1f96d163bb804ff30dcc65872dba193102d4627d100df37c7e83bee2d5b7fea8

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 07:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f96d163bb804ff30dcc65872dba193102d4627d100df37c7e83bee2d5b7fea8N.exe
Size

468KB
MD5

7d0624cda9e22dd8c58f92512ca78920
SHA1

ccdd0d89020be7d1dec4aba5ca0ab316a8fb6f79
SHA256

1f96d163bb804ff30dcc65872dba193102d4627d100df37c7e83bee2d5b7fea8
SHA512

b3c28e7dd30b5ea915fe2a51863d723c8aa372e4c33714167ae8dfe8520b9246728ff5119bf28e8e4aa3198f49a8d265f5e02f8805ece61c5f3a2e10c9e7026d
SSDEEP

3072:1bACogIdj05U4AYJP0Njff8/ECYFtIpxnmHexVpAhAd3ApZVRGlS:1b1or8U4fPojffh0n2hA9EZVR

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2272	Unicorn-62801.exe
2332	Unicorn-29033.exe
2348	Unicorn-57067.exe
2660	Unicorn-45028.exe
2716	Unicorn-62988.exe
2980	Unicorn-34037.exe
2864	Unicorn-55426.exe
2568	Unicorn-52158.exe
2156	Unicorn-3149.exe
3048	Unicorn-48821.exe
2848	Unicorn-41790.exe
1108	Unicorn-35660.exe
1144	Unicorn-49958.exe
780	Unicorn-49693.exe
2184	Unicorn-22308.exe
2928	Unicorn-38256.exe
3028	Unicorn-34041.exe
2448	Unicorn-63803.exe
2088	Unicorn-16640.exe
2096	Unicorn-64187.exe
300	Unicorn-11649.exe
1096	Unicorn-22003.exe
880	Unicorn-22003.exe
1372	Unicorn-35193.exe
1748	Unicorn-51530.exe
1056	Unicorn-25210.exe
1680	Unicorn-63154.exe
2548	Unicorn-25210.exe
1384	Unicorn-17234.exe
560	Unicorn-40761.exe
1064	Unicorn-54681.exe
2216	Unicorn-41733.exe
2344	Unicorn-25589.exe
2416	Unicorn-13891.exe
1576	Unicorn-27818.exe
1584	Unicorn-20820.exe
2504	Unicorn-4763.exe
2376	Unicorn-24629.exe
2964	Unicorn-35547.exe
2488	Unicorn-49133.exe
2852	Unicorn-65339.exe
2700	Unicorn-52340.exe
2160	Unicorn-46402.exe
2920	Unicorn-30140.exe
2584	Unicorn-22164.exe
2616	Unicorn-2298.exe
2800	Unicorn-5754.exe
1264	Unicorn-6019.exe
1316	Unicorn-63388.exe
2620	Unicorn-13118.exe
2628	Unicorn-13118.exe
596	Unicorn-55914.exe
1412	Unicorn-60405.exe
1804	Unicorn-52038.exe
2932	Unicorn-45023.exe
2284	Unicorn-45023.exe
2904	Unicorn-25157.exe
1640	Unicorn-8629.exe
2956	Unicorn-3990.exe
2944	Unicorn-36855.exe
2952	Unicorn-22957.exe
1664	Unicorn-14789.exe
2068	Unicorn-4020.exe
916	Unicorn-55542.exe

