bba846564198bf7be3743d08db67d815517d3c0d9bc8e08c08e35b490081b12a

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
28-09-2024 14:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bba846564198bf7be3743d08db67d815517d3c0d9bc8e08c08e35b490081b12aN.exe
Size

468KB
MD5

b6f381b5e03dc649c5fcca371de79060
SHA1

29176e9d849a2165205a4a5f7cc206c884a8c114
SHA256

bba846564198bf7be3743d08db67d815517d3c0d9bc8e08c08e35b490081b12a
SHA512

5c776f5f0115e8550174d7c48f9e4775eb0e3d7665a893386f2c71e5fc587ee8651efeabca05982707d27b1f756c7f4771391fb2f3dc72eefaed2af3f5247ea7
SSDEEP

3072:DqoNogLdjK8U2bxuPz5Fff5kChjWXpynmHeuVqlnci3f3dJwySFlD:DqCoozU2wP1FffM5Yzci3f/wyS

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2224	Unicorn-29512.exe
2188	Unicorn-34831.exe
2408	Unicorn-19049.exe
2792	Unicorn-39730.exe
2464	Unicorn-48453.exe
2728	Unicorn-12987.exe
2612	Unicorn-6865.exe
2992	Unicorn-39896.exe
1708	Unicorn-24114.exe
1564	Unicorn-48064.exe
2124	Unicorn-27836.exe
1804	Unicorn-21705.exe
920	Unicorn-36558.exe
1704	Unicorn-56424.exe
536	Unicorn-47991.exe
2168	Unicorn-24987.exe
2468	Unicorn-22573.exe
1592	Unicorn-50607.exe
1192	Unicorn-50607.exe
492	Unicorn-7720.exe
1604	Unicorn-10321.exe
572	Unicorn-46139.exe
1856	Unicorn-42055.exe
1656	Unicorn-9190.exe
2504	Unicorn-54862.exe
2080	Unicorn-3060.exe
796	Unicorn-13274.exe
2472	Unicorn-29232.exe
2388	Unicorn-37898.exe
1680	Unicorn-18297.exe
2684	Unicorn-43674.exe
2696	Unicorn-21399.exe
2748	Unicorn-27530.exe
2692	Unicorn-40336.exe
2600	Unicorn-60202.exe
2640	Unicorn-19340.exe
2372	Unicorn-39760.exe
2996	Unicorn-59626.exe
1808	Unicorn-486.exe
1560	Unicorn-51541.exe
1992	Unicorn-19061.exe
1364	Unicorn-64732.exe
2016	Unicorn-19061.exe
1668	Unicorn-30550.exe
640	Unicorn-39481.exe
776	Unicorn-39481.exe
288	Unicorn-19615.exe
2776	Unicorn-10051.exe
1140	Unicorn-55988.exe
1392	Unicorn-47073.exe
1616	Unicorn-47073.exe
2324	Unicorn-54976.exe
888	Unicorn-60264.exe
2400	Unicorn-22761.exe
2132	Unicorn-22761.exe
2396	Unicorn-2895.exe
1736	Unicorn-63601.exe
3008	Unicorn-1254.exe
2404	Unicorn-46179.exe
2700	Unicorn-26843.exe
2724	Unicorn-44909.exe
2608	Unicorn-3746.exe
2592	Unicorn-23612.exe
2248	Unicorn-30939.exe

