d96ebb74bbfec2669efa71047ded4ddc998f15feed415f7fd1a7982f269c8b9e

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 21:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d96ebb74bbfec2669efa71047ded4ddc998f15feed415f7fd1a7982f269c8b9eN.exe
Size

468KB
MD5

24f0ace8430ec639d12d89afdff24a40
SHA1

677eab36d6a6d0434ed650f91dfeacc412afb6fc
SHA256

d96ebb74bbfec2669efa71047ded4ddc998f15feed415f7fd1a7982f269c8b9e
SHA512

5debb4b06b8f90e962b159cbe00eb6b8405fbaaf46e71d50104c1aa3f9d4625c61f115df30f58f3d15552e5c884245490235f162b8c0fb61d8e1ffd9cb664060
SSDEEP

3072:pq0RogFdjY8U2bxAPz7Wff5kChgWXpXkmHevVpfn98Cd3r9a4yAlL:pqyoq1U2OPvWff/5un98C9Za4y

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2032	Unicorn-25243.exe
1080	Unicorn-40593.exe
2664	Unicorn-55538.exe
2760	Unicorn-34646.exe
2776	Unicorn-63326.exe
2908	Unicorn-3919.exe
2560	Unicorn-37146.exe
2148	Unicorn-10032.exe
2872	Unicorn-12481.exe
2748	Unicorn-4578.exe
2952	Unicorn-33913.exe
696	Unicorn-53779.exe
1136	Unicorn-47649.exe
2524	Unicorn-60349.exe
784	Unicorn-63042.exe
1152	Unicorn-28253.exe
1232	Unicorn-10333.exe
2216	Unicorn-24068.exe
1548	Unicorn-31574.exe
1972	Unicorn-28061.exe
1708	Unicorn-19893.exe
896	Unicorn-19627.exe
556	Unicorn-38367.exe
3024	Unicorn-19378.exe
2112	Unicorn-33113.exe
3020	Unicorn-39244.exe
2272	Unicorn-19378.exe
2472	Unicorn-42726.exe
1704	Unicorn-39196.exe
2300	Unicorn-52932.exe
2088	Unicorn-11807.exe
2136	Unicorn-20067.exe
2756	Unicorn-26198.exe
2680	Unicorn-49887.exe
3060	Unicorn-30858.exe
2884	Unicorn-22498.exe
2860	Unicorn-40707.exe
2876	Unicorn-36888.exe
2628	Unicorn-14229.exe
660	Unicorn-20094.exe
316	Unicorn-20360.exe
1928	Unicorn-63430.exe
1956	Unicorn-44094.exe
2544	Unicorn-21735.exe
1964	Unicorn-53032.exe
2408	Unicorn-44864.exe
412	Unicorn-24998.exe
3000	Unicorn-59254.exe
1772	Unicorn-59254.exe
664	Unicorn-39388.exe
1676	Unicorn-35880.exe
984	Unicorn-50271.exe
1500	Unicorn-41417.exe
2324	Unicorn-22389.exe
1588	Unicorn-25081.exe
2792	Unicorn-57007.exe
2296	Unicorn-13928.exe
2424	Unicorn-7806.exe
1916	Unicorn-26592.exe
2724	Unicorn-26857.exe
1892	Unicorn-56192.exe
2880	Unicorn-59529.exe
1432	Unicorn-18231.exe
1864	Unicorn-64168.exe