Loads dropped DLL 64 IoCs

pid	Process
1972	1f96d163bb804ff30dcc65872dba193102d4627d100df37c7e83bee2d5b7fea8N.exe
1972	1f96d163bb804ff30dcc65872dba193102d4627d100df37c7e83bee2d5b7fea8N.exe
1972	1f96d163bb804ff30dcc65872dba193102d4627d100df37c7e83bee2d5b7fea8N.exe
1972	1f96d163bb804ff30dcc65872dba193102d4627d100df37c7e83bee2d5b7fea8N.exe
2272	Unicorn-62801.exe
2272	Unicorn-62801.exe
2348	Unicorn-57067.exe
2348	Unicorn-57067.exe
2272	Unicorn-62801.exe
2272	Unicorn-62801.exe
2332	Unicorn-29033.exe
2332	Unicorn-29033.exe
1972	1f96d163bb804ff30dcc65872dba193102d4627d100df37c7e83bee2d5b7fea8N.exe
1972	1f96d163bb804ff30dcc65872dba193102d4627d100df37c7e83bee2d5b7fea8N.exe
2660	Unicorn-45028.exe
2660	Unicorn-45028.exe
2348	Unicorn-57067.exe
2348	Unicorn-57067.exe
2716	Unicorn-62988.exe
2716	Unicorn-62988.exe
2272	Unicorn-62801.exe
2864	Unicorn-55426.exe
2272	Unicorn-62801.exe
2864	Unicorn-55426.exe
1972	1f96d163bb804ff30dcc65872dba193102d4627d100df37c7e83bee2d5b7fea8N.exe
2980	Unicorn-34037.exe
1972	1f96d163bb804ff30dcc65872dba193102d4627d100df37c7e83bee2d5b7fea8N.exe
2980	Unicorn-34037.exe
2332	Unicorn-29033.exe
2332	Unicorn-29033.exe
2568	Unicorn-52158.exe
2568	Unicorn-52158.exe
2660	Unicorn-45028.exe
2660	Unicorn-45028.exe
3048	Unicorn-48821.exe
3048	Unicorn-48821.exe
2348	Unicorn-57067.exe
2348	Unicorn-57067.exe
2156	Unicorn-3149.exe
2156	Unicorn-3149.exe
2716	Unicorn-62988.exe
2716	Unicorn-62988.exe
1144	Unicorn-49958.exe
2848	Unicorn-41790.exe
1144	Unicorn-49958.exe
2848	Unicorn-41790.exe
2980	Unicorn-34037.exe
2980	Unicorn-34037.exe
2864	Unicorn-55426.exe
2864	Unicorn-55426.exe
1108	Unicorn-35660.exe
2184	Unicorn-22308.exe
1108	Unicorn-35660.exe
2272	Unicorn-62801.exe
2272	Unicorn-62801.exe
2184	Unicorn-22308.exe
780	Unicorn-49693.exe
780	Unicorn-49693.exe
2332	Unicorn-29033.exe
2332	Unicorn-29033.exe
1972	1f96d163bb804ff30dcc65872dba193102d4627d100df37c7e83bee2d5b7fea8N.exe
1972	1f96d163bb804ff30dcc65872dba193102d4627d100df37c7e83bee2d5b7fea8N.exe
2928	Unicorn-38256.exe
2928	Unicorn-38256.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46110.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8883.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2298.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62177.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46293.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11074.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23220.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22332.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33773.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50765.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6270.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6953.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27930.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61985.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22805.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29234.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53859.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30848.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27932.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1672.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28461.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57891.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46110.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4521.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43452.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56183.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38868.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14382.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18601.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45867.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13552.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9763.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65339.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6917.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6770.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50619.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21135.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6953.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60405.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28359.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64623.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60560.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55985.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54245.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2488.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58866.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52928.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16939.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24018.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49260.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54245.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45580.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42451.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1972	1f96d163bb804ff30dcc65872dba193102d4627d100df37c7e83bee2d5b7fea8N.exe
2272	Unicorn-62801.exe
2348	Unicorn-57067.exe
2332	Unicorn-29033.exe
2660	Unicorn-45028.exe
2716	Unicorn-62988.exe
2980	Unicorn-34037.exe
2864	Unicorn-55426.exe
2568	Unicorn-52158.exe
3048	Unicorn-48821.exe
2156	Unicorn-3149.exe
2848	Unicorn-41790.exe
780	Unicorn-49693.exe
1108	Unicorn-35660.exe
2184	Unicorn-22308.exe
1144	Unicorn-49958.exe
2928	Unicorn-38256.exe
3028	Unicorn-34041.exe
2448	Unicorn-63803.exe
2088	Unicorn-16640.exe
2096	Unicorn-64187.exe
300	Unicorn-11649.exe
1096	Unicorn-22003.exe
880	Unicorn-22003.exe
1372	Unicorn-35193.exe
1748	Unicorn-51530.exe
1056	Unicorn-25210.exe
1680	Unicorn-63154.exe
2548	Unicorn-25210.exe
1384	Unicorn-17234.exe
560	Unicorn-40761.exe
1064	Unicorn-54681.exe
2216	Unicorn-41733.exe
2344	Unicorn-25589.exe
2416	Unicorn-13891.exe
1584	Unicorn-20820.exe
1576	Unicorn-27818.exe
2504	Unicorn-4763.exe
2376	Unicorn-24629.exe
2964	Unicorn-35547.exe
2488	Unicorn-49133.exe
2700	Unicorn-52340.exe
2852	Unicorn-65339.exe
2160	Unicorn-46402.exe
2920	Unicorn-30140.exe
2616	Unicorn-2298.exe
2584	Unicorn-22164.exe
1264	Unicorn-6019.exe
2800	Unicorn-5754.exe
1316	Unicorn-63388.exe
2620	Unicorn-13118.exe
2628	Unicorn-13118.exe
596	Unicorn-55914.exe
1412	Unicorn-60405.exe
2932	Unicorn-45023.exe
1804	Unicorn-52038.exe
1640	Unicorn-8629.exe
2284	Unicorn-45023.exe
2904	Unicorn-25157.exe
2956	Unicorn-3990.exe
2944	Unicorn-36855.exe
2952	Unicorn-22957.exe
1664	Unicorn-14789.exe
2068	Unicorn-4020.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2272	1972	1f96d163bb804ff30dcc65872dba193102d4627d100df37c7e83bee2d5b7fea8N.exe	30
PID 1972 wrote to memory of 2272	1972	1f96d163bb804ff30dcc65872dba193102d4627d100df37c7e83bee2d5b7fea8N.exe	30
PID 1972 wrote to memory of 2272	1972	1f96d163bb804ff30dcc65872dba193102d4627d100df37c7e83bee2d5b7fea8N.exe	30
PID 1972 wrote to memory of 2272	1972	1f96d163bb804ff30dcc65872dba193102d4627d100df37c7e83bee2d5b7fea8N.exe	30
PID 1972 wrote to memory of 2332	1972	1f96d163bb804ff30dcc65872dba193102d4627d100df37c7e83bee2d5b7fea8N.exe	31
PID 1972 wrote to memory of 2332	1972	1f96d163bb804ff30dcc65872dba193102d4627d100df37c7e83bee2d5b7fea8N.exe	31
PID 1972 wrote to memory of 2332	1972	1f96d163bb804ff30dcc65872dba193102d4627d100df37c7e83bee2d5b7fea8N.exe	31
PID 1972 wrote to memory of 2332	1972	1f96d163bb804ff30dcc65872dba193102d4627d100df37c7e83bee2d5b7fea8N.exe	31
PID 2272 wrote to memory of 2348	2272	Unicorn-62801.exe	32
PID 2272 wrote to memory of 2348	2272	Unicorn-62801.exe	32
PID 2272 wrote to memory of 2348	2272	Unicorn-62801.exe	32
PID 2272 wrote to memory of 2348	2272	Unicorn-62801.exe	32
PID 2348 wrote to memory of 2660	2348	Unicorn-57067.exe	33
PID 2348 wrote to memory of 2660	2348	Unicorn-57067.exe	33
PID 2348 wrote to memory of 2660	2348	Unicorn-57067.exe	33
PID 2348 wrote to memory of 2660	2348	Unicorn-57067.exe	33
PID 2272 wrote to memory of 2716	2272	Unicorn-62801.exe	34
PID 2272 wrote to memory of 2716	2272	Unicorn-62801.exe	34
PID 2272 wrote to memory of 2716	2272	Unicorn-62801.exe	34
PID 2272 wrote to memory of 2716	2272	Unicorn-62801.exe	34
PID 2332 wrote to memory of 2980	2332	Unicorn-29033.exe	35
PID 2332 wrote to memory of 2980	2332	Unicorn-29033.exe	35
PID 2332 wrote to memory of 2980	2332	Unicorn-29033.exe	35
PID 2332 wrote to memory of 2980	2332	Unicorn-29033.exe	35
PID 1972 wrote to memory of 2864	1972	1f96d163bb804ff30dcc65872dba193102d4627d100df37c7e83bee2d5b7fea8N.exe	36
PID 1972 wrote to memory of 2864	1972	1f96d163bb804ff30dcc65872dba193102d4627d100df37c7e83bee2d5b7fea8N.exe	36
PID 1972 wrote to memory of 2864	1972	1f96d163bb804ff30dcc65872dba193102d4627d100df37c7e83bee2d5b7fea8N.exe	36
PID 1972 wrote to memory of 2864	1972	1f96d163bb804ff30dcc65872dba193102d4627d100df37c7e83bee2d5b7fea8N.exe	36
PID 2660 wrote to memory of 2568	2660	Unicorn-45028.exe	38
PID 2660 wrote to memory of 2568	2660	Unicorn-45028.exe	38
PID 2660 wrote to memory of 2568	2660	Unicorn-45028.exe	38
PID 2660 wrote to memory of 2568	2660	Unicorn-45028.exe	38
PID 2348 wrote to memory of 3048	2348	Unicorn-57067.exe	39
PID 2348 wrote to memory of 3048	2348	Unicorn-57067.exe	39
PID 2348 wrote to memory of 3048	2348	Unicorn-57067.exe	39
PID 2348 wrote to memory of 3048	2348	Unicorn-57067.exe	39
PID 2716 wrote to memory of 2156	2716	Unicorn-62988.exe	40
PID 2716 wrote to memory of 2156	2716	Unicorn-62988.exe	40
PID 2716 wrote to memory of 2156	2716	Unicorn-62988.exe	40
PID 2716 wrote to memory of 2156	2716	Unicorn-62988.exe	40
PID 2272 wrote to memory of 1108	2272	Unicorn-62801.exe	41
PID 2272 wrote to memory of 1108	2272	Unicorn-62801.exe	41
PID 2272 wrote to memory of 1108	2272	Unicorn-62801.exe	41
PID 2272 wrote to memory of 1108	2272	Unicorn-62801.exe	41
PID 2864 wrote to memory of 2848	2864	Unicorn-55426.exe	42
PID 2864 wrote to memory of 2848	2864	Unicorn-55426.exe	42
PID 2864 wrote to memory of 2848	2864	Unicorn-55426.exe	42
PID 2864 wrote to memory of 2848	2864	Unicorn-55426.exe	42
PID 1972 wrote to memory of 780	1972	1f96d163bb804ff30dcc65872dba193102d4627d100df37c7e83bee2d5b7fea8N.exe	43
PID 1972 wrote to memory of 780	1972	1f96d163bb804ff30dcc65872dba193102d4627d100df37c7e83bee2d5b7fea8N.exe	43
PID 1972 wrote to memory of 780	1972	1f96d163bb804ff30dcc65872dba193102d4627d100df37c7e83bee2d5b7fea8N.exe	43
PID 1972 wrote to memory of 780	1972	1f96d163bb804ff30dcc65872dba193102d4627d100df37c7e83bee2d5b7fea8N.exe	43
PID 2980 wrote to memory of 1144	2980	Unicorn-34037.exe	44
PID 2980 wrote to memory of 1144	2980	Unicorn-34037.exe	44
PID 2980 wrote to memory of 1144	2980	Unicorn-34037.exe	44
PID 2980 wrote to memory of 1144	2980	Unicorn-34037.exe	44
PID 2332 wrote to memory of 2184	2332	Unicorn-29033.exe	45
PID 2332 wrote to memory of 2184	2332	Unicorn-29033.exe	45
PID 2332 wrote to memory of 2184	2332	Unicorn-29033.exe	45
PID 2332 wrote to memory of 2184	2332	Unicorn-29033.exe	45
PID 2568 wrote to memory of 2928	2568	Unicorn-52158.exe	46
PID 2568 wrote to memory of 2928	2568	Unicorn-52158.exe	46
PID 2568 wrote to memory of 2928	2568	Unicorn-52158.exe	46
PID 2568 wrote to memory of 2928	2568	Unicorn-52158.exe	46