Loads dropped DLL 64 IoCs

pid	Process
2968	bba846564198bf7be3743d08db67d815517d3c0d9bc8e08c08e35b490081b12aN.exe
2968	bba846564198bf7be3743d08db67d815517d3c0d9bc8e08c08e35b490081b12aN.exe
2224	Unicorn-29512.exe
2968	bba846564198bf7be3743d08db67d815517d3c0d9bc8e08c08e35b490081b12aN.exe
2224	Unicorn-29512.exe
2968	bba846564198bf7be3743d08db67d815517d3c0d9bc8e08c08e35b490081b12aN.exe
2188	Unicorn-34831.exe
2188	Unicorn-34831.exe
2224	Unicorn-29512.exe
2224	Unicorn-29512.exe
2968	bba846564198bf7be3743d08db67d815517d3c0d9bc8e08c08e35b490081b12aN.exe
2968	bba846564198bf7be3743d08db67d815517d3c0d9bc8e08c08e35b490081b12aN.exe
2408	Unicorn-19049.exe
2408	Unicorn-19049.exe
2792	Unicorn-39730.exe
2792	Unicorn-39730.exe
2188	Unicorn-34831.exe
2188	Unicorn-34831.exe
2464	Unicorn-48453.exe
2464	Unicorn-48453.exe
2224	Unicorn-29512.exe
2612	Unicorn-6865.exe
2224	Unicorn-29512.exe
2612	Unicorn-6865.exe
2728	Unicorn-12987.exe
2408	Unicorn-19049.exe
2408	Unicorn-19049.exe
2728	Unicorn-12987.exe
2968	bba846564198bf7be3743d08db67d815517d3c0d9bc8e08c08e35b490081b12aN.exe
2968	bba846564198bf7be3743d08db67d815517d3c0d9bc8e08c08e35b490081b12aN.exe
2992	Unicorn-39896.exe
2992	Unicorn-39896.exe
2792	Unicorn-39730.exe
2792	Unicorn-39730.exe
1708	Unicorn-24114.exe
1564	Unicorn-48064.exe
1708	Unicorn-24114.exe
1564	Unicorn-48064.exe
2188	Unicorn-34831.exe
2188	Unicorn-34831.exe
2464	Unicorn-48453.exe
2464	Unicorn-48453.exe
2124	Unicorn-27836.exe
2124	Unicorn-27836.exe
920	Unicorn-36558.exe
920	Unicorn-36558.exe
2612	Unicorn-6865.exe
1704	Unicorn-56424.exe
2408	Unicorn-19049.exe
2612	Unicorn-6865.exe
1704	Unicorn-56424.exe
2408	Unicorn-19049.exe
1804	Unicorn-21705.exe
1804	Unicorn-21705.exe
2968	bba846564198bf7be3743d08db67d815517d3c0d9bc8e08c08e35b490081b12aN.exe
2224	Unicorn-29512.exe
2968	bba846564198bf7be3743d08db67d815517d3c0d9bc8e08c08e35b490081b12aN.exe
2224	Unicorn-29512.exe
2728	Unicorn-12987.exe
2728	Unicorn-12987.exe
2468	Unicorn-22573.exe
2468	Unicorn-22573.exe
2792	Unicorn-39730.exe
2792	Unicorn-39730.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65456.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8388.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16743.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23612.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1721.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24791.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6865.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5290.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1262.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15927.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64260.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26146.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30444.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31202.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10577.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9131.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7262.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23545.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45799.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58699.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29228.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30483.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11367.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6811.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49296.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48671.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15927.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31396.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62162.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35560.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7792.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4853.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47569.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54627.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39896.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2041.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7237.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50663.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10321.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27080.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30302.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47569.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47026.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47886.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48679.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56264.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28768.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22521.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18281.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10062.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27836.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31731.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25102.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11367.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2968	bba846564198bf7be3743d08db67d815517d3c0d9bc8e08c08e35b490081b12aN.exe
2224	Unicorn-29512.exe
2188	Unicorn-34831.exe
2408	Unicorn-19049.exe
2792	Unicorn-39730.exe
2464	Unicorn-48453.exe
2612	Unicorn-6865.exe
2728	Unicorn-12987.exe
2992	Unicorn-39896.exe
1708	Unicorn-24114.exe
1564	Unicorn-48064.exe
1804	Unicorn-21705.exe
2124	Unicorn-27836.exe
920	Unicorn-36558.exe
536	Unicorn-47991.exe
1704	Unicorn-56424.exe
2168	Unicorn-24987.exe
2468	Unicorn-22573.exe
1592	Unicorn-50607.exe
1192	Unicorn-50607.exe
492	Unicorn-7720.exe
1604	Unicorn-10321.exe
572	Unicorn-46139.exe
2504	Unicorn-54862.exe
1656	Unicorn-9190.exe
796	Unicorn-13274.exe
1856	Unicorn-42055.exe
2080	Unicorn-3060.exe
2388	Unicorn-37898.exe
2472	Unicorn-29232.exe
1680	Unicorn-18297.exe
2684	Unicorn-43674.exe
2696	Unicorn-21399.exe
2748	Unicorn-27530.exe
2692	Unicorn-40336.exe
2600	Unicorn-60202.exe
2640	Unicorn-19340.exe
2372	Unicorn-39760.exe
2996	Unicorn-59626.exe
1808	Unicorn-486.exe
1560	Unicorn-51541.exe
776	Unicorn-39481.exe
2016	Unicorn-19061.exe
288	Unicorn-19615.exe
1364	Unicorn-64732.exe
1992	Unicorn-19061.exe
1668	Unicorn-30550.exe
640	Unicorn-39481.exe
1140	Unicorn-55988.exe
1392	Unicorn-47073.exe
2324	Unicorn-54976.exe
1616	Unicorn-47073.exe
2776	Unicorn-10051.exe
888	Unicorn-60264.exe
2400	Unicorn-22761.exe
2396	Unicorn-2895.exe
2132	Unicorn-22761.exe
1736	Unicorn-63601.exe
3008	Unicorn-1254.exe
2404	Unicorn-46179.exe
2700	Unicorn-26843.exe
2724	Unicorn-44909.exe
2592	Unicorn-23612.exe
2608	Unicorn-3746.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2224	2968	bba846564198bf7be3743d08db67d815517d3c0d9bc8e08c08e35b490081b12aN.exe	30
PID 2968 wrote to memory of 2224	2968	bba846564198bf7be3743d08db67d815517d3c0d9bc8e08c08e35b490081b12aN.exe	30
PID 2968 wrote to memory of 2224	2968	bba846564198bf7be3743d08db67d815517d3c0d9bc8e08c08e35b490081b12aN.exe	30
PID 2968 wrote to memory of 2224	2968	bba846564198bf7be3743d08db67d815517d3c0d9bc8e08c08e35b490081b12aN.exe	30
PID 2224 wrote to memory of 2188	2224	Unicorn-29512.exe	31
PID 2224 wrote to memory of 2188	2224	Unicorn-29512.exe	31
PID 2224 wrote to memory of 2188	2224	Unicorn-29512.exe	31
PID 2224 wrote to memory of 2188	2224	Unicorn-29512.exe	31
PID 2968 wrote to memory of 2408	2968	bba846564198bf7be3743d08db67d815517d3c0d9bc8e08c08e35b490081b12aN.exe	32
PID 2968 wrote to memory of 2408	2968	bba846564198bf7be3743d08db67d815517d3c0d9bc8e08c08e35b490081b12aN.exe	32
PID 2968 wrote to memory of 2408	2968	bba846564198bf7be3743d08db67d815517d3c0d9bc8e08c08e35b490081b12aN.exe	32
PID 2968 wrote to memory of 2408	2968	bba846564198bf7be3743d08db67d815517d3c0d9bc8e08c08e35b490081b12aN.exe	32
PID 2188 wrote to memory of 2792	2188	Unicorn-34831.exe	33
PID 2188 wrote to memory of 2792	2188	Unicorn-34831.exe	33
PID 2188 wrote to memory of 2792	2188	Unicorn-34831.exe	33
PID 2188 wrote to memory of 2792	2188	Unicorn-34831.exe	33
PID 2224 wrote to memory of 2464	2224	Unicorn-29512.exe	34
PID 2224 wrote to memory of 2464	2224	Unicorn-29512.exe	34
PID 2224 wrote to memory of 2464	2224	Unicorn-29512.exe	34
PID 2224 wrote to memory of 2464	2224	Unicorn-29512.exe	34
PID 2968 wrote to memory of 2728	2968	bba846564198bf7be3743d08db67d815517d3c0d9bc8e08c08e35b490081b12aN.exe	35
PID 2968 wrote to memory of 2728	2968	bba846564198bf7be3743d08db67d815517d3c0d9bc8e08c08e35b490081b12aN.exe	35
PID 2968 wrote to memory of 2728	2968	bba846564198bf7be3743d08db67d815517d3c0d9bc8e08c08e35b490081b12aN.exe	35
PID 2968 wrote to memory of 2728	2968	bba846564198bf7be3743d08db67d815517d3c0d9bc8e08c08e35b490081b12aN.exe	35
PID 2408 wrote to memory of 2612	2408	Unicorn-19049.exe	36
PID 2408 wrote to memory of 2612	2408	Unicorn-19049.exe	36
PID 2408 wrote to memory of 2612	2408	Unicorn-19049.exe	36
PID 2408 wrote to memory of 2612	2408	Unicorn-19049.exe	36
PID 2792 wrote to memory of 2992	2792	Unicorn-39730.exe	37
PID 2792 wrote to memory of 2992	2792	Unicorn-39730.exe	37
PID 2792 wrote to memory of 2992	2792	Unicorn-39730.exe	37
PID 2792 wrote to memory of 2992	2792	Unicorn-39730.exe	37
PID 2188 wrote to memory of 1708	2188	Unicorn-34831.exe	38
PID 2188 wrote to memory of 1708	2188	Unicorn-34831.exe	38
PID 2188 wrote to memory of 1708	2188	Unicorn-34831.exe	38
PID 2188 wrote to memory of 1708	2188	Unicorn-34831.exe	38
PID 2464 wrote to memory of 1564	2464	Unicorn-48453.exe	39
PID 2464 wrote to memory of 1564	2464	Unicorn-48453.exe	39
PID 2464 wrote to memory of 1564	2464	Unicorn-48453.exe	39
PID 2464 wrote to memory of 1564	2464	Unicorn-48453.exe	39
PID 2224 wrote to memory of 1804	2224	Unicorn-29512.exe	40
PID 2224 wrote to memory of 1804	2224	Unicorn-29512.exe	40
PID 2224 wrote to memory of 1804	2224	Unicorn-29512.exe	40
PID 2224 wrote to memory of 1804	2224	Unicorn-29512.exe	40
PID 2612 wrote to memory of 2124	2612	Unicorn-6865.exe	41
PID 2612 wrote to memory of 2124	2612	Unicorn-6865.exe	41
PID 2612 wrote to memory of 2124	2612	Unicorn-6865.exe	41
PID 2612 wrote to memory of 2124	2612	Unicorn-6865.exe	41
PID 2408 wrote to memory of 920	2408	Unicorn-19049.exe	43
PID 2408 wrote to memory of 920	2408	Unicorn-19049.exe	43
PID 2408 wrote to memory of 920	2408	Unicorn-19049.exe	43
PID 2408 wrote to memory of 920	2408	Unicorn-19049.exe	43
PID 2728 wrote to memory of 1704	2728	Unicorn-12987.exe	42
PID 2728 wrote to memory of 1704	2728	Unicorn-12987.exe	42
PID 2728 wrote to memory of 1704	2728	Unicorn-12987.exe	42
PID 2728 wrote to memory of 1704	2728	Unicorn-12987.exe	42
PID 2968 wrote to memory of 536	2968	bba846564198bf7be3743d08db67d815517d3c0d9bc8e08c08e35b490081b12aN.exe	44
PID 2968 wrote to memory of 536	2968	bba846564198bf7be3743d08db67d815517d3c0d9bc8e08c08e35b490081b12aN.exe	44
PID 2968 wrote to memory of 536	2968	bba846564198bf7be3743d08db67d815517d3c0d9bc8e08c08e35b490081b12aN.exe	44
PID 2968 wrote to memory of 536	2968	bba846564198bf7be3743d08db67d815517d3c0d9bc8e08c08e35b490081b12aN.exe	44
PID 2992 wrote to memory of 2168	2992	Unicorn-39896.exe	46
PID 2992 wrote to memory of 2168	2992	Unicorn-39896.exe	46
PID 2992 wrote to memory of 2168	2992	Unicorn-39896.exe	46
PID 2992 wrote to memory of 2168	2992	Unicorn-39896.exe	46