Loads dropped DLL 64 IoCs

pid	Process
2248	d96ebb74bbfec2669efa71047ded4ddc998f15feed415f7fd1a7982f269c8b9eN.exe
2248	d96ebb74bbfec2669efa71047ded4ddc998f15feed415f7fd1a7982f269c8b9eN.exe
2032	Unicorn-25243.exe
2032	Unicorn-25243.exe
2248	d96ebb74bbfec2669efa71047ded4ddc998f15feed415f7fd1a7982f269c8b9eN.exe
2248	d96ebb74bbfec2669efa71047ded4ddc998f15feed415f7fd1a7982f269c8b9eN.exe
2664	Unicorn-55538.exe
2664	Unicorn-55538.exe
2248	d96ebb74bbfec2669efa71047ded4ddc998f15feed415f7fd1a7982f269c8b9eN.exe
2248	d96ebb74bbfec2669efa71047ded4ddc998f15feed415f7fd1a7982f269c8b9eN.exe
1080	Unicorn-40593.exe
1080	Unicorn-40593.exe
2032	Unicorn-25243.exe
2032	Unicorn-25243.exe
2776	Unicorn-63326.exe
2776	Unicorn-63326.exe
2248	d96ebb74bbfec2669efa71047ded4ddc998f15feed415f7fd1a7982f269c8b9eN.exe
2248	d96ebb74bbfec2669efa71047ded4ddc998f15feed415f7fd1a7982f269c8b9eN.exe
2560	Unicorn-37146.exe
2560	Unicorn-37146.exe
1080	Unicorn-40593.exe
2032	Unicorn-25243.exe
1080	Unicorn-40593.exe
2032	Unicorn-25243.exe
2908	Unicorn-3919.exe
2908	Unicorn-3919.exe
2148	Unicorn-10032.exe
2148	Unicorn-10032.exe
2776	Unicorn-63326.exe
2776	Unicorn-63326.exe
2872	Unicorn-12481.exe
2872	Unicorn-12481.exe
2760	Unicorn-34646.exe
2664	Unicorn-55538.exe
2760	Unicorn-34646.exe
2664	Unicorn-55538.exe
2248	d96ebb74bbfec2669efa71047ded4ddc998f15feed415f7fd1a7982f269c8b9eN.exe
2248	d96ebb74bbfec2669efa71047ded4ddc998f15feed415f7fd1a7982f269c8b9eN.exe
1136	Unicorn-47649.exe
1136	Unicorn-47649.exe
2952	Unicorn-33913.exe
2952	Unicorn-33913.exe
2032	Unicorn-25243.exe
2032	Unicorn-25243.exe
2748	Unicorn-4578.exe
2748	Unicorn-4578.exe
696	Unicorn-53779.exe
2560	Unicorn-37146.exe
2908	Unicorn-3919.exe
1080	Unicorn-40593.exe
2560	Unicorn-37146.exe
696	Unicorn-53779.exe
2908	Unicorn-3919.exe
1080	Unicorn-40593.exe
2524	Unicorn-60349.exe
2524	Unicorn-60349.exe
2776	Unicorn-63326.exe
2148	Unicorn-10032.exe
2148	Unicorn-10032.exe
2776	Unicorn-63326.exe
1232	Unicorn-10333.exe
1232	Unicorn-10333.exe
2760	Unicorn-34646.exe
1152	Unicorn-28253.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19627.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1536.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38139.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31466.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28061.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26592.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1536.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28166.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53166.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49544.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46744.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34646.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50200.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23551.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1536.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29052.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27925.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46744.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60743.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12938.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53338.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46250.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50391.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2971.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64273.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53338.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46385.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49544.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45652.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11807.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24019.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50391.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50391.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16799.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43382.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65279.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45652.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53691.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16918.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45652.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25190.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42256.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1536.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45460.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40069.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24754.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31374.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21775.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10466.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10032.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46696.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26316.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53338.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58626.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2248	d96ebb74bbfec2669efa71047ded4ddc998f15feed415f7fd1a7982f269c8b9eN.exe
2032	Unicorn-25243.exe
1080	Unicorn-40593.exe
2664	Unicorn-55538.exe
2776	Unicorn-63326.exe
2760	Unicorn-34646.exe
2560	Unicorn-37146.exe
2908	Unicorn-3919.exe
2148	Unicorn-10032.exe
2872	Unicorn-12481.exe
696	Unicorn-53779.exe
2952	Unicorn-33913.exe
1136	Unicorn-47649.exe
2748	Unicorn-4578.exe
784	Unicorn-63042.exe
2524	Unicorn-60349.exe
1232	Unicorn-10333.exe
