1240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28016.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65124.exe
        6⤵
        
        PID:5348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        5⤵
        
        PID:680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37626.exe
        5⤵
        
        PID:3268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54114.exe
        5⤵
        
        PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9364.exe
        5⤵
        
        PID:5472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18940.exe
      4⤵
      PID:1676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50792.exe
        5⤵
        
        PID:2528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16033.exe
        5⤵
        
        PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2117.exe
        5⤵
        
        PID:5380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56150.exe
      4⤵
      PID:2512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31885.exe
      4⤵
      PID:3244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54644.exe
      4⤵
      PID:4332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5968.exe
      4⤵
      PID:5124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30350.exe
      4⤵
      PID:5564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16008.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16008.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34779.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24001.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44670.exe
        6⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52520.exe
        7⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24803.exe
        7⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45215.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51221.exe
        6⤵
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        6⤵
        
        PID:4556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26968.exe
        6⤵
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40150.exe
        6⤵
        
        PID:6116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33465.exe
        5⤵
        
        PID:1660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24956.exe
        6⤵
        
        PID:1784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18136.exe
        6⤵
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46945.exe
        6⤵
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        6⤵
        
        PID:4640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25899.exe
        6⤵
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48318.exe
        6⤵
        
        PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30885.exe
        5⤵
        
        PID:988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27482.exe
        6⤵
        
        PID:5520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57965.exe
        5⤵
        
        PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4456.exe
        5⤵
        
        PID:3812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45414.exe
        5⤵
        
        PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36269.exe
        5⤵
        
        PID:5928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24555.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43326.exe
        5⤵
        
        PID:1540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39406.exe
        6⤵
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34553.exe
        6⤵
        
        PID:3476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56914.exe
        6⤵
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35634.exe
        6⤵
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64854.exe
        6⤵
        
        PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45215.exe
        5⤵
        
        PID:2732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55305.exe
        5⤵
        
        PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9494.exe
        5⤵
        
        PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25899.exe
        5⤵
        
        PID:5428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30371.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42624.exe
        5⤵
        
        PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2498.exe
        5⤵
        
        PID:5748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64815.exe
      4⤵
      PID:2200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3366.exe
      4⤵
      PID:4008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37578.exe
      4⤵
      PID:4376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27499.exe
      4⤵
      PID:5068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35685.exe
      4⤵
      PID:5148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50413.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50413.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24961.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13445.exe
        5⤵
        
        PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4522.exe
        5⤵
        
        PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25917.exe
        5⤵
        
        PID:4224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59515.exe
        5⤵
        
        PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35738.exe
        5⤵
        
        PID:5872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25925.exe
      4⤵
      PID:2200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63226.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11969.exe
      4⤵
      PID:3800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54114.exe
      4⤵
      PID:4680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9364.exe
      4⤵
      PID:5484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48816.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48816.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41868.exe
      4⤵
      PID:2820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51385.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27808.exe
      4⤵
      PID:2088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62059.exe
      4⤵
      PID:4724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22330.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22330.exe
    3⤵
    PID:2080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64459.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64459.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23647.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23647.exe
    3⤵
    PID:4260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29849.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29849.exe
    3⤵
    PID:4688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9403.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9403.exe
    3⤵
    PID:6020
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20293.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20293.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60570.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60570.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51307.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54488.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3257.exe
        6⤵
        
        PID:2236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13808.exe
        6⤵
        
        PID:3312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45489.exe
        6⤵
        
        PID:3412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62589.exe
        6⤵
        
        PID:4776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14738.exe
        6⤵
        
        PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23652.exe
        5⤵
        
        PID:2064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45791.exe
        6⤵
        
        PID:1536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57968.exe
        6⤵
        
        PID:4056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3629.exe
        6⤵
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34565.exe
        6⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60770.exe
        6⤵
        
        PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65007.exe
        5⤵
        
        PID:2156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3366.exe
        5⤵
        
        PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37578.exe
        5⤵
        
        PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27499.exe
        5⤵
        
        PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35685.exe
        5⤵
        
        PID:5480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10118.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64898.exe
        5⤵
        
        PID:2848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30948.exe
        6⤵
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21627.exe
        6⤵
        
        PID:5660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45215.exe
        5⤵
        
        PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34692.exe
        5⤵
        
        PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43489.exe
        5⤵
        
        PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36269.exe
        5⤵
        
        PID:5944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11212.exe
      4⤵
      PID:1860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56895.exe
        5⤵
        
        PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24803.exe
        5⤵
        
        PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62568.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3366.exe
      4⤵
      PID:3980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37578.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27499.exe
      4⤵
      PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35685.exe
      4⤵
      PID:5308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64306.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64306.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24193.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36502.exe
        5⤵
        
        PID:1336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13497.exe
        6⤵
        
        PID:3440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13941.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56914.exe
        6⤵
        
        PID:4132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35634.exe
        6⤵
        
        PID:5132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56686.exe
        6⤵
        
        PID:4256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45215.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6104.exe
        5⤵
        
        PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        5⤵
        
        PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25899.exe
        5⤵
        
        PID:5412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58162.exe
      4⤵
      PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13095.exe
        5⤵
        
        PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64123.exe
        5⤵
        
        PID:4148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62441.exe
        5⤵
        
        PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44404.exe
        5⤵
        
        PID:5972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58950.exe
      4⤵
      PID:832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12031.exe
      4⤵
      PID:4016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54114.exe
      4⤵
      PID:4664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9364.exe
      4⤵
      PID:5464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61300.exe
      4⤵
      PID:6048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26230.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26230.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56704.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
      4⤵
      PID:3016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18378.exe
      4⤵
      PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57866.exe
      4⤵
      PID:4120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
    3⤵
    PID:2980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45791.exe
      4⤵
      PID:2704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34194.exe
      4⤵
      PID:3912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5187.exe
      4⤵
      PID:4836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35738.exe
      4⤵
      PID:5812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39806.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39806.exe
    3⤵
    PID:1380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3834.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3834.exe
    3⤵
    PID:3792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
    3⤵
    PID:4480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65101.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65101.exe
    3⤵
    PID:5504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42718.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42718.exe
    3⤵
    PID:5656
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27249.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27249.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49060.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49060.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17561.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8645.exe
        5⤵
        
        PID:3284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33209.exe
        5⤵
        
        PID:3416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35712.exe
        5⤵
        
        PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61167.exe
      4⤵
      PID:2536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63473.exe
      4⤵
      PID:3876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25899.exe
      4⤵
      PID:5420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44234.exe
      4⤵
      PID:6064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10632.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10632.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30555.exe
      4⤵
      PID:1632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27482.exe
        5⤵
        
        PID:5556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40035.exe
      4⤵
      PID:1644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34500.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
      4⤵
      PID:4580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26968.exe
      4⤵
      PID:5184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48318.exe
      4⤵
      PID:5200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
    3⤵
    PID:308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56220.exe
      4⤵
      PID:4796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14964.exe
      4⤵
      PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59486.exe
      4⤵
      PID:6140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59636.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59636.exe
    3⤵
    PID:1356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48229.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48229.exe
    3⤵
    PID:3832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62589.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62589.exe
    3⤵
    PID:4752
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11541.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11541.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61141.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61141.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45791.exe
      4⤵
      PID:2032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49738.exe
      4⤵
      PID:3716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56914.exe
      4⤵
      PID:4344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34565.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60770.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59142.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59142.exe
    3⤵
    PID:2544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57086.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57086.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45523.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45523.exe
    3⤵
    PID:4880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36269.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36269.exe
    3⤵
    PID:5936
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28851.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28851.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38334.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38334.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8330.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8330.exe
    3⤵
    PID:3884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42421.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42421.exe
    3⤵
    PID:5016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55941.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55941.exe
    3⤵
    PID:4520
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37391.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37391.exe
  2⤵
  PID:2460
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47902.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47902.exe
  2⤵
  PID:3952
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27778.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27778.exe
  2⤵
  PID:4452
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3764.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3764.exe
  2⤵
  PID:5340
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6814.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6814.exe
  2⤵
  PID:5392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11732.exe