C:\Users\Admin\AppData\Local\Temp\bba846564198bf7be3743d08db67d815517d3c0d9bc8e08c08e35b490081b12aN.exe
"C:\Users\Admin\AppData\Local\Temp\bba846564198bf7be3743d08db67d815517d3c0d9bc8e08c08e35b490081b12aN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29512.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29512.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34831.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34831.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39730.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39896.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24987.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27530.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64260.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15425.exe
        9⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52645.exe
        10⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44759.exe
        10⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5062.exe
        9⤵
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        9⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8335.exe
        9⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44185.exe
        8⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56256.exe
        9⤵
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28285.exe
        9⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10062.exe
        9⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7313.exe
        8⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47886.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        8⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-238.exe
        7⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14486.exe
        8⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52748.exe
        8⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        8⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20587.exe
        8⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28776.exe
        7⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6811.exe
        7⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
        7⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23783.exe
        7⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40336.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31396.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-563.exe
        8⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24791.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31031.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        8⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62379.exe
        7⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61304.exe
        7⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47886.exe
        7⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11346.exe
        7⤵
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1721.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40693.exe
        7⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35560.exe
        7⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25165.exe
        7⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        7⤵
        
        PID:6240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45799.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13003.exe
        6⤵
        
        PID:4152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61471.exe
        6⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7792.exe
        6⤵
        
        PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22573.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43674.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44909.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58451.exe
        8⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52748.exe
        8⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        8⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28564.exe
        8⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46946.exe
        7⤵
        
        PID:112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-946.exe
        7⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7237.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19898.exe
        7⤵
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3746.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20086.exe
        7⤵
        
        PID:316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11367.exe
        7⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        7⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48984.exe
        7⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30483.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30968.exe
        6⤵
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
        6⤵
        
        PID:4696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48671.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21399.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23612.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29676.exe
        7⤵
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46946.exe
        8⤵
        
        PID:556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36390.exe
        8⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        8⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8335.exe
        8⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44761.exe
        7⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18797.exe
        7⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47886.exe
        7⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        7⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26146.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36609.exe
        7⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35560.exe
        7⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21081.exe
        7⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        7⤵
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34562.exe
        6⤵
        
        PID:3284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55161.exe
        6⤵
        
        PID:4904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22365.exe
        6⤵
        
        PID:5972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56264.exe
        6⤵
        
        PID:6280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30939.exe
        5⤵
        Executes dropped EXE
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17860.exe
        6⤵
        
        PID:2336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47569.exe
        6⤵
        
        PID:3864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        6⤵
        
        PID:4160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        6⤵
        
        PID:6304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37517.exe
        5⤵
        
        PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22521.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62818.exe
        5⤵
        
        PID:5836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46463.exe
        5⤵
        
        PID:6224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24114.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50607.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51541.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46946.exe
        7⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41958.exe
        8⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36390.exe
        7⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64855.exe
        8⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45748.exe
        8⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15983.exe
        8⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49296.exe
        7⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31031.exe
        7⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        7⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23956.exe
        6⤵
        
        PID:2128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32502.exe
        6⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47886.exe
        6⤵
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        6⤵
        
        PID:6184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64732.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45052.exe
        6⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36609.exe
        7⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35560.exe
        7⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25165.exe
        7⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        7⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16743.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49296.exe
        6⤵
        