1152	Unicorn-28253.exe
2216	Unicorn-24068.exe
1548	Unicorn-31574.exe
1972	Unicorn-28061.exe
1708	Unicorn-19893.exe
896	Unicorn-19627.exe
556	Unicorn-38367.exe
3020	Unicorn-39244.exe
3024	Unicorn-19378.exe
2112	Unicorn-33113.exe
2272	Unicorn-19378.exe
2472	Unicorn-42726.exe
1704	Unicorn-39196.exe
2300	Unicorn-52932.exe
2136	Unicorn-20067.exe
2088	Unicorn-11807.exe
2756	Unicorn-26198.exe
2680	Unicorn-49887.exe
2628	Unicorn-14229.exe
2876	Unicorn-36888.exe
316	Unicorn-20360.exe
1928	Unicorn-63430.exe
3060	Unicorn-30858.exe
2860	Unicorn-40707.exe
660	Unicorn-20094.exe
1956	Unicorn-44094.exe
2544	Unicorn-21735.exe
2884	Unicorn-22498.exe
1964	Unicorn-53032.exe
2408	Unicorn-44864.exe
412	Unicorn-24998.exe
1676	Unicorn-35880.exe
1772	Unicorn-59254.exe
984	Unicorn-50271.exe
664	Unicorn-39388.exe
2324	Unicorn-22389.exe
1500	Unicorn-41417.exe
1588	Unicorn-25081.exe
2792	Unicorn-57007.exe
2296	Unicorn-13928.exe
2424	Unicorn-7806.exe
2724	Unicorn-26857.exe
1916	Unicorn-26592.exe
2880	Unicorn-59529.exe
1892	Unicorn-56192.exe
1432	Unicorn-18231.exe
1864	Unicorn-64168.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2032	2248	d96ebb74bbfec2669efa71047ded4ddc998f15feed415f7fd1a7982f269c8b9eN.exe	30
PID 2248 wrote to memory of 2032	2248	d96ebb74bbfec2669efa71047ded4ddc998f15feed415f7fd1a7982f269c8b9eN.exe	30
PID 2248 wrote to memory of 2032	2248	d96ebb74bbfec2669efa71047ded4ddc998f15feed415f7fd1a7982f269c8b9eN.exe	30
PID 2248 wrote to memory of 2032	2248	d96ebb74bbfec2669efa71047ded4ddc998f15feed415f7fd1a7982f269c8b9eN.exe	30
PID 2032 wrote to memory of 1080	2032	Unicorn-25243.exe	31
PID 2032 wrote to memory of 1080	2032	Unicorn-25243.exe	31
PID 2032 wrote to memory of 1080	2032	Unicorn-25243.exe	31
PID 2032 wrote to memory of 1080	2032	Unicorn-25243.exe	31
PID 2248 wrote to memory of 2664	2248	d96ebb74bbfec2669efa71047ded4ddc998f15feed415f7fd1a7982f269c8b9eN.exe	32
PID 2248 wrote to memory of 2664	2248	d96ebb74bbfec2669efa71047ded4ddc998f15feed415f7fd1a7982f269c8b9eN.exe	32
PID 2248 wrote to memory of 2664	2248	d96ebb74bbfec2669efa71047ded4ddc998f15feed415f7fd1a7982f269c8b9eN.exe	32
PID 2248 wrote to memory of 2664	2248	d96ebb74bbfec2669efa71047ded4ddc998f15feed415f7fd1a7982f269c8b9eN.exe	32
PID 2664 wrote to memory of 2760	2664	Unicorn-55538.exe	33
PID 2664 wrote to memory of 2760	2664	Unicorn-55538.exe	33
PID 2664 wrote to memory of 2760	2664	Unicorn-55538.exe	33
PID 2664 wrote to memory of 2760	2664	Unicorn-55538.exe	33
PID 2248 wrote to memory of 2776	2248	d96ebb74bbfec2669efa71047ded4ddc998f15feed415f7fd1a7982f269c8b9eN.exe	34
PID 2248 wrote to memory of 2776	2248	d96ebb74bbfec2669efa71047ded4ddc998f15feed415f7fd1a7982f269c8b9eN.exe	34
PID 2248 wrote to memory of 2776	2248	d96ebb74bbfec2669efa71047ded4ddc998f15feed415f7fd1a7982f269c8b9eN.exe	34
PID 2248 wrote to memory of 2776	2248	d96ebb74bbfec2669efa71047ded4ddc998f15feed415f7fd1a7982f269c8b9eN.exe	34
PID 1080 wrote to memory of 2908	1080	Unicorn-40593.exe	35
PID 1080 wrote to memory of 2908	1080	Unicorn-40593.exe	35
PID 1080 wrote to memory of 2908	1080	Unicorn-40593.exe	35
PID 1080 wrote to memory of 2908	1080	Unicorn-40593.exe	35
PID 2032 wrote to memory of 2560	2032	Unicorn-25243.exe	36
PID 2032 wrote to memory of 2560	2032	Unicorn-25243.exe	36
PID 2032 wrote to memory of 2560	2032	Unicorn-25243.exe	36
PID 2032 wrote to memory of 2560	2032	Unicorn-25243.exe	36
PID 2776 wrote to memory of 2148	2776	Unicorn-63326.exe	37
PID 2776 wrote to memory of 2148	2776	Unicorn-63326.exe	37
PID 2776 wrote to memory of 2148	2776	Unicorn-63326.exe	37
PID 2776 wrote to memory of 2148	2776	Unicorn-63326.exe	37
PID 2248 wrote to memory of 2872	2248	d96ebb74bbfec2669efa71047ded4ddc998f15feed415f7fd1a7982f269c8b9eN.exe	38
PID 2248 wrote to memory of 2872	2248	d96ebb74bbfec2669efa71047ded4ddc998f15feed415f7fd1a7982f269c8b9eN.exe	38
PID 2248 wrote to memory of 2872	2248	d96ebb74bbfec2669efa71047ded4ddc998f15feed415f7fd1a7982f269c8b9eN.exe	38
PID 2248 wrote to memory of 2872	2248	d96ebb74bbfec2669efa71047ded4ddc998f15feed415f7fd1a7982f269c8b9eN.exe	38
PID 2560 wrote to memory of 2748	2560	Unicorn-37146.exe	39
PID 2560 wrote to memory of 2748	2560	Unicorn-37146.exe	39
PID 2560 wrote to memory of 2748	2560	Unicorn-37146.exe	39
PID 2560 wrote to memory of 2748	2560	Unicorn-37146.exe	39
PID 1080 wrote to memory of 2952	1080	Unicorn-40593.exe	40
PID 1080 wrote to memory of 2952	1080	Unicorn-40593.exe	40
PID 1080 wrote to memory of 2952	1080	Unicorn-40593.exe	40
PID 1080 wrote to memory of 2952	1080	Unicorn-40593.exe	40
PID 2032 wrote to memory of 1136	2032	Unicorn-25243.exe	41
PID 2032 wrote to memory of 1136	2032	Unicorn-25243.exe	41
PID 2032 wrote to memory of 1136	2032	Unicorn-25243.exe	41
PID 2032 wrote to memory of 1136	2032	Unicorn-25243.exe	41
PID 2908 wrote to memory of 696	2908	Unicorn-3919.exe	42
PID 2908 wrote to memory of 696	2908	Unicorn-3919.exe	42
PID 2908 wrote to memory of 696	2908	Unicorn-3919.exe	42
PID 2908 wrote to memory of 696	2908	Unicorn-3919.exe	42
PID 2148 wrote to memory of 2524	2148	Unicorn-10032.exe	43
PID 2148 wrote to memory of 2524	2148	Unicorn-10032.exe	43
PID 2148 wrote to memory of 2524	2148	Unicorn-10032.exe	43
PID 2148 wrote to memory of 2524	2148	Unicorn-10032.exe	43
PID 2776 wrote to memory of 784	2776	Unicorn-63326.exe	44
PID 2776 wrote to memory of 784	2776	Unicorn-63326.exe	44
PID 2776 wrote to memory of 784	2776	Unicorn-63326.exe	44
PID 2776 wrote to memory of 784	2776	Unicorn-63326.exe	44
PID 2872 wrote to memory of 1152	2872	Unicorn-12481.exe	45
PID 2872 wrote to memory of 1152	2872	Unicorn-12481.exe	45
PID 2872 wrote to memory of 1152	2872	Unicorn-12481.exe	45
PID 2872 wrote to memory of 1152	2872	Unicorn-12481.exe	45