C:\Users\Admin\AppData\Local\Temp\1f96d163bb804ff30dcc65872dba193102d4627d100df37c7e83bee2d5b7fea8N.exe
"C:\Users\Admin\AppData\Local\Temp\1f96d163bb804ff30dcc65872dba193102d4627d100df37c7e83bee2d5b7fea8N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62801.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62801.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57067.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57067.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45028.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52158.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38256.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41733.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55542.exe
        8⤵
        Executes dropped EXE
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21534.exe
        9⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        9⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23048.exe
        9⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21135.exe
        9⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45217.exe
        9⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24548.exe
        8⤵
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        8⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16939.exe
        8⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14554.exe
        8⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
        8⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44037.exe
        7⤵
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6946.exe
        8⤵
        
        PID:852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51095.exe
        8⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31471.exe
        8⤵
        
        PID:616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45580.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2461.exe
        7⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6692.exe
        7⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58544.exe
        7⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6379.exe
        7⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6613.exe
        7⤵
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13891.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6917.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46251.exe
        8⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        8⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11074.exe
        8⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
        8⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6083.exe
        8⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25617.exe
        7⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        7⤵
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16939.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14554.exe
        7⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
        7⤵
        
        PID:6772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7611.exe
        6⤵
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57216.exe
        7⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11788.exe
        7⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61344.exe
        7⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15435.exe
        7⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23488.exe
        7⤵
        
        PID:6820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56183.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4187.exe
        6⤵
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42008.exe
        6⤵
        
        PID:4320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23444.exe
        6⤵
        
        PID:6048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50619.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34041.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25589.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39590.exe
        7⤵
        