Filesize
468KB

MD5
fcf10396483f21c019aff593929ad8ac

SHA1
d4f226de5f67fe7209a97bfeec1d7d5c02ae4591

SHA256
a2910d9af7802586d554e0543288cf995d14dadda26854908ae082f86b6110d6

SHA512
507094f8ff8fb4eaaef1b523909e4cc72a9d301d0523cf8d6e754a007edc15d1d1b02b8d2dfd501716f3de8628be22cb9aa8c7d585bf54397168bc86eb9d83d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1774.exe

Filesize
468KB

MD5
7ac2c510ef9c7ccf35d055c0ac932919

SHA1
05bd733b852fe452f9e9c850e6350a9ea95e4c42

SHA256
c51ae25706a6fc25a7e1903237e5fe2ead0f686d121b70fb1743f3f67b70cd88

SHA512
a7baeb1ff8d6ebb6c9b078626d9ca677cbf66e00d7b182698190cff9706ce5f3e12e9f6daf73df106c2e41a684659ddf5303647888acba28890a7f324e5c668a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27249.exe

Filesize
468KB

MD5
d2f00c7bcf791d53ea6be43545388b37

SHA1
df600dfb4f974e458b16e74c1f0724bf8d67e2b6

SHA256
e0b96a5c48e9898dc3c1c2dc15c67b9706283fc5af4c05321f985f948e483071

SHA512
e07e1976859389678db8b6e853aa23fd0118d255b677b1cc43d6a28d3ec1f6ae8a738644e499377f80ea26be46b6a6f5eb5827e376ecd5bdb2f5338dc9ea1fc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27514.exe

Filesize
468KB

MD5
a727732d940ce609cff3c02efaabf87e

SHA1
859181f4d3cc429964addb0be853d339a6c7f23d

SHA256
76f93f605f61e64a8202c52a7c2b7b75dea15184b655a06f7693dca6d0d88cff

SHA512
3f9e61653062c99d746e5c299652bf0114858675d86cab7d35551a659e6ad95371c41e7bbee0f2b9815c6f4376bfe56d599d40589f2b92efdc51dfdfbe8433c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27778.exe

Filesize
468KB

MD5
3efc89175f7736903ebb630375374d4a

SHA1
2ad8bb9282911666389862ab3d42f72c791b37bb

SHA256
7ef77a990894da56973853bce97789eaf0cca4b8a8b2f41fc896d343aa65829c

SHA512
260d45070d42f1b06ebfb53fb4862d913285bacaca531f67f00684a664ee9894b485002882323861f523f02933bc340b9c6e27228f85d9b56b8f0bf8fa4d6b7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31965.exe

Filesize
468KB

MD5
b6a3b6d5433245288115cbf32c7c8308

SHA1
88d36a873eadc73704101bfaf87046dc55a69121

SHA256
e5f0d125bcc15754bbe8aca278b88e4a32441d83d462ae8bd6ab0f3b0ae859c3

SHA512
61524cbb7a11d4052fc2153b2334dd43ea41df57c8a360285e8fd3d2811739ca0bf26da1000bf1a83f9df0f1dbd8ac6f51eece62f90b8d3fe518b2d8a48d1435