C:\Users\Admin\AppData\Local\Temp\d96ebb74bbfec2669efa71047ded4ddc998f15feed415f7fd1a7982f269c8b9eN.exe
"C:\Users\Admin\AppData\Local\Temp\d96ebb74bbfec2669efa71047ded4ddc998f15feed415f7fd1a7982f269c8b9eN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25243.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25243.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40593.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40593.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3919.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53779.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39244.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59254.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50650.exe
        8⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        9⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9451.exe
        9⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45460.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50391.exe
        9⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6435.exe
        8⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42119.exe
        8⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42852.exe
        8⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25190.exe
        8⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24754.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41054.exe
        7⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42119.exe
        7⤵
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42852.exe
        7⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60001.exe
        7⤵
        
        PID:6164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50271.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29571.exe
        7⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58.exe
        7⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        8⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41101.exe
        8⤵
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45652.exe
        8⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38139.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12300.exe
        7⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33453.exe
        7⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        7⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10466.exe
        7⤵
        
        PID:6468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13134.exe
        6⤵
        
        PID:628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47558.exe
        7⤵
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        6⤵
        
        PID:2840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6036.exe
        6⤵
        
        PID:5072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43382.exe
        6⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37061.exe
        6⤵
        
        PID:6452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19378.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20360.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40130.exe
        7⤵
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        8⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9451.exe
        8⤵
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7634.exe
        8⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39509.exe
        8⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1536.exe
        7⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47526.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11933.exe
        7⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12938.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7375.exe
        6⤵
        
        PID:624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59996.exe
        7⤵
        
        PID:856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        8⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60743.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42256.exe
        8⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32202.exe
        7⤵
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50366.exe
        7⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        7⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19505.exe
        7⤵
        
        PID:6524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53866.exe
        6⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27371.exe
        7⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31532.exe
        7⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13799.exe
        7⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        6⤵
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8134.exe
        6⤵
        
        PID:4476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30208.exe
        6⤵
        
        PID:5048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11529.exe
        6⤵
        
        PID:6228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63430.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31709.exe
        6⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        7⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9451.exe
        7⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49544.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33604.exe
        7⤵
        
        PID:6332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53338.exe
        6⤵
        
        PID:2940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7484.exe
        6⤵
        
        PID:4672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21119.exe
        6⤵
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32448.exe
        6⤵
        
        PID:7036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49726.exe
        5⤵
        
        PID:2128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        6⤵
        
        PID:3140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24019.exe
        6⤵
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4054.exe
        6⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        6⤵
        
        PID:6996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64273.exe
        5⤵
        
        PID:2820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22325.exe
        5⤵
        
        PID:4248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47274.exe
        5⤵
        
        PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5131.exe
        5⤵
        
        PID:6576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33913.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19893.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53032.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58.exe
        7⤵
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9057.exe
        8⤵
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exe
        8⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45652.exe
        8⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50391.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1536.exe
        7⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47526.exe
        7⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46744.exe
        7⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31997.exe
        7⤵
        
        PID:6400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32263.exe
        6⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37262.exe
        7⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exe
        7⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45652.exe
        7⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
        7⤵
        
        PID:6568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1536.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22571.exe
        6⤵
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8034.exe
        6⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42256.exe
        6⤵
        
        PID:6084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24998.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40069.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32202.exe
        6⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24549.exe
        6⤵
        
        PID:4584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65126.exe
        6⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27113.exe
        6⤵
        
        PID:7008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44355.exe
        5⤵
        
        PID:948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6021.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2971.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49357.exe
        6⤵
        
        PID:6912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64273.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22325.exe
        5⤵
        
        PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47274.exe
        5⤵
        
        PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20725.exe
        5⤵
        
        PID:1376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36888.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57775.exe
        6⤵
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9451.exe
        7⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40307.exe
        7⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39509.exe
        7⤵
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21952.exe
        6⤵
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26336.exe
        6⤵
        
        PID:3368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59031.exe
        6⤵
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42852.exe
        6⤵
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25190.exe
        6⤵
        
        PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64552.exe
        5⤵
        
        PID:2200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        6⤵
        
        PID:3108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38231.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7634.exe
        6⤵
        
        PID:5040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50391.exe
        6⤵
        
        PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45994.exe
        5⤵
        
        PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32202.exe
        5⤵
        
        PID:3092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50366.exe
        5⤵
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        5⤵
        
        PID:5492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42256.exe
        5⤵
        
        PID:6112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20094.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18876.exe
        5⤵
        
        PID:1100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28145.exe
        6⤵
        
