733fa04179387508909219bdb2ff0456d35527ded823a7132031b5b8fd5d9e0c

Analysis

max time kernel
150s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 00:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

733fa04179387508909219bdb2ff0456d35527ded823a7132031b5b8fd5d9e0c.exe
Size

468KB
MD5

f714d4e43fb2e6e104b8ce954f391de2
SHA1

80ef339e486bc06156d0bf3c5484e9e1eb674956
SHA256

733fa04179387508909219bdb2ff0456d35527ded823a7132031b5b8fd5d9e0c
SHA512

666a4794d14369112760e55ed80056a95266340bd455079b4f250a8c6734580e4525aa0de85f44073fc44d3795d5fc6c276d5066dd2eab0a5c6bc7945f36ef39
SSDEEP

3072:mbelogxAIU57tbYbPzTfmbfp/n2TgsIHzQmyeQVZzc4ukn4AuxGlO:mb4occ7tUPvfmbfua5ec4/4Aux

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2456	Unicorn-13385.exe
2952	Unicorn-39240.exe
2992	Unicorn-2514.exe
3004	Unicorn-16301.exe
2904	Unicorn-37395.exe
2728	Unicorn-1436.exe
1804	Unicorn-39863.exe
2128	Unicorn-37435.exe
2452	Unicorn-12829.exe
1392	Unicorn-6118.exe
1032	Unicorn-17627.exe
1744	Unicorn-14017.exe
2556	Unicorn-56809.exe
1424	Unicorn-29920.exe
1732	Unicorn-14017.exe
1244	Unicorn-23440.exe
2280	Unicorn-47083.exe
2056	Unicorn-9992.exe
2336	Unicorn-46326.exe
908	Unicorn-48335.exe
1724	Unicorn-64954.exe
1868	Unicorn-24379.exe
236	Unicorn-30736.exe
396	Unicorn-39143.exe
2380	Unicorn-56029.exe
1480	Unicorn-56294.exe
1360	Unicorn-37876.exe
620	Unicorn-30379.exe
864	Unicorn-14403.exe
2616	Unicorn-34269.exe
2420	Unicorn-7735.exe
1636	Unicorn-11137.exe
1924	Unicorn-65001.exe
2692	Unicorn-48463.exe
2376	Unicorn-36175.exe
1596	Unicorn-52160.exe
2140	Unicorn-38424.exe
2588	Unicorn-58290.exe
2864	Unicorn-23065.exe
2116	Unicorn-30313.exe
2760	Unicorn-41215.exe
2736	Unicorn-46601.exe
2776	Unicorn-14006.exe
2764	Unicorn-65048.exe
2476	Unicorn-30393.exe
884	Unicorn-40472.exe
2312	Unicorn-27698.exe
2124	Unicorn-47564.exe
1252	Unicorn-3865.exe
1248	Unicorn-50756.exe
952	Unicorn-6218.exe
2720	Unicorn-29608.exe
1528	Unicorn-28531.exe
1056	Unicorn-33917.exe
1752	Unicorn-21629.exe
2636	Unicorn-15498.exe
2660	Unicorn-4901.exe
2436	Unicorn-37507.exe
1256	Unicorn-6400.exe
824	Unicorn-32423.exe
2540	Unicorn-38554.exe
2400	Unicorn-32862.exe
1200	Unicorn-27099.exe
2672	Unicorn-39273.exe