        PID:1868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19718.exe
        8⤵
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        8⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11074.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
        8⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6083.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39924.exe
        7⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14382.exe
        7⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18450.exe
        7⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36966.exe
        7⤵
        
        PID:6344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52589.exe
        6⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43625.exe
        7⤵
        
        PID:480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        7⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23048.exe
        7⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57891.exe
        7⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6953.exe
        7⤵
        
        PID:6668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55943.exe
        6⤵
        
        PID:372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61495.exe
        6⤵
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31504.exe
        6⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24579.exe
        6⤵
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27818.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46798.exe
        6⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33376.exe
        7⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62115.exe
        8⤵
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exe
        8⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43395.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61645.exe
        8⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        7⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
        7⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22914.exe
        7⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31457.exe
        7⤵
        
        PID:6700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42923.exe
        6⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62115.exe
        7⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exe
        7⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42326.exe
        7⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42451.exe
        7⤵
        
        PID:6992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55985.exe
        6⤵
        
        PID:3128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14382.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41355.exe
        6⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24018.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63061.exe
        5⤵
        
        PID:2300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25888.exe
        6⤵
        
        PID:2892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        6⤵
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41092.exe
        6⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25915.exe
        6⤵
        
        PID:6952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17533.exe
        5⤵
        
        PID:1352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31759.exe
        5⤵
        
        PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23335.exe
        5⤵
        
        PID:1308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24579.exe
        5⤵
        
        PID:5156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48821.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:3048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20820.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37945.exe
        7⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64507.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        8⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11074.exe
        8⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
        8⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6083.exe
        8⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52919.exe
        7⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50028.exe
        7⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
        7⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22914.exe
        7⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
        7⤵
        
        PID:6764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4047.exe
        6⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57216.exe
        7⤵
        
        PID:328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36292.exe
        7⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61344.exe
        7⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31580.exe
        7⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6083.exe
        7⤵
        
        PID:6476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9477.exe
        6⤵
        
        PID:612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6692.exe
        6⤵
        
        PID:4116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58544.exe
        6⤵
        
        PID:4428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38201.exe
        6⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29234.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4763.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40859.exe
        6⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42738.exe
        7⤵
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exe
        7⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42326.exe
        7⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41898.exe
        7⤵
        
        PID:6220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        6⤵
        
        PID:2732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
        6⤵
        
        PID:4916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6770.exe
        6⤵
        
        PID:5620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6953.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51366.exe
        5⤵
        
        PID:768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57216.exe
        6⤵
        
        PID:1744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14382.exe
        6⤵
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41355.exe
        6⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6613.exe
        6⤵
        
        PID:6508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31679.exe
        5⤵
        
        PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55588.exe
        5⤵
        
        PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42008.exe
        5⤵
        
        PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7300.exe
        5⤵
        
        PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2488.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16640.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24629.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37945.exe
        6⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57216.exe
        7⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11788.exe
        7⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61344.exe
        7⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31580.exe
        7⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6083.exe
        7⤵
        
        PID:6380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20630.exe
        6⤵
        
        PID:960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15155.exe
        6⤵
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17240.exe
        6⤵
        
        PID:3524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57891.exe
        6⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
        6⤵
        
        PID:6740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
        5⤵
        
        PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13023.exe
        5⤵
        
        PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54871.exe
        5⤵
        
        PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34158.exe
        5⤵
        
        PID:7112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35547.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30090.exe
        5⤵
        
        PID:1484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        5⤵
        
        PID:3744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
        5⤵
        
        PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6770.exe
        5⤵
        
        PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6953.exe
        5⤵
        
        PID:6660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31383.exe
      4⤵
      PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        5⤵
        
        PID:3516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
        5⤵
        
        PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22914.exe
        5⤵
        
        PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
        5⤵
        
        PID:6716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9083.exe
      4⤵
      PID:2072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7024.exe
      4⤵
      PID:4820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60242.exe
      4⤵
      PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42596.exe
      4⤵
      PID:6028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62988.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62988.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3149.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64187.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49133.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57496.exe
        7⤵
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40709.exe
        8⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52928.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43395.exe
        8⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42451.exe
        8⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63329.exe
        7⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51479.exe
        7⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39639.exe
        7⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2651.exe
        7⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21678.exe
        6⤵
        
        PID:1332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2208.exe
        7⤵
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14382.exe
        7⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38201.exe
        7⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29234.exe
        7⤵
        
        PID:6848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12606.exe
        6⤵
        
        PID:2476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48295.exe
        6⤵
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6270.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46110.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65339.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22761.exe
        6⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19718.exe
        7⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        7⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11074.exe
        7⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48108.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6083.exe
        7⤵
        
        PID:6356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64429.exe
        6⤵
        
        PID:2080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        6⤵
        
        PID:2704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
        6⤵
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21135.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44340.exe
        6⤵
        
        PID:7080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8846.exe
        5⤵
        
        PID:2592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18405.exe
        6⤵
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52928.exe
        6⤵
        
        PID:4888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35227.exe
        6⤵
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42451.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32660.exe
        5⤵
        
        PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48679.exe
        5⤵
        
        PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14438.exe
        5⤵
        
        PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63723.exe
        5⤵
        
        PID:6336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11649.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52340.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37945.exe
        6⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58560.exe
        7⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        7⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48191.exe
        7⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52980.exe
        7⤵
        
        PID:6200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64076.exe
        6⤵
        
        PID:2960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51479.exe
        6⤵
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47807.exe
        6⤵
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45580.exe
        6⤵
        
        PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28359.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34248.exe
        6⤵
        
        PID:1888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37359.exe
        6⤵
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25605.exe
        6⤵
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54245.exe
        6⤵
        
        PID:5864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34578.exe
        5⤵
        
        PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6991.exe
        5⤵
        
        PID:4864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32426.exe
        5⤵
        
        PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42981.exe
        5⤵
        
        PID:6932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46402.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53276.exe
        5⤵
        
        PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47533.exe
        5⤵
        
        PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8274.exe
        5⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22907.exe
        5⤵
        
        PID:5948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24018.exe
        5⤵
        