        PID:7144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46696.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42852.exe
        5⤵
        
        PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25190.exe
        5⤵
        
        PID:5992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16167.exe
      4⤵
      PID:2944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45441.exe
        5⤵
        
        PID:6948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7001.exe
      4⤵
      PID:3440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
      4⤵
      PID:4596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21851.exe
      4⤵
      PID:5424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9331.exe
      4⤵
      PID:6788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37146.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37146.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4578.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38367.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59254.exe
        6⤵
        Executes dropped EXE
        
        PID:3000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7375.exe
        6⤵
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59996.exe
        7⤵
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        8⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27925.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14733.exe
        8⤵
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
        8⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53338.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62893.exe
        7⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17162.exe
        7⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57715.exe
        7⤵
        
        PID:6720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53866.exe
        6⤵
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        7⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48490.exe
        7⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10466.exe
        7⤵
        
        PID:1480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        6⤵
        
        PID:2372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4474.exe
        6⤵
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43382.exe
        6⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63512.exe
        6⤵
        
        PID:6560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35880.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26508.exe
        6⤵
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        7⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24019.exe
        7⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4054.exe
        7⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        7⤵
        
        PID:6980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1536.exe
        6⤵
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47526.exe
        6⤵
        
        PID:4180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46744.exe
        6⤵
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25190.exe
        6⤵
        
        PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53866.exe
        5⤵
        
        PID:1944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21160.exe
        6⤵
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42513.exe
        6⤵
        
        PID:7020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        5⤵
        
        PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20386.exe
        5⤵
        
        PID:4056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26124.exe
        5⤵
        
        PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31374.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19378.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22498.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23349.exe
        6⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58528.exe
        7⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3904.exe
        7⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21775.exe
        7⤵
        
        PID:6532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32202.exe
        6⤵
        
        PID:3952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50366.exe
        6⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58592.exe
        6⤵
        
        PID:6460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38869.exe
        5⤵
        
        PID:1880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9239.exe
        6⤵
        
        PID:5224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1536.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16799.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46744.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25190.exe
        5⤵
        
        PID:6036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14229.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23349.exe
        5⤵
        
        PID:2660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15316.exe
        6⤵
        
        PID:7096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53338.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29675.exe
        5⤵
        
        PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42852.exe
        5⤵
        
        PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31997.exe
        5⤵
        
        PID:6508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50302.exe
      4⤵
      PID:2936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        5⤵
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23809.exe
        5⤵
        
        PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51517.exe
        5⤵
        
        PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29473.exe
        5⤵
        
        PID:6184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64273.exe
      4⤵
      PID:2584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57136.exe
      4⤵
      PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47274.exe
      4⤵
      PID:3988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20725.exe
      4⤵
      PID:5832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47649.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47649.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28061.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44864.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24562.exe
        6⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6286.exe
        7⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57573.exe
        7⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59985.exe
        7⤵
        
        PID:6688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1536.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47526.exe
        6⤵
        
        PID:4188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46744.exe
        6⤵
        
        PID:4888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25190.exe
        6⤵
        
        PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16119.exe
        5⤵
        
        PID:580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        6⤵
        
        PID:3236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27925.exe
        6⤵
        
        PID:4292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49544.exe
        6⤵
        
        PID:4920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
        6⤵
        
        PID:6596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1536.exe
        5⤵
        
        PID:2452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29052.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23000.exe
        5⤵
        
        PID:6044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57715.exe
        5⤵
        
        PID:6764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39388.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53691.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        6⤵
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38231.exe
        6⤵
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57712.exe
        6⤵
        
        PID:1144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50391.exe
        6⤵
        
        PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1532.exe
        5⤵
        
        PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39550.exe
        5⤵
        
        PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4834.exe
        5⤵
        
        PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25190.exe
        5⤵
        
        PID:5688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49507.exe
      4⤵
      PID:2328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19924.exe
        5⤵
        
        PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53338.exe
        5⤵
        
        PID:1792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6435.exe
        5⤵
        
        PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42119.exe
        5⤵
        
        PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42852.exe
        5⤵
        
        PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60001.exe
        5⤵
        
        PID:6244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23551.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        5⤵
        
        PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27925.exe
        5⤵
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49544.exe
        5⤵
        
        PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19327.exe
        5⤵
        
        PID:6880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64273.exe
      4⤵
      PID:980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22325.exe
      4⤵
      PID:4196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43190.exe
      4⤵
      PID:5084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20725.exe
      4⤵
      PID:5748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19627.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19627.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17602.exe
      4⤵
      PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        5⤵
        
        PID:3284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27925.exe
        5⤵
        
        PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49544.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
        5⤵
        
        PID:6612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
      4⤵
      PID:1568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20386.exe
      4⤵
      PID:3996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30208.exe
      4⤵
      PID:5096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42256.exe
      4⤵
      PID:5736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21735.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21735.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19924.exe
      4⤵
      PID:2388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6435.exe
      4⤵
      PID:3732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42119.exe
      4⤵
      PID:4484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42852.exe
      4⤵
      PID:5360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25190.exe
      4⤵
      PID:6116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59995.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59995.exe
    3⤵
    PID:880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64803.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64803.exe
    3⤵
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28166.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28166.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44035.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44035.exe
    3⤵
    PID:4932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15506.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15506.exe
    3⤵
    PID:5708
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55538.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55538.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34646.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34646.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10333.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11807.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29187.exe
        6⤵
        