Loads dropped DLL 64 IoCs

pid	Process
2916	733fa04179387508909219bdb2ff0456d35527ded823a7132031b5b8fd5d9e0c.exe
2916	733fa04179387508909219bdb2ff0456d35527ded823a7132031b5b8fd5d9e0c.exe
2456	Unicorn-13385.exe
2456	Unicorn-13385.exe
2916	733fa04179387508909219bdb2ff0456d35527ded823a7132031b5b8fd5d9e0c.exe
2916	733fa04179387508909219bdb2ff0456d35527ded823a7132031b5b8fd5d9e0c.exe
2952	Unicorn-39240.exe
2952	Unicorn-39240.exe
2456	Unicorn-13385.exe
2456	Unicorn-13385.exe
2992	Unicorn-2514.exe
2992	Unicorn-2514.exe
2916	733fa04179387508909219bdb2ff0456d35527ded823a7132031b5b8fd5d9e0c.exe
2916	733fa04179387508909219bdb2ff0456d35527ded823a7132031b5b8fd5d9e0c.exe
3004	Unicorn-16301.exe
3004	Unicorn-16301.exe
2952	Unicorn-39240.exe
2952	Unicorn-39240.exe
2904	Unicorn-37395.exe
2904	Unicorn-37395.exe
2456	Unicorn-13385.exe
2456	Unicorn-13385.exe
2728	Unicorn-1436.exe
2916	733fa04179387508909219bdb2ff0456d35527ded823a7132031b5b8fd5d9e0c.exe
2728	Unicorn-1436.exe
2916	733fa04179387508909219bdb2ff0456d35527ded823a7132031b5b8fd5d9e0c.exe
2992	Unicorn-2514.exe
1804	Unicorn-39863.exe
2992	Unicorn-2514.exe
1804	Unicorn-39863.exe
2128	Unicorn-37435.exe
2128	Unicorn-37435.exe
3004	Unicorn-16301.exe
3004	Unicorn-16301.exe
2452	Unicorn-12829.exe
2452	Unicorn-12829.exe
2952	Unicorn-39240.exe
2952	Unicorn-39240.exe
1392	Unicorn-6118.exe
1392	Unicorn-6118.exe
2904	Unicorn-37395.exe
2904	Unicorn-37395.exe
2556	Unicorn-56809.exe
2556	Unicorn-56809.exe
2916	733fa04179387508909219bdb2ff0456d35527ded823a7132031b5b8fd5d9e0c.exe
2916	733fa04179387508909219bdb2ff0456d35527ded823a7132031b5b8fd5d9e0c.exe
1032	Unicorn-17627.exe
1032	Unicorn-17627.exe
2456	Unicorn-13385.exe
2456	Unicorn-13385.exe
1424	Unicorn-29920.exe
1424	Unicorn-29920.exe
2992	Unicorn-2514.exe
2992	Unicorn-2514.exe
1744	Unicorn-14017.exe
1744	Unicorn-14017.exe
2728	Unicorn-1436.exe
2728	Unicorn-1436.exe
1732	Unicorn-14017.exe
1732	Unicorn-14017.exe
1804	Unicorn-39863.exe
1804	Unicorn-39863.exe
1244	Unicorn-23440.exe
1244	Unicorn-23440.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17586.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-527.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29821.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50756.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36035.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32862.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48165.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35254.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16041.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22373.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5308.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-843.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16259.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7640.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25234.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10694.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47601.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34563.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63131.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21627.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33859.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32423.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44657.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15762.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43331.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29127.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37656.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56029.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49469.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60035.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63937.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54133.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30736.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51032.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45437.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41430.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6496.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29970.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30509.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14096.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36394.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2514.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26030.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35101.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19950.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31864.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41635.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55590.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14403.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45682.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37507.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2916	733fa04179387508909219bdb2ff0456d35527ded823a7132031b5b8fd5d9e0c.exe
2456	Unicorn-13385.exe
2952	Unicorn-39240.exe
2992	Unicorn-2514.exe
3004	Unicorn-16301.exe
2904	Unicorn-37395.exe
2728	Unicorn-1436.exe
1804	Unicorn-39863.exe
2128	Unicorn-37435.exe
2452	Unicorn-12829.exe
1392	Unicorn-6118.exe
1032	Unicorn-17627.exe
1744	Unicorn-14017.exe
1424	Unicorn-29920.exe
1732	Unicorn-14017.exe
2556	Unicorn-56809.exe
1244	Unicorn-23440.exe
2280	Unicorn-47083.exe
2056	Unicorn-9992.exe
2336	Unicorn-46326.exe
908	Unicorn-48335.exe