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63927.exe

Filesize
468KB

MD5
c89978f4b61c55e18df28743dea96bd8

SHA1
009d8739faa96bd601751d04aadbca01cbcbd0fd

SHA256
496f01ebf71fcd72a044afffe0021b42cc98d1892e9ff0441b12a6b6662954b0

SHA512
a04ebfed3e08e2ac859a8c4a42e0bd9c7944de985bd0dd68bb458c2e55de86a53603d33873a032b90a5238d17834c120c97ab92095bf9527e178f9a3fa1da4c7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16008.exe

Filesize
468KB

MD5
3e201a58257dea5958d35ef8b35dec0e

SHA1
8e188e0d1a97e4bc2d0f40c15e9550785df64201

SHA256
9a8d883971a2ce13dab4f8599b53ba63b5e283a6f9e164b9d97920ea4266a342

SHA512
129edb29597e129ed88da99befb06d8fc5b880eda2a37c025a9ad562bf36a7e7573c6bded9b0d0e7c5e1cdc36f29e395b89c821ee18933355ca59c7b2cc25351

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18256.exe

Filesize
468KB

MD5
50fa693b90974d459a561792cb33eecb

SHA1
1e52175ae6b51189ebcdcc087e0bb6fbab3c81c1

SHA256
e6136048c81357992ec11cd7666f6169f9a5c063b660fd8fa412fbab641e895f

SHA512
b5cb2d0faa7398a1b0092bd41140e3213126c05c03db4e1f15ad36593a932feb7e9ffe9a598821dbdbfd87c09587908e3f144c316f6a1bdd79ea1a8ed8f48ca4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20293.exe

Filesize
468KB

MD5
37a68f5ffcd905a4b1ad19a6401c29fa

SHA1
165140722c004d1524ec7bcfb36e5975e3699cbc

SHA256
6833592d3e063deb7ce3b2aee0ceed3d3a252062807d1c3309351396bb87c95b

SHA512
cd4261a16f10c6267fecc904240a53ed7a1c37f32526d97e6070917c8c36ed4efdb6eb3d1311ec88d943fe3c0f11a754a80e819a6dcbd44fcad0cdff33923889

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-2049.exe

Filesize
468KB

MD5
5cc2a36679fe1e3fbaf6db2d344abb0b

SHA1
dabb2ea0ef002c7745b9207302b431b7d3a66e0b

SHA256
2f491a58e3a11c8c640ee8251ee8b1f87a828f7a7853945104c16825322ba63c

SHA512
ee6720683ce0fc1002f2df60db78978a37d90c55a4ec6512f3dc7af5632a2e412a079802db46b8763a15062b393a0d0715e49345fc70408e7c0b4126f9e0c500

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25467.exe

Filesize
468KB

MD5
d874e297e2ff8c68bc78e474c6d03105

SHA1
58069d81920ab7f8a62da2c6d22a9db84d423671

SHA256
224036a9a6b94c3e5d006372e97ab1f6c53a8e92da2998ad0817e60b4e73cd02

SHA512
202d5c08ca22bd20896921c9358f245b849c83a838954e5e1657cc68c858a3ae319e5bd71349320ca18a683054bc270f2d5db51910e2212eee24b6e1211582fe

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3201.exe

Filesize
468KB

MD5
9dba7df57e405bdc2eadd9eb6a679aff

SHA1
9ba4238e5dc6178787cdc72c949879197f01270e

SHA256
c89294ed81d0a4e9dd849dd5bb38b6c00471344f3c897dbe30c9ca0761e52ef9

SHA512
5addec696ada95961b5bbb9b93d4656daf537cd1a702818750858bceeb7aee410341a72b0b64e42db05065e41baa4a37660e1aa5fa797f9431f885d13fc3a3a8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3761.exe

Filesize
468KB

MD5
95dc5a53b4d17b4fe820dd935e2d3847

SHA1
7bfbf9960a4b56667cbd07a105699841da788485

SHA256
03d6aa4b6cc3849ff7fd798e197415610fb1b59569df5ecc6f2b5a9b0e97c77f

SHA512
c08c4b950bd106953c120ccedaa404f6a147bb7411270674ea9def603d07c101de8ea230d309fdf0b6e933e7b46908628460cd891ab44e5cc46ef4cd6f3d09d0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43663.exe