        PID:6796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41026.exe
      4⤵
      PID:2520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22332.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8804.exe
      4⤵
      PID:5088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59090.exe
      4⤵
      PID:5856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45284.exe
      4⤵
      PID:6540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35660.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35660.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25210.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30140.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14784.exe
        6⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57024.exe
        7⤵
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36100.exe
        7⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11074.exe
        7⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
        7⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6083.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54263.exe
        6⤵
        
        PID:2328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50028.exe
        6⤵
        
        PID:3412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
        6⤵
        
        PID:4476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21135.exe
        6⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50765.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5391.exe
        5⤵
        
        PID:2824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40112.exe
        6⤵
        
        PID:1136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50621.exe
        6⤵
        
        PID:4240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61344.exe
        6⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31580.exe
        6⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6083.exe
        6⤵
        
        PID:6468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52430.exe
        5⤵
        
        PID:1072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16311.exe
        5⤵
        
        PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14445.exe
        5⤵
        
        PID:1976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29044.exe
        5⤵
        
        PID:5604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2298.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21922.exe
        5⤵
        
        PID:1952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
        5⤵
        
        PID:4872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6770.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38857.exe
        5⤵
        
        PID:6868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48491.exe
      4⤵
      PID:2868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7076.exe
        5⤵
        
        PID:3192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-468.exe
        5⤵
        
        PID:4108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33773.exe
        5⤵
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54245.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59577.exe
      4⤵
      PID:3480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6494.exe
      4⤵
      PID:4752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14438.exe
      4⤵
      PID:5224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46110.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63154.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63154.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63388.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60176.exe
        5⤵
        
        PID:1156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18405.exe
        6⤵
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61096.exe
        6⤵
        
        PID:4812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33773.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54245.exe
        6⤵
        
        PID:2112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62260.exe
        5⤵
        
        PID:2524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9294.exe
        5⤵
        
        PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47807.exe
        5⤵
        
        PID:5188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2651.exe
        5⤵
        
        PID:6324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28969.exe
      4⤵
      PID:2260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62115.exe
        5⤵
        
        PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exe
        5⤵
        
        PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42326.exe
        5⤵
        
        PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42451.exe
        5⤵
        
        PID:7004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55985.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21158.exe
      4⤵
      PID:4760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40595.exe
      4⤵
      PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44612.exe
      4⤵
      PID:6012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60405.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60405.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19334.exe
      4⤵
      PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
      4⤵
      PID:3456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11074.exe
      4⤵
      PID:4112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48108.exe
      4⤵
      PID:5928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23488.exe
      4⤵
      PID:6812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43452.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43452.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39398.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39398.exe
    3⤵
    PID:4092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52810.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52810.exe
    3⤵
    PID:5092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53755.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53755.exe
    3⤵
    PID:5840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49484.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49484.exe
    3⤵
    PID:6780
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29033.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29033.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34037.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34037.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49958.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22003.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45023.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37185.exe
        7⤵
        
        PID:772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61344.exe
        7⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31580.exe
        7⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6083.exe
        7⤵
        
        PID:6404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34231.exe
        6⤵
        
        PID:1488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        6⤵
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
        6⤵
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22914.exe
        6⤵
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
        6⤵
        
        PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8629.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10783.exe
        6⤵
        
        PID:1036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38083.exe
        7⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        7⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11074.exe
        7⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48108.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23488.exe
        7⤵
        
        PID:6836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58866.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56960.exe
        6⤵
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22805.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29044.exe
        6⤵
        
        PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54430.exe
        5⤵
        
        PID:1660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57024.exe
        6⤵
        
        PID:1536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21158.exe
        6⤵
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21135.exe
        6⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28461.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40999.exe
        5⤵
        
        PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47228.exe
        5⤵
        
        PID:4144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42008.exe
        5⤵
        
        PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23444.exe
        5⤵
        
        PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50619.exe
        5⤵
        
        PID:6804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35193.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36855.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5005.exe
        6⤵
        
        PID:2836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        6⤵
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11074.exe
        6⤵
        
        PID:4168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
        6⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6083.exe
        6⤵
        
        PID:6432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7636.exe
        5⤵
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19030.exe
        6⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28173.exe
        6⤵
        
        PID:7012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12493.exe
        5⤵
        
        PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14438.exe
        5⤵
        
        PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46110.exe
        5⤵
        
        PID:5660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4020.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62789.exe
        5⤵
        
        PID:1820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42249.exe
        6⤵
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        6⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41092.exe
        6⤵
        
        PID:5552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9763.exe
        6⤵
        
        PID:6268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61108.exe
        5⤵
        
        PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21158.exe
        5⤵
        
        PID:4764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40595.exe
        5⤵
        
        PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36444.exe
        5⤵
        
        PID:6184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53204.exe
      4⤵
      PID:272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62115.exe
        5⤵
        
        PID:3216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exe
        5⤵
        
        PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33773.exe
        5⤵
        
        PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46077.exe
        5⤵
        
        PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53185.exe
      4⤵
      PID:3096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61495.exe
      4⤵
      PID:4636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41125.exe
      4⤵
      PID:5456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31979.exe
      4⤵
      PID:6208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22308.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22308.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25210.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13118.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39546.exe
        6⤵
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46293.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exe
        7⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33773.exe
        7⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54245.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17491.exe
        6⤵
        
        PID:3476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        6⤵
        
        PID:4548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49260.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19731.exe
        6⤵
        
        PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45083.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55217.exe
        6⤵
        
        PID:1892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46956.exe
        6⤵
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30237.exe
        6⤵
        
        PID:6936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        5⤵
        
        PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14382.exe
        5⤵
        
        PID:4284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18450.exe
        5⤵
        
        PID:5896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36966.exe
        5⤵
        
        PID:6376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25157.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18601.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        5⤵
        
        PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
        5⤵
        
        PID:4572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
        5⤵
        
        PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6953.exe
        5⤵
        
        PID:6616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4521.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47533.exe
      4⤵
      PID:3168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63384.exe
      4⤵
      PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58421.exe
      4⤵
      PID:5396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2488.exe
      4⤵
      PID:6592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40761.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40761.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22164.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61328.exe
        5⤵
        