1868	Unicorn-24379.exe
236	Unicorn-30736.exe
396	Unicorn-39143.exe
1724	Unicorn-64954.exe
2380	Unicorn-56029.exe
1480	Unicorn-56294.exe
620	Unicorn-30379.exe
2616	Unicorn-34269.exe
864	Unicorn-14403.exe
2420	Unicorn-7735.exe
1360	Unicorn-37876.exe
1636	Unicorn-11137.exe
1924	Unicorn-65001.exe
2692	Unicorn-48463.exe
2376	Unicorn-36175.exe
2140	Unicorn-38424.exe
1596	Unicorn-52160.exe
2864	Unicorn-23065.exe
2588	Unicorn-58290.exe
2116	Unicorn-30313.exe
2760	Unicorn-41215.exe
2736	Unicorn-46601.exe
2776	Unicorn-14006.exe
2764	Unicorn-65048.exe
884	Unicorn-40472.exe
2476	Unicorn-30393.exe
2312	Unicorn-27698.exe
2124	Unicorn-47564.exe
1252	Unicorn-3865.exe
1248	Unicorn-50756.exe
952	Unicorn-6218.exe
2720	Unicorn-29608.exe
1528	Unicorn-28531.exe
1752	Unicorn-21629.exe
2636	Unicorn-15498.exe
1056	Unicorn-33917.exe
2660	Unicorn-4901.exe
1256	Unicorn-6400.exe
2436	Unicorn-37507.exe
2400	Unicorn-32862.exe
2540	Unicorn-38554.exe
824	Unicorn-32423.exe
1200	Unicorn-27099.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2456	2916	733fa04179387508909219bdb2ff0456d35527ded823a7132031b5b8fd5d9e0c.exe	29
PID 2916 wrote to memory of 2456	2916	733fa04179387508909219bdb2ff0456d35527ded823a7132031b5b8fd5d9e0c.exe	29
PID 2916 wrote to memory of 2456	2916	733fa04179387508909219bdb2ff0456d35527ded823a7132031b5b8fd5d9e0c.exe	29
PID 2916 wrote to memory of 2456	2916	733fa04179387508909219bdb2ff0456d35527ded823a7132031b5b8fd5d9e0c.exe	29
PID 2456 wrote to memory of 2952	2456	Unicorn-13385.exe	30
PID 2456 wrote to memory of 2952	2456	Unicorn-13385.exe	30
PID 2456 wrote to memory of 2952	2456	Unicorn-13385.exe	30
PID 2456 wrote to memory of 2952	2456	Unicorn-13385.exe	30
PID 2916 wrote to memory of 2992	2916	733fa04179387508909219bdb2ff0456d35527ded823a7132031b5b8fd5d9e0c.exe	31
PID 2916 wrote to memory of 2992	2916	733fa04179387508909219bdb2ff0456d35527ded823a7132031b5b8fd5d9e0c.exe	31
PID 2916 wrote to memory of 2992	2916	733fa04179387508909219bdb2ff0456d35527ded823a7132031b5b8fd5d9e0c.exe	31
PID 2916 wrote to memory of 2992	2916	733fa04179387508909219bdb2ff0456d35527ded823a7132031b5b8fd5d9e0c.exe	31
PID 2952 wrote to memory of 3004	2952	Unicorn-39240.exe	32
PID 2952 wrote to memory of 3004	2952	Unicorn-39240.exe	32
PID 2952 wrote to memory of 3004	2952	Unicorn-39240.exe	32
PID 2952 wrote to memory of 3004	2952	Unicorn-39240.exe	32
PID 2456 wrote to memory of 2904	2456	Unicorn-13385.exe	33
PID 2456 wrote to memory of 2904	2456	Unicorn-13385.exe	33
PID 2456 wrote to memory of 2904	2456	Unicorn-13385.exe	33
PID 2456 wrote to memory of 2904	2456	Unicorn-13385.exe	33
PID 2992 wrote to memory of 2728	2992	Unicorn-2514.exe	34
PID 2992 wrote to memory of 2728	2992	Unicorn-2514.exe	34
PID 2992 wrote to memory of 2728	2992	Unicorn-2514.exe	34
PID 2992 wrote to memory of 2728	2992	Unicorn-2514.exe	34
PID 2916 wrote to memory of 1804	2916	733fa04179387508909219bdb2ff0456d35527ded823a7132031b5b8fd5d9e0c.exe	35
PID 2916 wrote to memory of 1804	2916	733fa04179387508909219bdb2ff0456d35527ded823a7132031b5b8fd5d9e0c.exe	35
PID 2916 wrote to memory of 1804	2916	733fa04179387508909219bdb2ff0456d35527ded823a7132031b5b8fd5d9e0c.exe	35
PID 2916 wrote to memory of 1804	2916	733fa04179387508909219bdb2ff0456d35527ded823a7132031b5b8fd5d9e0c.exe	35
PID 3004 wrote to memory of 2128	3004	Unicorn-16301.exe	36
PID 3004 wrote to memory of 2128	3004	Unicorn-16301.exe	36
PID 3004 wrote to memory of 2128	3004	Unicorn-16301.exe	36
PID 3004 wrote to memory of 2128	3004	Unicorn-16301.exe	36
PID 2952 wrote to memory of 2452	2952	Unicorn-39240.exe	37
PID 2952 wrote to memory of 2452	2952	Unicorn-39240.exe	37
PID 2952 wrote to memory of 2452	2952	Unicorn-39240.exe	37
PID 2952 wrote to memory of 2452	2952	Unicorn-39240.exe	37
PID 2904 wrote to memory of 1392	2904	Unicorn-37395.exe	38
PID 2904 wrote to memory of 1392	2904	Unicorn-37395.exe	38
PID 2904 wrote to memory of 1392	2904	Unicorn-37395.exe	38
PID 2904 wrote to memory of 1392	2904	Unicorn-37395.exe	38
PID 2456 wrote to memory of 1032	2456	Unicorn-13385.exe	39
PID 2456 wrote to memory of 1032	2456	Unicorn-13385.exe	39
PID 2456 wrote to memory of 1032	2456	Unicorn-13385.exe	39
PID 2456 wrote to memory of 1032	2456	Unicorn-13385.exe	39
PID 2728 wrote to memory of 1744	2728	Unicorn-1436.exe	40
PID 2728 wrote to memory of 1744	2728	Unicorn-1436.exe	40
PID 2728 wrote to memory of 1744	2728	Unicorn-1436.exe	40
PID 2728 wrote to memory of 1744	2728	Unicorn-1436.exe	40
PID 2916 wrote to memory of 2556	2916	733fa04179387508909219bdb2ff0456d35527ded823a7132031b5b8fd5d9e0c.exe	41
PID 2916 wrote to memory of 2556	2916	733fa04179387508909219bdb2ff0456d35527ded823a7132031b5b8fd5d9e0c.exe	41
PID 2916 wrote to memory of 2556	2916	733fa04179387508909219bdb2ff0456d35527ded823a7132031b5b8fd5d9e0c.exe	41
PID 2916 wrote to memory of 2556	2916	733fa04179387508909219bdb2ff0456d35527ded823a7132031b5b8fd5d9e0c.exe	41
PID 2992 wrote to memory of 1424	2992	Unicorn-2514.exe	42
PID 2992 wrote to memory of 1424	2992	Unicorn-2514.exe	42
PID 2992 wrote to memory of 1424	2992	Unicorn-2514.exe	42
PID 2992 wrote to memory of 1424	2992	Unicorn-2514.exe	42
PID 1804 wrote to memory of 1732	1804	Unicorn-39863.exe	43
PID 1804 wrote to memory of 1732	1804	Unicorn-39863.exe	43
PID 1804 wrote to memory of 1732	1804	Unicorn-39863.exe	43
PID 1804 wrote to memory of 1732	1804	Unicorn-39863.exe	43
PID 2128 wrote to memory of 1244	2128	Unicorn-37435.exe	44
PID 2128 wrote to memory of 1244	2128	Unicorn-37435.exe	44
PID 2128 wrote to memory of 1244	2128	Unicorn-37435.exe	44
PID 2128 wrote to memory of 1244	2128	Unicorn-37435.exe	44