        PID:4852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56512.exe
        6⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64790.exe
        6⤵
        
        PID:6368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65456.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47326.exe
        5⤵
        
        PID:3696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22685.exe
        5⤵
        
        PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7792.exe
        5⤵
        
        PID:6168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7720.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39481.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46946.exe
        6⤵
        
        PID:2448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57195.exe
        6⤵
        
        PID:3840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        6⤵
        
        PID:4464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        6⤵
        
        PID:6472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57749.exe
        5⤵
        
        PID:580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6811.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
        5⤵
        
        PID:4328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56264.exe
        5⤵
        
        PID:6160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10051.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55332.exe
        5⤵
        
        PID:2120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36609.exe
        6⤵
        
        PID:3388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35560.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21081.exe
        6⤵
        
        PID:5812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        6⤵
        
        PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20827.exe
        5⤵
        
        PID:3252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49296.exe
        5⤵
        
        PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31031.exe
        5⤵
        
        PID:5908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        5⤵
        
        PID:6312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62162.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14678.exe
        5⤵
        
        PID:1588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52748.exe
        5⤵
        
        PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        5⤵
        
        PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        5⤵
        
        PID:6272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2041.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64213.exe
      4⤵
      PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18220.exe
      4⤵
      PID:2268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46463.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48453.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48453.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48064.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50607.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60202.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53640.exe
        7⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17995.exe
        8⤵
        
        PID:1320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16567.exe
        8⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        8⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28564.exe
        8⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32284.exe
        7⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6811.exe
        7⤵
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
        7⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56264.exe
        7⤵
        
        PID:5692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1262.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53520.exe
        7⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38047.exe
        7⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        7⤵
        
        PID:6056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18218.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22685.exe
        6⤵
        
        PID:4476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7792.exe
        6⤵
        
        PID:5284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19340.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        6⤵
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8928.exe
        7⤵
        
        PID:876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36390.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        7⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30017.exe
        7⤵
        
        PID:6548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27080.exe
        6⤵
        
        PID:1820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50126.exe
        6⤵
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47886.exe
        6⤵
        
        PID:2960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40319.exe
        6⤵
        
        PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38094.exe
        5⤵
        
        PID:108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63879.exe
        6⤵
        
        PID:2900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52748.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        6⤵
        
        PID:928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50594.exe
        5⤵
        
        PID:408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63683.exe
        5⤵
        
        PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22685.exe
        5⤵
        
        PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7792.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10321.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59626.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31378.exe
        6⤵
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40693.exe
        7⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35560.exe
        7⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25165.exe
        7⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        7⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20827.exe
        6⤵
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49296.exe
        6⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31031.exe
        6⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        6⤵
        
        PID:6360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57781.exe
        5⤵
        
        PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34881.exe
        5⤵
        
        PID:4248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29381.exe
        5⤵
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56264.exe
        5⤵
        
        PID:5224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-486.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57340.exe
        5⤵
        
        PID:2644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9665.exe
        6⤵
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24952.exe
        6⤵
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        6⤵
        
        PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50126.exe
        5⤵
        
        PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6526.exe
        5⤵
        
        PID:5704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        5⤵
        
        PID:5168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29411.exe
      4⤵
      PID:1968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33677.exe
        5⤵
        
        PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53733.exe
        5⤵
        
        PID:4384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        5⤵
        
        PID:6464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29707.exe
      4⤵
      PID:3748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29960.exe
      4⤵
      PID:4864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22895.exe
      4⤵
      PID:5952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51798.exe
      4⤵
      PID:6264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21705.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21705.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13274.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47073.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28062.exe
        6⤵
        
        PID:112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30478.exe
        6⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49878.exe
        6⤵
        
        PID:4092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18452.exe
        6⤵
        
        PID:4192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56264.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4112.exe
        5⤵
        
        PID:2476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59385.exe
        5⤵
        
        PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29381.exe
        5⤵
        
        PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56264.exe
        5⤵
        
        PID:6152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60264.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65472.exe
        5⤵
        
        PID:2840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28768.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52748.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        6⤵
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        6⤵
        
        PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24854.exe
        5⤵
        
        PID:2564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55492.exe
        5⤵
        
        PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47886.exe
        5⤵
        
        PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        5⤵
        
        PID:5460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15047.exe
      4⤵
      PID:1580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5767.exe
      4⤵
      PID:3916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39751.exe
      4⤵
      PID:4416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51798.exe
      4⤵
      PID:6128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37898.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37898.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19061.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54180.exe
        5⤵
        
        PID:1044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25125.exe
        6⤵
        
        PID:3564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29228.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        6⤵
        
        PID:6256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30640.exe
        5⤵
        
        PID:3824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49296.exe
        5⤵
        
        PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26947.exe
        5⤵
        
        PID:5868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        5⤵
        
        PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51803.exe
      4⤵
      PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36609.exe
        5⤵
        
        PID:3380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35560.exe
        5⤵
        
        PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25165.exe
        5⤵
        
        PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        5⤵
        
        PID:6208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48460.exe
      4⤵
      PID:3788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55161.exe
      4⤵
      PID:4828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18281.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56264.exe
      4⤵
      PID:5156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30550.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30550.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45856.exe
      4⤵
      PID:1060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15509.exe
        5⤵
        
        PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4853.exe
        5⤵
        
        PID:6052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50126.exe
      4⤵
      PID:3756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47886.exe
      4⤵
      PID:4292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
      4⤵
      PID:5268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25782.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25782.exe
    3⤵
    PID:1236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51435.exe
      4⤵
      PID:1156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52748.exe
      4⤵
      PID:3632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
      4⤵
      PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12419.exe
      4⤵
      PID:5600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31359.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31359.exe
    3⤵
    PID:2060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42682.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42682.exe
    3⤵
    PID:1148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58769.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58769.exe
    3⤵
    PID:5208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50663.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50663.exe
    3⤵
    PID:6176
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19049.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19049.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6865.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6865.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27836.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42055.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22761.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31731.exe
        7⤵
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51030.exe
        8⤵
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36390.exe
        8⤵
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        8⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        8⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe
        7⤵
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50126.exe
        7⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47886.exe
        7⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        7⤵
        
        PID:6200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9810.exe
        6⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-371.exe
        7⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47569.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        7⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        7⤵
        
        PID:6440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40318.exe
        6⤵
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1632.exe
        6⤵
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
        6⤵
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48671.exe
        6⤵
        
        PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2895.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31731.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8731.exe
        7⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47569.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        7⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        7⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10246.exe
        6⤵
        