        PID:828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9057.exe
        7⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exe
        7⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45652.exe
        7⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
        7⤵
        
        PID:6608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33628.exe
        6⤵
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26336.exe
        6⤵
        
        PID:3380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60755.exe
        6⤵
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17162.exe
        6⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57715.exe
        6⤵
        
        PID:6756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58522.exe
        5⤵
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19924.exe
        6⤵
        
        PID:2104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32202.exe
        6⤵
        
        PID:3400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50366.exe
        6⤵
        
        PID:4524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        6⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10466.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13793.exe
        5⤵
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        6⤵
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26519.exe
        6⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45652.exe
        6⤵
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50391.exe
        6⤵
        
        PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        5⤵
        
        PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49167.exe
        5⤵
        
        PID:4060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53836.exe
        5⤵
        
        PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31374.exe
        5⤵
        
        PID:5320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20067.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59529.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        6⤵
        
        PID:3260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24019.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4054.exe
        6⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        6⤵
        
        PID:6968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1536.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57832.exe
        5⤵
        
        PID:3332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4834.exe
        5⤵
        
        PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14308.exe
        5⤵
        
        PID:5568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18231.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        5⤵
        
        PID:3156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9451.exe
        5⤵
        
        PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48201.exe
        5⤵
        
        PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57185.exe
        5⤵
        
        PID:6676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
      4⤵
      PID:1188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31415.exe
      4⤵
      PID:3348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25743.exe
      4⤵
      PID:1616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3138.exe
      4⤵
      PID:6156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24068.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24068.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30858.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53691.exe
        5⤵
        
        PID:304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35854.exe
        5⤵
        
        PID:1724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22737.exe
        6⤵
        
        PID:4092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29124.exe
        6⤵
        
        PID:4716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36498.exe
        6⤵
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-313.exe
        6⤵
        
        PID:6800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1536.exe
        5⤵
        
        PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47526.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46744.exe
        5⤵
        
        PID:2456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31997.exe
        5⤵
        
        PID:6620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54246.exe
      4⤵
      PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        5⤵
        
        PID:3196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27925.exe
        5⤵
        
        PID:4272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49544.exe
        5⤵
        
        PID:5104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
        5⤵
        
        PID:6436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1536.exe
      4⤵
      PID:340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29052.exe
      4⤵
      PID:4172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46744.exe
      4⤵
      PID:4852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12938.exe
      4⤵
      PID:6276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40707.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40707.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43385.exe
      4⤵
      PID:1668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12565.exe
        5⤵
        
        PID:3780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exe
        5⤵
        
        PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45652.exe
        5⤵
        
        PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
        5⤵
        
        PID:6540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53338.exe
      4⤵
      PID:1856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23186.exe
      4⤵
      PID:4112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55409.exe
      4⤵
      PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30843.exe
      4⤵
      PID:5256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53505.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53505.exe
    3⤵
    PID:2784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24538.exe
      4⤵
      PID:5312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46250.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4165.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4165.exe
    3⤵
    PID:3764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12453.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12453.exe
    3⤵
    PID:4220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16516.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16516.exe
    3⤵
    PID:5416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19590.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19590.exe
    3⤵
    PID:6140
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63326.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63326.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10032.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10032.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60349.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42726.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22389.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41159.exe
        7⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38051.exe
        8⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36488.exe
        8⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33684.exe
        7⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55409.exe
        7⤵
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41726.exe
        7⤵
        
        PID:2256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59808.exe
        6⤵
        
        PID:1284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32202.exe
        6⤵
        
        PID:3964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50366.exe
        6⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        6⤵
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42256.exe
        6⤵
        
        PID:6092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25081.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19924.exe
        6⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22774.exe
        7⤵
        
        PID:6684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53338.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41661.exe
        6⤵
        
        PID:4444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55409.exe
        6⤵
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14931.exe
        6⤵
        
        PID:6648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38298.exe
        5⤵
        
        PID:2732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38824.exe
        6⤵
        
        PID:3924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exe
        6⤵
        
        PID:4156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45652.exe
        6⤵
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
        6⤵
        
        PID:6496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        5⤵
        
        PID:480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38861.exe
        5⤵
        
        PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30208.exe
        5⤵
        
        PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10466.exe
        5⤵
        
        PID:6500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39196.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57007.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65279.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        7⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9451.exe
        7⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48201.exe
        7⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57185.exe
        7⤵
        
        PID:6668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32202.exe
        6⤵
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50366.exe
        6⤵
        
        PID:4588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        6⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42256.exe
        6⤵
        
        PID:6000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62326.exe
        5⤵
        
        PID:2692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27623.exe
        5⤵
        
        PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42119.exe
        5⤵
        
        PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12509.exe
        5⤵
        
        PID:5816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40649.exe
        5⤵
        
        PID:6780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13928.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58626.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64267.exe
        5⤵
        
        PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        5⤵
        
        PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51517.exe
        5⤵
        
        PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14931.exe
        5⤵
        
        PID:6628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15429.exe
      4⤵
      PID:308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28975.exe
        5⤵
        