C:\Users\Admin\AppData\Local\Temp\733fa04179387508909219bdb2ff0456d35527ded823a7132031b5b8fd5d9e0c.exe
"C:\Users\Admin\AppData\Local\Temp\733fa04179387508909219bdb2ff0456d35527ded823a7132031b5b8fd5d9e0c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13385.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13385.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39240.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39240.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16301.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37435.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23440.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11137.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38554.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63223.exe
        9⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44755.exe
        9⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14085.exe
        9⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4479.exe
        9⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14973.exe
        8⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21627.exe
        8⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61492.exe
        8⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22373.exe
        8⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50752.exe
        8⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6400.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56544.exe
        8⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64885.exe
        8⤵
        
        PID:472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5115.exe
        8⤵
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9993.exe
        9⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52051.exe
        9⤵
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43195.exe
        9⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59856.exe
        8⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29577.exe
        8⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59782.exe
        8⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42218.exe
        7⤵
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12379.exe
        7⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43331.exe
        7⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11663.exe
        7⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25505.exe
        7⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6819.exe
        7⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65001.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
        7⤵
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61098.exe
        7⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52789.exe
        7⤵
        
        PID:3740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63966.exe
        7⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9771.exe
        7⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5584.exe
        7⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59558.exe
        6⤵
        
        PID:2296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44525.exe
        6⤵
        
        PID:752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43331.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53300.exe
        6⤵
        
        PID:4008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22373.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35467.exe
        6⤵
        
        PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47083.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36175.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49400.exe
        7⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16259.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55371.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32941.exe
        7⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21843.exe
        7⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31099.exe
        7⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36678.exe
        6⤵
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18179.exe
        6⤵
        
        PID:2352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61236.exe
        6⤵
        
        PID:3292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57023.exe
        6⤵
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5308.exe
        6⤵
        
        PID:3808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15462.exe
        6⤵
        
        PID:4400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52160.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19818.exe
        6⤵
        
        PID:2732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1254.exe
        6⤵
        
        PID:3000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15762.exe
        6⤵
        
        PID:3604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17586.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14096.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11824.exe
        6⤵
        
        PID:5856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10791.exe
        5⤵
        
        PID:1788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26030.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61964.exe
        5⤵
        
        PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35785.exe
        5⤵
        
        PID:3844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49516.exe
        5⤵
        
        PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47601.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19950.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12829.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9992.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48463.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21629.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6047.exe
        8⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32395.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62656.exe
        8⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30509.exe
        8⤵
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20459.exe
        8⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1991.exe
        7⤵
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31657.exe
        7⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34617.exe
        7⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52927.exe
        7⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5308.exe
        7⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15462.exe
        7⤵
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4901.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24085.exe
        7⤵
        
        PID:4864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50732.exe
        6⤵
        
        PID:2168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21627.exe
        6⤵
        
        PID:3676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35254.exe
        6⤵
        
        PID:3856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53982.exe
        6⤵
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8930.exe
        6⤵
        
        PID:4944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21085.exe
        6⤵
        
        PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38424.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47634.exe
        6⤵
        
        PID:1532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63131.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28004.exe
        6⤵
        
        PID:3780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9509.exe
        6⤵
        
        PID:3692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62568.exe
        6⤵
        
        PID:4504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15776.exe
        6⤵
        
        PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58453.exe
        5⤵
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9261.exe
        6⤵
        
        PID:3084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6847.exe
        6⤵
        
        PID:5044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65238.exe
        6⤵
        
        PID:4940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55728.exe
        6⤵
        
        PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45682.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1676.exe
        5⤵
        
        PID:3832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-836.exe
        5⤵
        
        PID:3916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22373.exe
        5⤵
        
        PID:5104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59468.exe
        5⤵
        
        PID:1308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46326.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58290.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10548.exe
        6⤵
        
        PID:2884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32395.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60347.exe
        6⤵
        
        PID:3940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30509.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36394.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27461.exe
        5⤵
        
        PID:2040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13272.exe
        5⤵
        
        PID:1020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61236.exe
        5⤵
        
        PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17586.exe
        5⤵
        
        PID:4140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24192.exe
        5⤵
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48165.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23065.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62792.exe
        5⤵
        
        PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42212.exe
        5⤵
        
        PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38193.exe
        5⤵
        
        PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30509.exe
        5⤵
        
        PID:4156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14932.exe
        5⤵
        
        PID:4508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20872.exe
      4⤵
      PID:1396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59474.exe
      4⤵
      PID:1548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43861.exe
      4⤵
      PID:3248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38855.exe
      4⤵
      PID:3684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61045.exe
      4⤵
      PID:4208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12136.exe
      4⤵
      PID:5220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37395.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37395.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6118.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48335.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30313.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27694.exe
        7⤵
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9296.exe
        7⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34617.exe
        7⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58547.exe
        7⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29577.exe
        7⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19394.exe
        7⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64299.exe
        6⤵
        
        PID:2428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-984.exe
        6⤵
        
        PID:1492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51996.exe
        6⤵
        
        PID:3192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59856.exe
        6⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29577.exe
        6⤵
        
        PID:4576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19394.exe
        6⤵
        
        PID:5948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41215.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52193.exe
        6⤵
        
        PID:3724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53017.exe
        6⤵
        
        PID:3372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25839.exe
        6⤵
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55590.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18554.exe
        5⤵
        
        PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2208.exe
        5⤵
        
        PID:2956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45451.exe
        5⤵
        
        PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60386.exe
        5⤵
        
        PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-843.exe
        5⤵
        
        PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57687.exe
        5⤵
        
        PID:5464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64954.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37507.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35454.exe
        6⤵
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44499.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55948.exe
        6⤵
        
        PID:3884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63442.exe
        6⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21843.exe
        6⤵
        
        PID:4240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7640.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36996.exe
        5⤵
        
        PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15762.exe
        5⤵
        
        PID:3572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63952.exe
        5⤵
        
        PID:4080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26837.exe
        5⤵
        
        PID:4768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25014.exe
        5⤵
        
        PID:5900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32423.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14608.exe
      4⤵
      PID:616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12962.exe
      4⤵
      PID:3544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25234.exe
      4⤵
      PID:2072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-843.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54133.exe
      4⤵
      PID:4264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17627.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17627.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29608.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2134.exe
        6⤵
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52799.exe
        6⤵
        
        PID:4044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44657.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12511.exe
        6⤵
        
        PID:4584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15776.exe
        6⤵
        
        PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26155.exe
        5⤵
        
        PID:1320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20420.exe
        5⤵
        
        PID:3076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44190.exe
        5⤵
        
        PID:3688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2711.exe
        5⤵
        
        PID:4600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59696.exe
        5⤵
        
        PID:5732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28531.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6351.exe
        5⤵
        
        PID:2852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2027.exe
        5⤵
        
        PID:3468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38055.exe
        5⤵
        
        PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46842.exe
        5⤵
        
        PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63937.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62328.exe
        5⤵
        
        PID:5512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45954.exe
      4⤵
      PID:1052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12962.exe
      4⤵
      PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18719.exe
      4⤵
      PID:3936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38707.exe
      4⤵
      PID:4472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42936.exe
      4⤵
      PID:4708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47042.exe
      4⤵
      PID:5552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56029.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56029.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47564.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39273.exe
        5⤵
        
        PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60545.exe
        5⤵
        
        PID:1584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15762.exe
        5⤵
        
        PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51852.exe
        5⤵
        
        PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29577.exe
        5⤵
        
        PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59782.exe
        5⤵
        
        PID:5820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62326.exe
      4⤵
      PID:1888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8743.exe
      4⤵
      PID:1328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21627.exe
      4⤵
      PID:3512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35254.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21641.exe
      4⤵
      PID:4488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64467.exe
      4⤵
      PID:4760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52377.exe
      4⤵
      PID:5580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3865.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3865.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37703.exe
      4⤵
      PID:2248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24919.exe
        5⤵
        
        PID:2036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
        5⤵
        
        PID:3812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54818.exe
        5⤵
        
        PID:3768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30509.exe
        5⤵
        
        PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14932.exe
        5⤵
        
        PID:4624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60545.exe
      4⤵
      PID:1304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15762.exe
      4⤵
      PID:3588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43920.exe
      4⤵
      PID:3992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38177.exe
      4⤵
      PID:4464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47401.exe
      4⤵
      PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8371.exe
      4⤵
      PID:5476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55923.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55923.exe
    3⤵
    PID:2584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7152.exe
      4⤵
      PID:1940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
      4⤵
      PID:3408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20386.exe
      4⤵
      PID:1756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49393.exe
      4⤵
      PID:4180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59420.exe
      4⤵
      PID:5396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30954.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30954.exe
    3⤵
    PID:1792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57498.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57498.exe
    3⤵
    PID:3552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8919.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8919.exe
    3⤵
    PID:3928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16041.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16041.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14065.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14065.exe
    3⤵
    PID:4704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5306.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5306.exe
    3⤵
    PID:5488
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2514.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2514.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1436.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1436.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14017.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30379.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50756.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49991.exe
        7⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47560.exe
        8⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30210.exe
        8⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62958.exe
        8⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55142.exe
        8⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29970.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39497.exe
        8⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27694.exe
        7⤵
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21627.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50276.exe
        7⤵
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-209.exe
        7⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63943.exe
        7⤵
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21085.exe
        7⤵
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60544.exe
        6⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
        7⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15762.exe
        7⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58941.exe
        7⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4980.exe
        7⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57402.exe
        7⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42616.exe
        7⤵
        
        PID:5352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8233.exe
        6⤵
        
        PID:796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15161.exe
        6⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49989.exe
        6⤵
        
        PID:3712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64160.exe
        6⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22373.exe
        6⤵
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15463.exe
        6⤵
        
        PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6218.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48509.exe
        6⤵
        
        PID:2092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41635.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20386.exe
        6⤵
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30509.exe
        6⤵
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14932.exe
        6⤵
        
        PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41430.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15161.exe
        5⤵
        
        PID:3168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49989.exe
        5⤵
        
        PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14435.exe
        5⤵
        
        PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22373.exe
        5⤵
        
        PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26703.exe
        5⤵
        
        PID:5188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14403.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24996.exe
        5⤵
        
        PID:2960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58329.exe
        6⤵
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39651.exe
        6⤵
        
        PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55353.exe
        5⤵
        
        PID:2008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15762.exe
        5⤵
        
        PID:3580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-202.exe
        5⤵
        
        PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26837.exe
        5⤵
        
        PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37302.exe
        5⤵
        
        PID:5848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44441.exe
      4⤵
      PID:1796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30305.exe
        5⤵
        
        PID:2968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15762.exe
        5⤵
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43920.exe
        5⤵
        
        PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18884.exe
        5⤵
        
        PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15462.exe
        5⤵
        
        PID:2668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14098.exe
      4⤵
      PID:1824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6496.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33453.exe
      4⤵
      PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59268.exe
      4⤵
      PID:4616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45437.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12631.exe
      4⤵
      PID:5612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29920.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29920.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56294.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32862.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48037.exe
        6⤵
        
        PID:2136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60864.exe
        6⤵
        
        PID:836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46131.exe
        6⤵
        
        PID:3116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12963.exe
        6⤵
        
        PID:3324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12511.exe
        6⤵
        
        PID:4536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15776.exe
        6⤵
        
        PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37250.exe
        5⤵
        
        PID:3060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16706.exe
        5⤵
        
        PID:1552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51996.exe
        5⤵
        
        PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31053.exe
        5⤵
        
        PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40985.exe
        5⤵
        
        PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12631.exe
        5⤵
        
        PID:5620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27099.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8743.exe
      4⤵
      PID:2920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49999.exe
      4⤵
      PID:4056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47416.exe
      4⤵
      PID:3964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22373.exe
      4⤵
      PID:4952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35467.exe
      4⤵
      PID:4524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37876.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37876.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51730.exe
      4⤵
      PID:980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22170.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45440.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8652.exe
      4⤵
      PID:3956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33432.exe
      4⤵
      PID:4572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52377.exe
      4⤵
      PID:5572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28386.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28386.exe
    3⤵
    PID:2552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18269.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18269.exe
    3⤵
    PID:1516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44012.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44012.exe
    3⤵
    PID:3872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29127.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29127.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-843.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-843.exe
    3⤵
    PID:4340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54133.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54133.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2508
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39863.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39863.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14017.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14017.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34269.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40472.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49469.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34563.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15762.exe
        6⤵
        
        PID:3460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17247.exe
        6⤵
        
        PID:3392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53036.exe
        6⤵
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15462.exe
        6⤵
        
        PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31864.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35906.exe
        5⤵
        
        PID:1280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45901.exe
        5⤵
        
        PID:3752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23324.exe
        5⤵
        
        PID:3400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18884.exe
        5⤵
        
        PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20989.exe
        5⤵
        
        PID:5176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27698.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39273.exe
        5⤵
        Executes dropped EXE
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47560.exe
        6⤵
        
        PID:2820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15762.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22344.exe
        6⤵
        
        PID:3376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35101.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59166.exe
        6⤵
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26975.exe
        6⤵
        
        PID:5168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60035.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21627.exe
        5⤵
        
        PID:3644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35254.exe
        5⤵
        
        PID:3892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4564.exe
        5⤵
        
        PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59468.exe
        5⤵
        
        PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3325.exe
      4⤵
      PID:1580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7238.exe
        5⤵
        
        PID:3068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4053.exe
        5⤵
        
        PID:3064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46131.exe
        5⤵
        
        PID:3160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26252.exe
        5⤵
        
        PID:4116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21843.exe
        5⤵
        
        PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31099.exe
        5⤵
        
        PID:5340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28436.exe
      4⤵
      PID:2192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30311.exe
      4⤵
      PID:936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36035.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25234.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-843.exe
      4⤵
      PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37656.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7735.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7735.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33917.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56544.exe
        5⤵
        
        PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11397.exe
        5⤵
        
        PID:316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50783.exe
        5⤵
        
        PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39393.exe
        5⤵
        
        PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62516.exe
        5⤵
        
        PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12154.exe
        5⤵
        
        PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19749.exe
      4⤵
      PID:2396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65521.exe
      4⤵
      PID:1764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51996.exe
      4⤵
      PID:3216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17586.exe
      4⤵
      PID:4132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5308.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15462.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15498.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15498.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48348.exe
      4⤵
      PID:3040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58316.exe
      4⤵
      PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55371.exe
      4⤵
      PID:3304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43641.exe
      4⤵
      PID:4840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45902.exe
      4⤵
      PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33685.exe
      4⤵
      PID:5640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14098.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14098.exe
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61964.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61964.exe
    3⤵
    PID:3652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35785.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35785.exe
    3⤵
    PID:3852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17176.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17176.exe
    3⤵
    PID:4444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37601.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37601.exe
    3⤵
    PID:4796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51242.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51242.exe
    3⤵
    PID:5436
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56809.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56809.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24379.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24379.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65048.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15192.exe
        5⤵
        
        PID:1652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32395.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7098.exe
        5⤵
        
        PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30509.exe
        5⤵
        
        PID:432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56468.exe
        5⤵
        
        PID:4916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27694.exe
      4⤵
      PID:1036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21627.exe
      4⤵
      PID:3504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10837.exe
      4⤵
      PID:4512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29821.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36925.exe
      4⤵
      PID:5408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30393.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30393.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32736.exe
      4⤵
      PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24353.exe
      4⤵
      PID:5676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8233.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8233.exe
    3⤵
    PID:3020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12962.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12962.exe
    3⤵
    PID:3536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62680.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62680.exe
    3⤵
    PID:3384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35632.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35632.exe
    3⤵
    PID:4216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49604.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49604.exe
    3⤵
    PID:5060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20589.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20589.exe
    3⤵
    PID:5200
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30736.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30736.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46601.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46601.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33688.exe
      4⤵
      PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47560.exe
        5⤵
        
        PID:1128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61098.exe
        5⤵
        
        PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28751.exe
        5⤵
        
        PID:3788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23824.exe
        5⤵
        