Filesize
468KB

MD5
5c0b6294bf3650d336f1f8eada04f785

SHA1
c6c463b25565e5354f60051867beba868b232e88

SHA256
493328b7dfd47bb3e99a5b132be351872b852acbe4533e6a3c95e458378e0ace

SHA512
4865d5e69f3e11577f8df0ead828aadfae4095d863b98748320085d0182692428e5d75cc248d115d10ca0bd4a0ab626ebc6a2b26f38896534e8f57afbc0b5b98

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47607.exe

Filesize
468KB

MD5
287b0626d5ffe51f2beaf300b6f53194

SHA1
44b91f083531b0074553dfa59721d7eed9a4b985

SHA256
e91cf70ccd2d38c909fe44d359ef5c556603f8e88e551835ba5ae83ce1079232

SHA512
9bd200d112a74b1a5be636c06a25dc0ecb1946255e55a7e83793e7214c9bf12a71b07e7396936c5ea8d8d962fecbe420f8ad0d8c003c0f74f633e99ae9803fa7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-48354.exe

Filesize
468KB

MD5
65771e24e68c45b5989e0a53ef8b5ac7

SHA1
a88c282f2b4df6b287c78fcc6ed7a3ac11291390

SHA256
a2e9ebaac8b54817f78c30a29ff514730293a9618295990cf56f05cfe555f877

SHA512
92cc6c052c6fb702d46205d32319505f8e2f8643f6c1c9871b68a267f659d79b23fb71a98780df67b0b4cac4bc8f4e1e2abb1c5af8998d154737df863ad334d6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51307.exe

Filesize
468KB

MD5
1b4ed667d374f32498ed7f4962fc2e34

SHA1
e2373df1bb83c7b89502c13a12a3b115b12eeaa4

SHA256
1af244b6e7ed132acbfa89a59d6ff95ea71b2dc6124bf260bd4b5d4bceabf905

SHA512
2d5448fe0cec5ac5aae452bec44c591fe024026881fe1536cad0e5acd8791e571a2fceb791ba21df9f5f6ee3b1dc423c71249419ed5100303ac928ff49833d5a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-5811.exe

Filesize
468KB

MD5
2147cd9fe6ee4d35d70a2af9b7890783

SHA1
a8eab47ad64b968e419198f53e0419a3086b0f54

SHA256
45f754c32ad3c884436277fb42b3bf06887975229a88f54822e758f13e9c886e

SHA512
610eba348c9ea24a11199af8ea4b41a6a7b1be8db8a39139db6734156423457841c1eb3c3580f87bb48a7c862b543f9b7856bb5638303a7c13558442ec0dde0c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60570.exe

Filesize
468KB

MD5
cacc3378e5d1da3ee581107149c8d261

SHA1
8e7f2ff625b82a139779a062e9d4e61dd44c4ead

SHA256
8a8a03228032c3f0264eed9e1c7925037e6602023e473a930401d89676d2baf6

SHA512
ab925b6c93e4e7feacb985caeeab2116ab6183e3af2904687bfd7838624e440fd3bcf5a152f4bd1b901889cba0947f6388c06d75b38b1f870327a5a853e1a941

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64306.exe

Filesize
468KB

MD5
ec44c422fc7a92accf4dccb56a50b4c3

SHA1
f29d8b6da780405d2586e83bb425fc6fb893227e

SHA256
787dc128706ba5a6ef51e014742bb17539ddab9a90604250c6f3bdbd8298726d

SHA512
96425ff32226ebf3b331350a01556632e254a2a160d0dcf6a0d10bf3e9a7434de3557ba59ca7026c5f51418f5eaf2978f146d9adaf71e1282f975372a074094e

Download Submit