        PID:568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59842.exe
        6⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58538.exe
        7⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46956.exe
        7⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8883.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52928.exe
        6⤵
        
        PID:4904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46336.exe
        6⤵
        
        PID:5308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48805.exe
        6⤵
        
        PID:7096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15280.exe
        5⤵
        
        PID:3420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51479.exe
        5⤵
        
        PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49260.exe
        5⤵
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19731.exe
        5⤵
        
        PID:6032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64623.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12981.exe
        5⤵
        
        PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        5⤵
        
        PID:3184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11074.exe
        5⤵
        
        PID:4224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
        5⤵
        
        PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6083.exe
        5⤵
        
        PID:6460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62212.exe
      4⤵
      PID:1752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47533.exe
      4⤵
      PID:3120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8274.exe
      4⤵
      PID:4256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63556.exe
      4⤵
      PID:5848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52280.exe
      4⤵
      PID:6908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5754.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5754.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57880.exe
      4⤵
      PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58690.exe
        5⤵
        
        PID:1540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52928.exe
        5⤵
        
        PID:4948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18506.exe
        5⤵
        
        PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4276.exe
        5⤵
        
        PID:5996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13552.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1126.exe
      4⤵
      PID:4876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41092.exe
      4⤵
      PID:5504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9763.exe
      4⤵
      PID:6284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53859.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53859.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62115.exe
      4⤵
      PID:3312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exe
      4⤵
      PID:4692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42326.exe
      4⤵
      PID:5724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42451.exe
      4⤵
      PID:6964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36649.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36649.exe
    3⤵
    PID:3076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13023.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13023.exe
    3⤵
    PID:4596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19594.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19594.exe
    3⤵
    PID:5448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26644.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26644.exe
    3⤵
    PID:6236
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55426.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55426.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41790.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41790.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22003.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3990.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60729.exe
        6⤵
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        6⤵
        
        PID:3404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23048.exe
        6⤵
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21135.exe
        6⤵
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28461.exe
        6⤵
        
        PID:6628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7039.exe
        5⤵
        
        PID:2696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        5⤵
        
        PID:3564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
        5⤵
        
        PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6770.exe
        5⤵
        
        PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6953.exe
        5⤵
        
        PID:6676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22957.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48835.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        6⤵
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22914.exe
        6⤵
        
        PID:940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
        6⤵
        
        PID:6748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62177.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1126.exe
        5⤵
        
        PID:4936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48191.exe
        5⤵
        
        PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9763.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60686.exe
      4⤵
      PID:492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
        5⤵
        
        PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exe
        5⤵
        
        PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35227.exe
        5⤵
        
        PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42451.exe
        5⤵
        
        PID:6980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61850.exe
      4⤵
      PID:3080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12493.exe
      4⤵
      PID:4516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14438.exe
      4⤵
      PID:5312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20173.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51530.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51530.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6019.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60560.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        6⤵
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
        6⤵
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22914.exe
        6⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
        6⤵
        
        PID:6732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61985.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9294.exe
        5⤵
        
        PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39639.exe
        5⤵
        
        PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29243.exe
        5⤵
        
        PID:5976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55119.exe
      4⤵
      PID:1564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64808.exe
        5⤵
        
        PID:2540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13106.exe
        6⤵
        
        PID:3244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exe
        6⤵
        
        PID:4524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33773.exe
        6⤵
        
        PID:5300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54245.exe
        6⤵
        
        PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        5⤵
        
        PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
        5⤵
        
        PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22914.exe
        5⤵
        
        PID:6116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
        5⤵
        
        PID:6708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60790.exe
      4⤵
      PID:1244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56960.exe
      4⤵
      PID:4392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22805.exe
      4⤵
      PID:2516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29044.exe
      4⤵
      PID:5704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55914.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55914.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18768.exe
      4⤵
      PID:2076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62115.exe
        5⤵
        
        PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exe
        5⤵
        
        PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46336.exe
        5⤵
        
        PID:5648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27930.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
      4⤵
      PID:3752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
      4⤵
      PID:4852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22914.exe
      4⤵
      PID:5128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
      4⤵
      PID:6756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62524.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62524.exe
    3⤵
    PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18405.exe
      4⤵
      PID:804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37743.exe
      4⤵
      PID:4696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33773.exe
      4⤵
      PID:5280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37909.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37909.exe
      4⤵
      PID:5956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48499.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48499.exe
    3⤵
    PID:2580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55496.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55496.exe
    3⤵
    PID:4836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16670.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16670.exe
    3⤵
    PID:5220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23899.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23899.exe
    3⤵
    PID:6884
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49693.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49693.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17234.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17234.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45023.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54097.exe
        5⤵
        
        PID:1340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        5⤵
        
        PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23048.exe
        5⤵
        
        PID:4248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57891.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6953.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8575.exe
      4⤵
      PID:2440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
      4⤵
      PID:3580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
      4⤵
      PID:4712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
      4⤵
      PID:5168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6953.exe
      4⤵
      PID:6560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14789.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14789.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21565.exe
      4⤵
      PID:2172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16506.exe
        5⤵
        
        PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37743.exe
        5⤵
        
        PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33773.exe
        5⤵
        
        PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54245.exe
        5⤵
        
        PID:1224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30848.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14382.exe
      4⤵
      PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38201.exe
      4⤵
      PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29234.exe
      4⤵
      PID:6584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56659.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56659.exe
    3⤵
    PID:2600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45867.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
      4⤵
      PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11074.exe
      4⤵
      PID:4192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6083.exe
      4⤵
      PID:6484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45794.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45794.exe
    3⤵
    PID:2668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38868.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38868.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57276.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57276.exe
    3⤵
    PID:5064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39973.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39973.exe
    3⤵
    PID:5964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2488.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2488.exe
    3⤵
    PID:6576
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54681.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54681.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13118.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13118.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60537.exe
      4⤵
      PID:344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
      4⤵
      PID:3380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11074.exe
      4⤵
      PID:4140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48108.exe
      4⤵
      PID:5940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23488.exe
      4⤵
      PID:6828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32695.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32695.exe
    3⤵
    PID:3036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
    3⤵
    PID:3624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
    3⤵
    PID:4956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6770.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6770.exe
    3⤵
    PID:5640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6953.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6953.exe
    3⤵
    PID:6552
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52038.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52038.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45353.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45353.exe
    3⤵
    PID:1948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
    3⤵
    PID:3368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61344.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61344.exe
    3⤵
    PID:4420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31580.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31580.exe
    3⤵
    PID:6100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6083.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6083.exe
    3⤵
    PID:6492
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60689.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60689.exe
  2⤵
  PID:1672
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17867.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17867.exe
  2⤵
  PID:3772
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47475.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47475.exe
  2⤵
  PID:5056
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17307.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17307.exe
  2⤵
  PID:5904
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21749.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21749.exe
  2⤵
  PID:6368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-3149.exe

Filesize
468KB

MD5
c380d0ad8ceede41d52d3c4c19cf371e

SHA1
569a0682c9f0695cc182989b1151e93579fa2fd6

SHA256
f6a4356872aae5653b2ca915e64b30f1c15fca08f4869c8d2c4ff60bfd96f82a

SHA512
bc134070888169e7c7e3631fb526003178b525231352d5b6c36d5239a818affbe94e32cba668108329f8bfe8aad7e39b8636b33a94c0163bc0a45e30200e78e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38083.exe

Filesize
468KB

MD5
faf920b838c6fc7e407fe226db638c6b

SHA1
a5281ff0b539aebabd13ff9f092649efb61d7dae

SHA256
4126f6706b8ff16af6221632a2f7d0083ef49df5e4d2eacc34b73aa8d298d4fa

SHA512
ec31636c0733224120864bf72aa164f5af5101f4f5c67e9fd033d00ff4ef609aef712dfe037cc63cc1055c1380cf224000b1926f1900fcbd67c03aa5acfaf628

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38256.exe

Filesize
468KB

MD5
5b18fabc8d0112c0081e1df7760553ad

SHA1
5ea9376afe16dd5d770af82a56f39656e0647c5e

SHA256
1ad596f1251987a0629874884b8e030484310ebe81b7ad2ff485075eeda95dcb

SHA512
0ea98cfa2fc33939386a75de6c2aec1679d1b0f397ee358db7d7c43c571f781500b605b60503793be25f8fcd068456add278829d78b7194465fb819b27b70ec9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41790.exe

Filesize
468KB

MD5
817079b402ca7498ab6ccc4eb2216b0e

SHA1
90e00f2a3e8aeb00bc298c3877b201a03292aed0

SHA256
3a4cde9fd4c058024d9f9d0b884294ee1a2e8bb0e5ef4e29a14df2e85179748a

SHA512
3db7869a0e7d91a7375aa83c52ca435ef490d435de2e20893170040d12444e19c80560a285a893b22c112acecea4c5e75fa4eb606a9a8e519a564738f76c383d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46293.exe

Filesize
468KB

MD5
755dee9e7bdaafbf3a2bc5444ac66ad1

SHA1
a791b7d6c7e064f617ca017c42d7d32482340ed9

SHA256
0101ca5a9d36fb5952d683f5bacea6d6f8a43974e5c9b35e8acbab643fac428b

SHA512
93dbaf43eb2011e7c635bbb5efb59febc8c913cd64d26d3f9911127ad8986aa774884afb9df48c9df04777329c4e4c638a6dbb0aab91333120e0c84ec42b6f4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48821.exe

Filesize
468KB

MD5
0b788900f17cfa28ef2cd92bc697e738

SHA1
2a62588a9a08aeab5dee5e513c224585f51389e9

SHA256
0a0c57d49cbb899b29af833ca85cadcdbacfc6b2458e14ab9cb78029659b8f99

SHA512
fc90738972c8686ab1d68a68e4b9c6650d3b639d917a73a66cc9a9025d3541512acabc6af721d293e037158a42c837ae0958e678ef70b86ae96382326e7b6908

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62988.exe

Filesize
468KB

MD5
758f8650eaa6aca1868943268ef796d2

SHA1
6753d6ecedc50f12405898a1b7e0f204a3a1bbfb

SHA256
44a18ded39512f6d2f27fc7887770c3ba9342587a5d4aac34635f144a1aa118b

SHA512
9292cfe2e878cd01478992326f0b8a509ad26c4456b7e4c95fb0f7f8ca9675938d5afacfc44282f1085775d790f37af441066f2295d7713a6cf9f95e79eb438e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe

Filesize
468KB

MD5
a472158682d49d6169fb66335c6e5512

SHA1
e0dc33bc5620ebbf315e5018109f9b4a7655e395

SHA256
2fc8d07a04555b01e8afb1473577847c75db67053f241dde089cff37002f269f

SHA512
2af87ed075a7d089d591b6637e8c5201a9e558d28cc18c53eb8e9ed9a50d93b1b4732f7da552b5f08cac91d402b6d7427af096da3d8dc0ba0d9565d9dd0319af

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16640.exe

Filesize
468KB

MD5
4cf319a13abf96d356b02e99caafa7db

SHA1
962071d9f5afbe2778ff6d7f73ecced6cb84e806

SHA256
f7a9f1b02cc86587a4c301f892fae66991307b7a1e44eb9e54b2e8ae2a9208de

SHA512
6d17c6a331a76076011f583d18a129f20232419121fd89994528d9231e320fac50c94bd8b5a54763b804df579ccff40c09f9abe90cf49cbda3808b99e85603f7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22308.exe

Filesize
468KB

MD5
738910a4bc9a43c3914ff4732e045792

SHA1
c0dc1f0e31328e8b56fddf3f766d42ebb40db33b

SHA256
b64790f8f51e6f394e26dc2a97c91fc0e16041100b16f4b9aa791344918f0dbd

SHA512
fb97c568d0285e8c1af259032950a128b2bc0c84a1a86a3dedaba28696fd8e7352079a1a84dc32390455caa21802d02672c2b522540ff68c86259bc93fd7364a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29033.exe