        PID:4284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12511.exe
        5⤵
        
        PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40925.exe
        5⤵
        
        PID:5928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26155.exe
      4⤵
      PID:2276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21627.exe
      4⤵
      PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13678.exe
      4⤵
      PID:3424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18566.exe
      4⤵
      PID:4184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10694.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5444.exe
      4⤵
      PID:5124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59358.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59358.exe
    3⤵
    PID:2892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47060.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47060.exe
    3⤵
    PID:2348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21627.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21627.exe
    3⤵
    PID:3520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35254.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35254.exe
    3⤵
    PID:3864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56821.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56821.exe
    3⤵
    PID:5056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24251.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24251.exe
    3⤵
    PID:6016
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14006.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14006.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13140.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13140.exe
    3⤵
    PID:696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15762.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15762.exe
    3⤵
    PID:3596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43920.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43920.exe
    3⤵
    PID:4032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-527.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-527.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29586.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29586.exe
    3⤵
    PID:6032
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39160.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39160.exe
  2⤵
  PID:2120
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51032.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51032.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3152
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23653.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23653.exe
  2⤵
  PID:2604
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58560.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58560.exe
  2⤵
  PID:4272
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37509.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37509.exe
  2⤵
  PID:4192
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33859.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33859.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-14608.exe

Filesize
468KB

MD5
e27a9a6b1c0ded35570cab01313f5f1e

SHA1
28f2f3403f1cf37d60d6f0bb862ccd709824c4e6

SHA256
14a9c999a032233861d668e948a20f7e62e4a63840fa21630413594e806c3978

SHA512
0d6cc11a306525df36bf9e28732e7edf53293fc7832f6468b56fa6084cbbbd1866d5077854f99336f0c5d35c002e968622ca38fa25f9623d6df36ae715d023da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29920.exe

Filesize
468KB

MD5
995ffe0376bd4818d429af7bdf082354

SHA1
3ce678a3ebb89f625092d5780472d78c6bb73f67

SHA256
925317b43110804489e9076078f6e6e8113102a4d8ce611afaa062b4827001cc

SHA512
977d5de44042e53c9c77034e6451377d3d3a797bf03223ed31c87b3ae011248356e8650937ad3448e50534c3b9a87a073864f05ee5173a366950c698c39a2fb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6118.exe

Filesize
468KB

MD5
9583038c6f52f3a7f1714c04c7010e5f

SHA1
19e85c2d8b57f92ddc1da411bd60e5484173be0c

SHA256
47399065fdf5b0dc871cdc1d36181088a932c5e62087c0ccdef76ff7d51004a0

SHA512
c7dfbe70e0b0f550903797d31e5a7ef5fd6bc9b5010199d85ad3c2b549428c8acf742e58fe10dd14d77eebbe9ccb18ec98e7866d2aff43b8862e37680e1a9269

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12829.exe

Filesize
468KB

MD5
95ab70e7adc800e631391ec74b5f6dc6

SHA1
788591fb2bbab18a3f2a7e7910b80a31dd13f647

SHA256
bb9e11c42e05187f1fdec00ba49899cdb992f706e0a8b32e9d0b64b19a29545e

SHA512
77e7cfde5d2fd93008b04c0f316ef88c85b4fb1d6862461a805fdafd724e92cc31ac93204fb37391d2732e95e791563235be9aa2e41314703a4afcdd18495352

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13385.exe

Filesize
468KB

MD5
e7d8c018d419e51f0609f0c282b50fe3

SHA1
9d9f365599681ebb3e36eff431a6e3d2e8496238

SHA256
0e84081d584531bf85f7afe4a92401f77b5574b267cdc8b5552517b473ab4c5c

SHA512
77291d4c745fe985c88c7229696a059ad27aa698df2ca6a600dfb165e065a6ce233799e7720d75231fb6c79c4cc8882e7f9f3070f34c8caa3a73f6ffc73641ef

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14017.exe

Filesize
468KB

MD5
47b0e67d2366e60ceb5fab5bd50f2fdd

SHA1
fbded9ef3983503917031e065a847254caf179cf

SHA256
5f06cb779a01044bbf48e8ce7605abad82d248c33d1d0d417b7cf1d3273a221f

SHA512
b0bbd4e21d91b8524b6f221261d01fae16753443905407c0592e6ea7ff15edb27427caf1fd3ce40c4451fa4aa357cf0702f7dd758d52b9adb011e59209bbf508

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1436.exe

Filesize
468KB

MD5
da9365737e2df678e9e8119fe8b088bc

SHA1
3d5a96ab3f0a0b0ad903d2ae4545edae161bed96

SHA256
5fa06bbe0a5ca0d067ec2e66404f77dd2b02fa758c89e683cb9866d4a0a3e603

SHA512
7c5ebf9d5c20c58f22ecd0ca3b8c8275dd3356a1276271acded661082137d9f7d51c19f7c2ab641dde454147f4e9794b776ee4fd11aa8c9b592af2b9c13bdf09

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16301.exe

Filesize
468KB

MD5
03631d79abc468238f025b53d26b055e

SHA1
75cdf5a85f0de454d3231146379c01726482bca2

SHA256
8ece5c2ad3d8f67b1df4d11f94c7330ea6595cd08b4a61f98f88a68addafe889

SHA512
b1c98abf39ca6adef0f87529c4393dd7ccadd82e43f40bcbb7d6adc30032b09ff32d2a07baa0f5dc182460442b155335d585f5bfbe174dbc73d2b83fbdb017e8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17627.exe