        PID:2556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61304.exe
        6⤵
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47886.exe
        6⤵
        
        PID:4320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        6⤵
        
        PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23545.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36614.exe
        6⤵
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11367.exe
        6⤵
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        6⤵
        
        PID:5108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        6⤵
        
        PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27797.exe
        5⤵
        
        PID:2228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16708.exe
        6⤵
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47569.exe
        6⤵
        
        PID:1224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        6⤵
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28564.exe
        6⤵
        
        PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        5⤵
        
        PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41968.exe
        5⤵
        
        PID:4068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39751.exe
        5⤵
        
        PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51798.exe
        5⤵
        
        PID:6048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54862.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32718.exe
        5⤵
        
        PID:860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40693.exe
        6⤵
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35560.exe
        6⤵
        
        PID:4984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25165.exe
        6⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        6⤵
        
        PID:6248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30478.exe
        5⤵
        
        PID:3192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55161.exe
        5⤵
        
        PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18281.exe
        5⤵
        
        PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23783.exe
        5⤵
        
        PID:5380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46179.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11668.exe
        5⤵
        
        PID:2812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-620.exe
        6⤵
        
        PID:3524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35560.exe
        6⤵
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21081.exe
        6⤵
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19504.exe
        5⤵
        
        PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49296.exe
        5⤵
        
        PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56512.exe
        5⤵
        
        PID:5844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64128.exe
        5⤵
        
        PID:6116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20958.exe
        5⤵
        
        PID:6544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45996.exe
      4⤵
      PID:2264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36609.exe
        5⤵
        
        PID:3360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35560.exe
        5⤵
        
        PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21081.exe
        5⤵
        
        PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        5⤵
        
        PID:6096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27678.exe
      4⤵
      PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29960.exe
      4⤵
      PID:4872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18811.exe
      4⤵
      PID:5828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51798.exe
      4⤵
      PID:6132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36558.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36558.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46139.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19061.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27080.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50126.exe
        6⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47886.exe
        6⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31958.exe
        5⤵
        
        PID:884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59821.exe
        6⤵
        
        PID:3224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18638.exe
        6⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18806.exe
        6⤵
        
        PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50126.exe
        5⤵
        
        PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7237.exe
        5⤵
        
        PID:1284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30287.exe
        5⤵
        
        PID:6616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19615.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7968.exe
        5⤵
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36609.exe
        6⤵
        
        PID:3340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35560.exe
        6⤵
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21081.exe
        6⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        6⤵
        
        PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5259.exe
        5⤵
        
        PID:3508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49296.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31031.exe
        5⤵
        
        PID:5888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        5⤵
        
        PID:2136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5538.exe
      4⤵
      PID:2616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5250.exe
        5⤵
        
        PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4853.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55991.exe
      4⤵
      PID:3656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
      4⤵
      PID:5100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4816.exe
      4⤵
      PID:6536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3060.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3060.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47073.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9634.exe
        5⤵
        
        PID:1032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44964.exe
        5⤵
        
        PID:3784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        5⤵
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48984.exe
        5⤵
        
        PID:5396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63666.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30302.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47886.exe
      4⤵
      PID:2440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65207.exe
      4⤵
      PID:5624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54976.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54976.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14849.exe
      4⤵
      PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13744.exe
        5⤵
        
        PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54627.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10062.exe
        5⤵
        
        PID:5876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11367.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22368.exe
      4⤵
      PID:5248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48104.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48104.exe
    3⤵
    PID:836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36609.exe
      4⤵
      PID:3320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21252.exe
      4⤵
      PID:3088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12419.exe
      4⤵
      PID:5608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11143.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11143.exe
    3⤵
    PID:3228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47026.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47026.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1365.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1365.exe
    3⤵
    PID:5928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50547.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50547.exe
    3⤵
    PID:6412
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12987.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12987.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56424.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56424.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9190.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39481.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12571.exe
        6⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7828.exe
        7⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35560.exe
        7⤵
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25165.exe
        7⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        7⤵
        
        PID:6456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16743.exe
        6⤵
        
        PID:3152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49296.exe
        6⤵
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31031.exe
        6⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48679.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9810.exe
        5⤵
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22136.exe
        6⤵
        
        PID:964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47569.exe
        6⤵
        
        PID:3944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        6⤵
        
        PID:4680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12419.exe
        6⤵
        
        PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37111.exe
        5⤵
        
        PID:1740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25753.exe
        5⤵
        
        PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        5⤵
        
        PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32143.exe
        5⤵
        
        PID:2888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55988.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15828.exe
        5⤵
        
        PID:1620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14849.exe
        6⤵
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11367.exe
        6⤵
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        6⤵
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8335.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8388.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35125.exe
        6⤵
        
        PID:3728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30314.exe
        6⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10062.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25102.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47886.exe
        5⤵
        
        PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        5⤵
        
        PID:5536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34201.exe
      4⤵
      PID:992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32338.exe
        5⤵
        
        PID:1268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53520.exe
        5⤵
        
        PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38047.exe
        5⤵
        
        PID:5560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        5⤵
        
        PID:5672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36349.exe
      4⤵
      PID:2300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22302.exe
      4⤵
      PID:3932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22685.exe
      4⤵
      PID:4964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7792.exe
      4⤵
      PID:5160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18297.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18297.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22761.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36391.exe
        5⤵
        
        PID:2380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28062.exe
        6⤵
        
        PID:1868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11367.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1372.exe
        6⤵
        
        PID:4112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8335.exe
        6⤵
        
        PID:5544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34885.exe
        5⤵
        
        PID:2856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58699.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47886.exe
        5⤵
        
        PID:4432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        5⤵
        
        PID:6344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15949.exe
      4⤵
      PID:2352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18545.exe
        5⤵
        
        PID:1712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6152.exe
        5⤵
        
        PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11185.exe
        5⤵
        
        PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        5⤵
        
        PID:1104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34562.exe
      4⤵
      PID:3300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55161.exe
      4⤵
      PID:4844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22365.exe
      4⤵
      PID:5920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56264.exe
      4⤵
      PID:1084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1254.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1254.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4979.exe
      4⤵
      PID:1092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40693.exe
        5⤵
        
        PID:3428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35560.exe
        5⤵
        
        PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25165.exe
        5⤵
        
        PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20011.exe
        5⤵
        
        PID:6404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44013.exe
      4⤵
      PID:3236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31202.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
      4⤵
      PID:6296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5290.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5290.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36609.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33312.exe
      4⤵
      PID:4360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
      4⤵
      PID:5676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31762.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31762.exe
    3⤵
    PID:3276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29960.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29960.exe
    3⤵
    PID:4916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22895.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22895.exe
    3⤵
    PID:5944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51798.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51798.exe
    3⤵
    PID:6140
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47991.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47991.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39760.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39760.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65412.exe
      4⤵
      PID:320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11860.exe
        5⤵
        
        PID:2024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36390.exe
        6⤵
        
        PID:3668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        6⤵
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47121.exe
        6⤵
        
        PID:6672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36390.exe
        5⤵
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        5⤵
        
        PID:2140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        5⤵
        
        PID:6092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32643.exe
      4⤵
      PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49764.exe
        5⤵
        
        PID:1368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30464.exe
        5⤵
        
        PID:3908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        5⤵
        
        PID:4140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20011.exe
        5⤵
        
        PID:6380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10577.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1632.exe
      4⤵
      PID:4116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
      4⤵
      PID:4736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48671.exe
      4⤵
      PID:5472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50538.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50538.exe
    3⤵
    PID:1852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30444.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39955.exe
        5⤵
        
        PID:3216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39815.exe
        5⤵
        
        PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16318.exe
        5⤵
        
        PID:6068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30277.exe
      4⤵
      PID:3176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25336.exe
      4⤵
      PID:4236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
      4⤵
      PID:6320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7703.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7703.exe
    3⤵
    PID:2500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40693.exe
      4⤵
      PID:3420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33312.exe
      4⤵
      PID:4348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20011.exe
      4⤵
      PID:6388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27678.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27678.exe
    3⤵
    PID:3200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29960.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29960.exe
    3⤵
    PID:4888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22895.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22895.exe
    3⤵
    PID:5936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51798.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51798.exe
    3⤵
    PID:6192
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29232.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29232.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63601.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63601.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40283.exe
      4⤵
      PID:1752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63879.exe
        5⤵
        
        PID:1484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52748.exe
        5⤵
        
        PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        5⤵
        
        PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20011.exe
        5⤵
        
        PID:6420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30993.exe
      4⤵
      PID:936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-946.exe
      4⤵
      PID:3140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47886.exe
      4⤵
      PID:4300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
      4⤵
      PID:6080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16525.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16525.exe
    3⤵
    PID:2100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30112.exe
      4⤵
      PID:588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47569.exe
      4⤵
      PID:3912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
      4⤵
      PID:4956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
      4⤵
      PID:4460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7261.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7261.exe
    3⤵
    PID:2872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1632.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1632.exe
    3⤵
    PID:4124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
    3⤵
    PID:4204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56264.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56264.exe
    3⤵
    PID:6336
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26843.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26843.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17995.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17995.exe
    3⤵
    PID:2256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16567.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16567.exe
    3⤵
    PID:3992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9131.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9131.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32700.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32700.exe
    3⤵
    PID:7108
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30015.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30015.exe
  2⤵
  PID:2936
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42682.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42682.exe
  2⤵
  PID:3400
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12885.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12885.exe
  2⤵
  PID:4224
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50663.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50663.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12987.exe

Filesize
468KB

MD5
1acd58ab74ad1c20c82901d74f069d47

SHA1
a244f20e67fc7bffe2d3f63c01f843a9ab3dbbef

SHA256
677f56c4bec139081cbe6fcd2c772d4f1b8c2794f896956313414eb302868cf5

SHA512
b2c43f796fb92d712ac16aab9e42971b3a1b3b7206b80aa1b7b28e82764909e2bfdbf132866f49fbdb78f028a6ffe6911413b84d1c9a99e096f9b7053232e5b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16318.exe

Filesize
468KB

MD5
0a363b9089750417b56fa475d6058004

SHA1
2b5e04e28cf55a925eef91999f49b1390a13ef18

SHA256
34143453d882aca2d5f1d5aeaedcb292b15ccd185637247151cfc4b7ce3dade8

SHA512
fe2bca8714f43c266ec4ceb6739ef44187f08a5bfb3dc8ff0b939355a5ef9bf99ff6d12fbca25cbd1a86d76012e5640f0bc30f3321c0f729a932677c6fbf44d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19049.exe

Filesize
468KB

MD5
915720075212871f620b5288594b5365

SHA1
d8d03d96939ed855642922d939588b4e3f80997f

SHA256
c4527c70cebdd3112e8d85c8433368e164b1cd0398012efcd49e21bfd0194bdc

SHA512
cb5c56e07b27d7b3d52fcc6f54ed6aa992a459d22ff37e22cb3fa634c1d469307293fbf23339b564a42faddc47a84c98892ba89836ced657f40d37c09f8e044b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24114.exe

Filesize
468KB

MD5
3ffb926d380d6acbfe21cccb07af5dbf

SHA1
229526602988d7e5cbf15581ef7631b117df3257

SHA256
c2a2f26b34433c0b58b4b0166adedb87baa7e7929d5dad3e6203beb67ec51808

SHA512
12a5d6815cc728f4266ce80822ca4637357da8ed548655ee314e726cfe0a80eda022dc69a6a1e0207200b794d7c9a32464d44d3106391b819f3e5fbb7e5579d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36558.exe

Filesize
468KB

MD5
e8da4714d76b83256dfa78fa6539cd64

SHA1
0a9428f7e4e863717ce94185783168ff7f6d6a11

SHA256
8009e72470f0f123dbf43ba7ab641889e02728d24ab1ee8cd8056308607c2388

SHA512
e2e8da22cc990b81d3b93d7153bfdf9c7b0e4c9f68c3277da6aae729afb313a2c5c45d3353411fe653370f348a1387af756e1c810cf53f3fd2272a542c2cfd3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39730.exe

Filesize
468KB

MD5
6108f83b97ace24e1857df6a42adfd5a

SHA1
bd5c52d15a609272fbc9b65e22fb8450a35f520b

SHA256
f22bbd30ce06587dda3bad189bee6ebbbd6b0929a9f908ad97e25498414023c2

SHA512
0e4252d34856f657870d09111dc24d4a663b9f308dc0df432609076d9883c8f09855f09b0d6e8cc19d41285bd0d10f84957e3eb01ee02ccc3fc28843b0a96fac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39896.exe

Filesize
468KB

MD5
19f081d0aeae190d5668de293bb4d490

SHA1
53c35f6c41c92db47e757305078bf772eab9ef52

SHA256
f23f3ecc600ff3bd598f4cfe5a2c6cf667bf24ca73424b53c43d3e6bf9941fc5

SHA512
a12c3c5d3d6c01b3a51eb04fa364473ed7223fc44b22e19148da262ce26b3eb8af78d792aae870c58ec2984de28ae2c88b99e5c7b764f4b2a769ebe886a87706