        PID:6636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34169.exe
      4⤵
      PID:3896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16918.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43382.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8473.exe
      4⤵
      PID:6208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63042.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63042.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41417.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50567.exe
        5⤵
        
        PID:2836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        6⤵
        
        PID:3316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6021.exe
        6⤵
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4054.exe
        6⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        6⤵
        
        PID:6988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53338.exe
        5⤵
        
        PID:1524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62893.exe
        5⤵
        
        PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17162.exe
        5⤵
        
        PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57715.exe
        5⤵
        
        PID:6704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27908.exe
      4⤵
      PID:1612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17797.exe
        5⤵
        
        PID:4692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65357.exe
        5⤵
        
        PID:5660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40132.exe
        5⤵
        
        PID:6808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
      4⤵
      PID:532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49167.exe
      4⤵
      PID:4080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30208.exe
      4⤵
      PID:4688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42256.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52932.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52932.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7806.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34039.exe
        5⤵
        
        PID:2276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22774.exe
        6⤵
        
        PID:6572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6435.exe
        5⤵
        
        PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42119.exe
        5⤵
        
        PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42852.exe
        5⤵
        
        PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31997.exe
        5⤵
        
        PID:6420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40130.exe
      4⤵
      PID:1328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58211.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exe
        5⤵
        
        PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45652.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50391.exe
        5⤵
        
        PID:6096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1536.exe
      4⤵
      PID:1544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57832.exe
      4⤵
      PID:4088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11933.exe
      4⤵
      PID:5100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25190.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26592.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26592.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
      4⤵
      PID:3220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9451.exe
      4⤵
      PID:3992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49544.exe
      4⤵
      PID:4800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50391.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47737.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47737.exe
    3⤵
    PID:2612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exe
    3⤵
    PID:4264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25743.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25743.exe
    3⤵
    PID:5092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50200.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50200.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5244
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12481.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12481.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28253.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28253.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26198.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26857.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        6⤵
        
        PID:3116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38231.exe
        6⤵
        
        PID:3904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7634.exe
        6⤵
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50391.exe
        6⤵
        
        PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5232.exe
        5⤵
        
        PID:1312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24346.exe
        6⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36488.exe
        6⤵
        
        PID:7164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26336.exe
        5⤵
        
        PID:3388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59031.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42852.exe
        5⤵
        
        PID:5604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12938.exe
        5⤵
        
        PID:6268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56192.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        5⤵
        
        PID:3188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9451.exe
        5⤵
        
        PID:4132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48201.exe
        5⤵
        
        PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57185.exe
        5⤵
        
        PID:6744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18967.exe
      4⤵
      PID:1404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3406.exe
        5⤵
        
        PID:4856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9934.exe
        5⤵
        
        PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-286.exe
        5⤵
        
        PID:6480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32202.exe
      4⤵
      PID:3412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50366.exe
      4⤵
      PID:4384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
      4⤵
      PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30004.exe
      4⤵
      PID:5148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49887.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49887.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8190.exe
      4⤵
      PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24754.exe
        5⤵
        
        PID:2060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
        6⤵
        
        PID:3292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27925.exe
        6⤵
        
        PID:4308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49544.exe
        6⤵
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30939.exe
        5⤵
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42119.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42852.exe
        5⤵
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12938.exe
        5⤵
        
        PID:6260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58.exe
      4⤵
      PID:756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30308.exe
        5⤵
        
        PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exe
        5⤵
        
        PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45652.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19664.exe
        5⤵
        
        PID:5112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1536.exe
      4⤵
      PID:2420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47526.exe
      4⤵
      PID:4224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46744.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25190.exe
      4⤵
      PID:6124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53783.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53783.exe
    3⤵
    PID:1808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
      4⤵
      PID:3308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27925.exe
      4⤵
      PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49544.exe
      4⤵
      PID:5128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50391.exe
      4⤵
      PID:6024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53229.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53229.exe
    3⤵
    PID:2772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23536.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23536.exe
    3⤵
    PID:3372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33830.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33830.exe
    3⤵
    PID:4548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43382.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43382.exe
    3⤵
    PID:5328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20725.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20725.exe
    3⤵
    PID:5944
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31574.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31574.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64168.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64168.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
      4⤵
      PID:3300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62736.exe
      4⤵
      PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49544.exe
      4⤵
      PID:924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50391.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59808.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59808.exe
    3⤵
    PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59566.exe
      4⤵
      PID:5188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37889.exe
      4⤵
      PID:6300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32202.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32202.exe
    3⤵
    PID:3944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44219.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44219.exe
    3⤵
    PID:4996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3501.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3501.exe
    3⤵
    PID:5912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36184.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36184.exe
    3⤵
    PID:6712
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44094.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44094.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25098.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25098.exe
    3⤵
    PID:1784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49322.exe
      4⤵
      PID:3864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exe
      4⤵
      PID:4496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45652.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
      4⤵
      PID:6696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12601.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12601.exe
    3⤵
    PID:3420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53166.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53166.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51517.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51517.exe
    3⤵
    PID:5336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10999.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10999.exe
    3⤵
    PID:5260
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16697.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16697.exe
  2⤵
  PID:352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46385.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46385.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12072.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12072.exe
    3⤵
    PID:5668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21775.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21775.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6548
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2536.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2536.exe
  2⤵
  PID:3404
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24030.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24030.exe
  2⤵
  PID:4416
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20716.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20716.exe
  2⤵
  PID:5344
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45139.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45139.exe
  2⤵
  PID:6172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10333.exe