Filesize
468KB

MD5
ad4af561d681de2ebded5204c8bb1460

SHA1
fc75fabdadc3f0ba1cbb078a7feb993c87e88033

SHA256
98f0806dc828f9937e65bca8fe08dc861b4b052da546401af3e92f260667882c

SHA512
093334ac653abfe6c875b23d5f11436ca87b38c5ebbc7410fc7a1991b4dbfd5b98db21ce5804dee7a3106b16419e3316423899d44e93e3f66c301c5d5098f0bf

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23440.exe

Filesize
468KB

MD5
fd6159a7e3776c1cd4272917a5412b6a

SHA1
16f4ae467ca58a8edc2977319dfee926d07b52fc

SHA256
fb87a3d58dc854420437f3ac278afb95630723e5e316e012a2ba05ae62e7d845

SHA512
0d7c2b89b1688786a0149f5659699637a5aae1b9786b589b7f1f8a14fe66086a8c6df379751da080fd6f74c796f01d067ddbdb4ed049f133addc23ed95bb257f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-2514.exe

Filesize
468KB

MD5
b1c766952810d6313364b5da4e77461a

SHA1
e4abc9586cc449d3d4919fb73c09a8cadc51fd1c

SHA256
f4f2cac6dfcc1e77b4898d250b632334fdcf6c1d7efca4e37547d9bc070eb3ad

SHA512
e60523372e0ae2266587b6a3f529739d875d95a6218425390c3149ac0801996641bbe2b69275cca81c6ed108f1baf3016660702925f12e45f480b1eaa629c26f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37395.exe

Filesize
468KB

MD5
5f24aa2f5a60c7e626a8aab95d3a7570

SHA1
98410e2cfb321d234d32b177ac79317e44920a12

SHA256
0f5a3438a007f7c7b77e1097b220d080414257041d97c9a16e1325e55d41d360

SHA512
fbe3c6200a8205bfa189274d10273bded79eb659dd8fd5f5a8d344b9f5c614e72570f4ff31edd0f36e28a1c6692c771969cd756ff2e5b382ff2307b11bff8bf7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37435.exe

Filesize
468KB

MD5
46e83fca57af5e9180a72359aa67fd10

SHA1
794d8f0596ae818a82d62370bc9a190ef85e78e7

SHA256
bb30ed7f043bf96dc2b362a102c08567d3eb190264e3aa5d686d6d84d70fc54f

SHA512
8106e8ea38a900286e15b49d6c66f27835247939095d5a33455e3f99115706297185944f4997131bf11aa49da848ad6c00cd066954c92a90a81ea5cda6c153cc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-39240.exe

Filesize
468KB

MD5
c8fdf0fc5c4b9eb4dc202563bd6f86d4

SHA1
af55ef3dc24b9d76e5998923f52a4a4520d7cbfd

SHA256
0cd10b4dc234a1f41a287c61f06d5ba599aa7186831981193be328d4763e140e

SHA512
bdc4337aa1fb6f6d66a9e23f577406b46e938be57fd35de78c4f5b18113f77bccbe4e310fc2bde2814a80d63e57ff6ef5851ec44cf2f796c43d8e74d0cff3eea

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-39863.exe

Filesize
468KB

MD5
04074f516d75a590b8a195830e37f06c

SHA1
28a383850f355d9a310c8219cdd5838f2deac577

SHA256
85a60c0d11b33245a12ae30aed8b2a9709ab8f787fc0bd3e029c94fbe3a7d28c

SHA512
4b08b2b0b7531395c07e6f3457a432e408cfcfdf8b9c703946435c6edb0655cbfc369f753cef0c748f9dd256954975b84c9a2b2e45361d18b24fc194b6a7e386

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47083.exe

Filesize
468KB

MD5
c6c3aab001f14b1f8c3a329e0abc32fd

SHA1
33260f604338c81bcab44bd1752591cf93aa4393

SHA256
e43df5bd20c4cceda2680f1db077063f100d46dab977bcf5db05c395a22c18bd

SHA512
1bb53501b32aede7d12cb057233a0617804042e92199bb07c3f4175600278206142a617825aa0b7ebc362dc5e306a3a66e78adafab61f3432b4afe7a38f9bd93

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56809.exe

Filesize
468KB

MD5
3a35754a3739d1fd5cbaf27675b13a83

SHA1
8f80c9a55eee9d4b63a6601f8384f6d9eb6dfb9b

SHA256
a25edde3faf0dc4804f8be5dbaf76f33e97b8d1de9018db5359c7a08e6eed5c5

SHA512
ad1cc7120e9ef87d2fc221c5b517dca5ffcb15047a996f89f69bcc6de60876033f41dea079474cd4864bf0a52a27a815a7281bf96e2728cb581459d5712388cd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9992.exe

Filesize
468KB

MD5
fc4d107ab93e547ff6573e995cfd16ee

SHA1
8fc55060316884f7e891a859a3b70e262dff526a

SHA256
15d5e5dc810490900ffa3e02c085bfbd4f4aa56837b44de9cf3d67cbe822c335

SHA512
717d12e9f857b7dcf4c60796543ebd49063ffc97ba632dbe8e3e7dc008a9f586c6c8a0e5a46b3d6939ff3dbaa40bbde240fa0e6c9ffc425c9fe41d3a87e950ee

Download Submit