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39955.exe

Filesize
468KB

MD5
ac52587551e41db98afb84cb62cd7a6b

SHA1
ec33d82d4128524eef30a4ac3e7da698f87de0b8

SHA256
8631f2141286a01f087c4c6b38156313f7963fb4d12784927336fa657935e2e9

SHA512
8d9f5cebcca65624c04d1fa9a05e2f9374aa4cc44aace192c0f4424370f1286ea900b4bbeb75e3c5c4e00fdd5e666d4d7f4c383114306005aaefb0134b9f603d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47991.exe

Filesize
468KB

MD5
0994192de113c71ad536d109e813961f

SHA1
78c3ee825b6d48a0de31e9c6d868f579a2176b99

SHA256
10a2c730664dcf82cb557e73895ac0a743d830ea16c32a29e5b7a0984e073c93

SHA512
9b1c10990c7564f8838e13d0c0bbd455cc31c0a27db91556442deaaf16ce59fcd9ab68a0d8378ec789d30f4bc31f9ebea06f2b160a4969db596e3ecb3676d271

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48064.exe

Filesize
468KB

MD5
21d8163d811b3f9928f9ac85198d3bf4

SHA1
7cf4f1a802cd28a7f6fc4227d6468cacfa633fa0

SHA256
1ae910c2c8cfce7feda73bcbf611189572a0bb7a20b1d31a16250137df87e0e7

SHA512
03b1b7eb993dcce71a103c125ef2f867e3c60557fef2b0757b2464192d2dbdc11c9d2d14c0d1a1996b13a463a7d88e4ba89e952d8628a27f3b32d0eebb2587fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56424.exe

Filesize
468KB

MD5
3fe2ac2f2fff15dbfdad3dfbb1a10f10

SHA1
aea749917bd73e59831d67c5d7ba018a403ae174

SHA256
33bc03311918550974d6b48a12db12df7425149e6c2aed1be7e6e51e17db8041

SHA512
77dd8e8bd309d576d4429cd566ad9beae85cbfc54ed538c7042839b7857551b06785bffc0aeff9c82f73e0fb56c537b7cc6135f348857d9de19a48d3d27d9d07

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-21705.exe

Filesize
468KB

MD5
5e0271392ce8e54e233bc1d4cb5ba673

SHA1
b914322617b1ad51b87929140a02b4008d30cff9

SHA256
6ef4059d34b1add8dda2c97ed734153da65cef7c6d365573c7373db53572689f

SHA512
75e49134ceb3b357dd414b490a98877dad7a2ead4b24d5c6ac59ce104e6539bb407e954befbceff0c5a23e8be74d744fa65881129a7d9c4487f31fda1d766343

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22573.exe

Filesize
468KB

MD5
2ae15ffc2f8a4d0a08b7645ad6cb5edf

SHA1
8b5eb54691c5d0e6f85a40ae68b66efd048a8c56

SHA256
3999626d4b8b4f7c8e4f4d010c01ae22bbde2a514d15f53ec9e4f46193d009bb

SHA512
e1bf2717cf9df2b4a0a12d3092af5044fa2a1c086cc332e24e0fc38e72f5fea0243d8deddd4b5358e67b5603599b5550ee82190a145c00a20d0a7546e0b00db2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24987.exe

Filesize
468KB

MD5
91b6b623a1598a0eba790fd6e657c6e1

SHA1
825749c5df437c6dad63990cd507bce80b3a622c

SHA256
ec45ff25fa4c9e95a0d3638469bf522f39c51d54445bbd4a2406cc4b6b8fcaaf

SHA512
68d5158d6ca28d74f8c28fa7343f22b9d1444b41bc0eb66fc39af38edebe2090f01ad6cf5371789be93b302ac9d6484f8ac98af4fbb73fa1c80f05ff3b9e8cfe

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27836.exe

Filesize
468KB

MD5
127dd052c84df336d795dcef440e46ba

SHA1
28193b1fde7fe2e0d73eae5dc8d998801331cc3c

SHA256
5b8b6d7657e7aae7de0eea82c6b75a999275f10608c29a7fbd8498dd29e9083f

SHA512
c364e2702ac98662ee2b7899abcaf4817f176730844e7d7b0fe77dbd9caf0b949e1416dd2259af0e2fcb6281229fe631db741e6c3e87333498eaf9c40dab1f5c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29512.exe

Filesize
468KB

MD5
ccb34dc413991f40c20f8a752861f58d

SHA1
5c2ba2a154bdbb38556c694e9e16668acc4ef14f

SHA256
500ea3a6e5387726daf11cb7f733cf82deb25da0c7067134dd0a47e4ed72cccc

SHA512
a6f737ff84bf8af36b372fa772798871c8337d6ca4e76b2bb42edd5948c8f64e4fed746ad8e8c7d6d7b54a511c89a110475c3bb777b2aa51428d91cbfb825146

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34831.exe

Filesize
468KB

MD5
e99c553401633419afa9dfd172f8bb4a

SHA1
5d56f2150d6129526976506ff0cd206bd9080662

SHA256
0726db59ece79891a750ccca2a5d58977bba774088ccbabc0d966aa352850c14

SHA512
eb5f476185e48142703012786b423d69b204de31f8d5e8d43744358f7515106d36e046f03d1949d3da6af6cf1ddca09aac25dc6f29f089feb26f46f3277c6531

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-48453.exe

Filesize
468KB

MD5
e0d40bc4b859f213a8fa0122392da66b

SHA1
7b49406b237b49d777c88868794dd1d895159805

SHA256
e36da4d74d14178cff949f57eb18708189bb7940ad5485c2bf906c52d44aa512

SHA512
59223c399d5b95f711e8d63efd96a2537742a7f2a4e5ae3a42f1df24c3ea4b31bf014447237dd16045460e930c7bb2d05ae649d9592bf2db599ef7e58304d5c9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-50607.exe

Filesize
468KB

MD5
bdb7ae369037e3b3a97611d16c2b4978

SHA1
8e8ef65cfa57ec34212890245c9efdf60c3923a2

SHA256
dc957662fe0970d6f6e42fb2bab232621c162f69eb0c433639773641ad345a24

SHA512
c374093c656d9a723379510d215ef448476395bbdbe47436b41a7cbc765d38c2a0ce542e94db7b3deea599fa99f37817945cc1d6a6e7fd6fed82e319fa0f50cd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-6865.exe