Filesize
468KB

MD5
343daafabe412617e046fdd0549c9120

SHA1
32c6fd6e93ad0157b048d4ed6cd43a8c3a7fbce4

SHA256
9fab823a3eb7573414ad8e0936add0357db49eb714a7645443a4573047eb4f24

SHA512
61fd2275f6834b4c24b19d44c848ce385ee14053d97e4f8e7cd001a49aa79ebc767cfb1427e26b59ce25cfa0dbf6098f16c0ac0168db99ea432405c3809ad242

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34037.exe

Filesize
468KB

MD5
4ec685e88897ed7a8c8b659c509762f2

SHA1
bf7536778424a9d72689fc4936510a44db75e74d

SHA256
74730053abb55a894d001085e44a25beedf8d29ea18b0711ca9b4184a6aaa64c

SHA512
d7cf77ed4feffc073a3cf219ac859a81cf758d63e2210eb3868945ae8618db956c2d2a1c51d728781ce6997ea89b30ee66c89bddfe493fdacf8eaf6a161cf97f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34041.exe

Filesize
468KB

MD5
a3ff0060c2fc0820b1a21094888fdd70

SHA1
3e916b1b12ea844449a11649f016a3855ba92c2d

SHA256
db8a2202432abd9b3f9058715af89497c47607e4b2320e73596dca734896d476

SHA512
fe4f9b9b9d5c134330eea74756860ad1f05a80cb686078c896b1755980154df102db7ffbd4035977388087b642c510fd4b367fdaf8842274a35394954bbcfd1b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-35660.exe

Filesize
468KB

MD5
fdada3ea785f1f7fc901d5c3763d3a3b

SHA1
90f67eaf75c8582a69fdba37f33ba6c427d2fb1a

SHA256
a83919fab268949090ff3e4c0c8bc1f1be331a190fa1f5a566a6ab583a7315b0

SHA512
99e029d14ab433baee2780c3b5cbbff73ab65ea073f5192a83f4ecdc9485f021466c19b2f39df43ec237dc03a745bed3047dd3c78fc66b45f3529a86151238c6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45028.exe

Filesize
468KB

MD5
cf47de29c73f5e1b8fe276cb7c5c07d9

SHA1
2210d59ad6253db0216d4c18cc143a541dd0c201

SHA256
03d2b688d43d34d9a9a3e0ac5e50315688fb721fd4a832748c2e9bdb629ed684

SHA512
b0c94a597d9994fd620d887663dabc8496f146cb73b180d9cac6093766daa85fadc9473f7c254e06a7e67ad1643c013670ccba38a8a8d27330b4d6cb550cb825

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49693.exe

Filesize
468KB

MD5
64c075173a098dfce9454cb52bdd585c

SHA1
69032e31c150009b71eeb92c49510cb040bf0f0e

SHA256
719b47d2d5a237e4e7194ffc02c29f2a109ade0fc4d606870567dab334578c0c

SHA512
cd36205e0fed3201baa9ec164169f30c4fa6b430286c72d89d6171f2cf992a8e1d6fa766e63abed339ea57ead1819c43b8a355cc8094343d5b43455c7a9216bf

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49958.exe

Filesize
468KB

MD5
ff68be556619941016dca75c71153f73

SHA1
6740e397515f214e3fe23e72de8d1ad91c330ff8

SHA256
0b1b16ef3597502e19c42b78809020238d755b4c0dc38772eaf2e99230ba4f60

SHA512
ad01d7e047c2d440994efd323519bff1f5741d081b2ad7feab5b5514ab83e475904775b4a1fa406e32424199fdfc510925c2fd4325b34968285f1533e71497f3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52158.exe

Filesize
468KB

MD5
c2302b8bf98f48b2b5c99c27d3b447f1

SHA1
be674890847afe8f44b7b7b057e1f1a7e1e3ffac

SHA256
6d49dfcb102e9dbadac0d500412e9b316c846d1598aaa89b1b06aadb50775f3c

SHA512
e16b7212435395776ba32f785eca16bf299e73ba62593c021d5b5d1ac87674f4eeac0297fb06d9a9e4a5d377994a2bf161249406cc9cbb14b7946e86ff7b9b69

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55426.exe

Filesize
468KB

MD5
798feab06fa3a6c67ff4ffa053aa7b2b

SHA1
1c722d1f226131dc5cfaef00e1f80c7834fac8dd

SHA256
1a8ce8b8e451963da80fd9078301bebe85ec8faefdae49060354c22e2a279e98

SHA512
7be11f3e520b53776e1653c455e7a6f3a2632c0113432c68cf8d92767846776d41873b4b8bd10efc7e2647ff6ea9863eab8b3428a8ffbb2fb4dbb548b29ff79c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57067.exe

Filesize
468KB

MD5
5973eddc4a2f5d1c61bcc75511c68a0d

SHA1
c33e1c0d797af8121fba4361cb8bdb3cd19b798f

SHA256
592a3c819f8e74c7d09c8e9e6e72efd87c96eebd41f3c981c59eca7efed7a9e4

SHA512
154f0502dd537cff12e4d834b720e03440ff38183da181059f1a256bcfa2a8520bc633eb24f714de57e1bb87b4fabe7c80c6d8f542e3d62704bcd41465e813b9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62801.exe

Filesize
468KB

MD5
30184a8efc7834f18fbb9c2fe5ffcc44

SHA1
31a21bb09cee0786140b1163a472908f4b380f30

SHA256
4d2b3f3bb2aabea074e1ec6724a97b14ec1c2e6d5f14f4be06e0e05d1c00eb42

SHA512
df8832accc12c8d8f86e03a463bb40beab6600476bca64ec27deb5d27bacfc88dd0409f565df407d6d89121709c37af5edaddd7d2dd3e18700d61fe739981c14

Download Submit