Filesize
468KB

MD5
5cfdab6a14ecba6b16fbab44a7dbba88

SHA1
682bbbff9c18100cba34d26f8d2f0e4e23bc4292

SHA256
754262edfe72249b9fa694cc77714fd097eccd269f6f593093d95d8cd1d8ec93

SHA512
86233b91d26f0d27baf7f2622c7eaf69f494654b7aef03f9ff0209b5fc4cd5bd70c4fdbf8fa311dbeca58fb502d3c4f4404686236cc76da499c8c78534c9d505

Download Submit
memory/492-232-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/536-173-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/536-400-0x0000000002810000-0x0000000002885000-memory.dmp

Filesize
468KB

Download
memory/536-392-0x0000000003340000-0x00000000033B5000-memory.dmp

Filesize
468KB

Download
memory/572-257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/572-437-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/796-290-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/920-253-0x0000000003420000-0x0000000003495000-memory.dmp

Filesize
468KB

Download
memory/920-256-0x0000000003420000-0x0000000003495000-memory.dmp

Filesize
468KB

Download
memory/920-171-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1192-425-0x0000000002420000-0x0000000002495000-memory.dmp

Filesize
468KB

Download
memory/1560-426-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1564-115-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1564-218-0x00000000028E0000-0x0000000002955000-memory.dmp

Filesize
468KB

Download
memory/1564-380-0x00000000028E0000-0x0000000002955000-memory.dmp

Filesize
468KB

Download
memory/1564-381-0x00000000028E0000-0x0000000002955000-memory.dmp

Filesize
468KB

Download
memory/1592-373-0x00000000033B0000-0x0000000003425000-memory.dmp

Filesize
468KB

Download
memory/1592-372-0x00000000033B0000-0x0000000003425000-memory.dmp

Filesize
468KB

Download
memory/1592-220-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1604-241-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1604-394-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1604-395-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1656-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1680-314-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1704-172-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1704-285-0x0000000002920000-0x0000000002995000-memory.dmp

Filesize
468KB

Download
memory/1708-217-0x0000000000670000-0x00000000006E5000-memory.dmp

Filesize
468KB

Download
memory/1708-439-0x0000000000670000-0x00000000006E5000-memory.dmp

Filesize
468KB

Download
memory/1708-436-0x0000000000670000-0x00000000006E5000-memory.dmp

Filesize
468KB

Download
memory/1708-112-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1708-219-0x0000000000670000-0x00000000006E5000-memory.dmp

Filesize
468KB

Download
memory/1804-156-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1808-417-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1856-258-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2080-289-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2124-252-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2124-247-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2124-155-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2168-195-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2168-354-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2168-352-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2188-231-0x0000000002460000-0x00000000024D5000-memory.dmp

Filesize
468KB

Download
memory/2188-48-0x0000000002460000-0x00000000024D5000-memory.dmp

Filesize
468KB

Download
memory/2188-33-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2188-230-0x0000000002460000-0x00000000024D5000-memory.dmp

Filesize
468KB

Download
memory/2224-305-0x00000000026F0000-0x0000000002765000-memory.dmp

Filesize
468KB

Download
memory/2224-12-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2224-31-0x00000000026F0000-0x0000000002765000-memory.dmp

Filesize
468KB

Download
memory/2224-153-0x00000000026F0000-0x0000000002765000-memory.dmp

Filesize
468KB

Download
memory/2224-304-0x00000000026F0000-0x0000000002765000-memory.dmp

Filesize
468KB

Download
memory/2372-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2388-307-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2388-438-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2408-36-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2408-286-0x0000000002830000-0x00000000028A5000-memory.dmp

Filesize
468KB

Download
memory/2408-157-0x0000000002830000-0x00000000028A5000-memory.dmp

Filesize
468KB

Download
memory/2408-158-0x0000000002830000-0x00000000028A5000-memory.dmp

Filesize
468KB

Download
memory/2464-412-0x0000000002920000-0x0000000002995000-memory.dmp

Filesize
468KB

Download
memory/2464-62-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2464-416-0x0000000002920000-0x0000000002995000-memory.dmp

Filesize
468KB

Download
memory/2464-239-0x0000000002920000-0x0000000002995000-memory.dmp

Filesize
468KB

Download
memory/2464-235-0x0000000002920000-0x0000000002995000-memory.dmp

Filesize
468KB

Download
memory/2468-335-0x0000000001DD0000-0x0000000001E45000-memory.dmp

Filesize
468KB

Download
memory/2468-337-0x0000000001DD0000-0x0000000001E45000-memory.dmp

Filesize
468KB

Download
memory/2468-208-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2472-306-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2504-288-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2600-374-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2612-154-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2612-284-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2612-81-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2640-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2684-339-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2692-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2696-356-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2728-309-0x0000000002820000-0x0000000002895000-memory.dmp

Filesize
468KB

Download
memory/2728-313-0x0000000002820000-0x0000000002895000-memory.dmp

Filesize
468KB

Download
memory/2728-80-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2748-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2792-206-0x00000000026B0000-0x0000000002725000-memory.dmp

Filesize
468KB

Download
memory/2792-207-0x00000000026B0000-0x0000000002725000-memory.dmp

Filesize
468KB

Download
memory/2792-49-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2792-350-0x00000000026B0000-0x0000000002725000-memory.dmp

Filesize
468KB

Download
memory/2792-351-0x00000000026B0000-0x0000000002725000-memory.dmp

Filesize
468KB

Download
memory/2968-303-0x0000000001DA0000-0x0000000001E15000-memory.dmp

Filesize
468KB

Download
memory/2968-10-0x0000000001DA0000-0x0000000001E15000-memory.dmp

Filesize
468KB

Download
memory/2968-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2968-418-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2968-167-0x0000000001DA0000-0x0000000001E15000-memory.dmp

Filesize
468KB

Download
memory/2968-166-0x0000000001DA0000-0x0000000001E15000-memory.dmp

Filesize
468KB

Download
memory/2992-193-0x00000000028E0000-0x0000000002955000-memory.dmp

Filesize
468KB

Download
memory/2992-192-0x0000000003410000-0x0000000003485000-memory.dmp

Filesize
468KB

Download
memory/2992-370-0x0000000003410000-0x0000000003485000-memory.dmp

Filesize
468KB

Download
memory/2992-369-0x0000000003410000-0x0000000003485000-memory.dmp

Filesize
468KB

Download
memory/2992-95-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2996-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download