Filesize
468KB

MD5
e0a35591f1afa18c43fdc03e1ea19fb5

SHA1
9123f0c1264a945bbd6fc566c86a28727afba98a

SHA256
a6ff576997a0a155f87eff95c0a7c9d4d0d4bc7be06a84dea5454add76e469ed

SHA512
2349ac6e8ab1e342d9899ada9584eedbf4f2ff04032727ce0c29ae828a9931da9e8a14f8fc70a85f2d82110b6bd712fec887cd65ef794f0a9b92ef75267e5d89

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33913.exe

Filesize
468KB

MD5
d2635170b3b329079bd7d85bdefea41b

SHA1
8fbcb9feeb913395c99df25cc2d1bc0abeb5764a

SHA256
ba41f0e427964036a6b7e98563ac42118cef3b8c746ca9a80b300f42db690ccc

SHA512
ed899e97bb71799be191d48a3a2e7ebf7236d59a4cb762ac5779de3275197bcd46e042c77dce0f81f22df98f9b25840ecbefffe417f9ee776be1cb2062e72df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3919.exe

Filesize
468KB

MD5
3bfde0bbcaee6ed93a070525267eea54

SHA1
a6ca362548d7c6f6d7a15e08bf0a75fae4046912

SHA256
1d54d65dbf8212317688d1bd9df8f3813d88d2ed7f68e3cc3553de18951a0a62

SHA512
602306ef096ebb3920aaab952285d6565c58b3b97d476792f421a1143dc5210feedb8b6ed7bff2ff0d1d98060ebad19eeec0ff4b2fd0cac11ec7e7c852f841fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47649.exe

Filesize
468KB

MD5
932dcbd6350d0c952652725e951f2c40

SHA1
68a60b93ce2c3b77f066beb17757c27a6632bec6

SHA256
bb7eb1a3423b6a589ccef8dd5902f4ecd7f80576eb54e4d3af0e0571c3d87eae

SHA512
8616846f76dd586021a6a4c65b9ae9cdca7a78ae69415d9c10dcd379465a6995a282899dd8ae1a43b8418bff917c840035bb6d6f69991ff6899a8dd63a0193b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53779.exe

Filesize
468KB

MD5
3a5d15b51b7ba48401c789e566cce829

SHA1
7ca06c365955fe7d8797a1bf1db52510ac7ed08f

SHA256
49dc57c158138462f6acd056e687d64a3eda122d9884e87abc61712b58158825

SHA512
8ea4860a25749f5ad546019bc59cebf9296ea413c2850650ecd0a491db7840f290e21228e100272340eda71f193789c579c28d5e9858f8e3cb1a1e837a2bc4b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55538.exe

Filesize
468KB

MD5
931df584104f5e481bb6fe69697773f4

SHA1
fbfba86df7ceaca2863585d6f276f0e086523008

SHA256
757a665bb339f666972da6ed7be61550f4c8fdc981d18a3b1431dd8a37a7e678

SHA512
c4597f16f68032f0f1eabbe0808c6cc418cee34f1867d265c9ec7f73731e80af27d2f8b42fa1a24f470bc3cea27d889373bd8ce8bdf60a0ff5a18ae52e9aea0f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-10032.exe

Filesize
468KB

MD5
26694daae528f08166167f969dd231c2

SHA1
65ec5da83904329254ad9e2b66f82577475faeb6

SHA256
a3eff4a4822bab0c661ffc907a83c255ec57a3f4174b71de2f7d541552bed3e6

SHA512
c53df7ca2787cf992850f796148f5271e6c82eef29b9788a783a0fcb021756e30c6865ea27b1820930dc828ecaede6f95c1987f2fd0ecae4b7de1e29770bd828

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12481.exe

Filesize
468KB

MD5
67bf76796abf2f332ced329154e41246

SHA1
ec393b75f5eb7a1694deb71e3a46ca2e75865ba7

SHA256
96d1091e8e0666cd1b622e0551286a15f5bbfff37befc0d900a96880e6169839

SHA512
43d4aa2a8b4b0c9b159b05d94e5b14587cab9382c6123bcd246e13e15d5e918ce0e8d464c1473c818895f7f3157455d599310c1a2e623ae80b084d7f27bc059b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24068.exe

Filesize
468KB

MD5
7c71d2ed2be73999dfa6ef8ae493b557

SHA1
a7c5939e2ae08c51b88c16c8150438d6b4c10593

SHA256
a386065250187558275756b4e15aef3dc33476229437f52616627179b1cf9f80

SHA512
61a1c8658805468a878f591a3f09c1466c82f565c9301ee357fd34a72e3bb5176f5b0968218b218261da6474ec856630ebc20ef2a32f6e565c9cbc991ec53014

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25243.exe

Filesize
468KB

MD5
2a99e7ebff0a273e3d9f9c4dddc7b5f7

SHA1
7787068555651483ff516016f65d260c6907a1dc

SHA256
a71bcb9b3f9a6185d3f89da60e4d940cc3154fc3fa2612661d9a2ccd5abf2d69

SHA512
fb5f408563e5bd6423561be6ccd11212a76a11068b131b5d52aee76bfa48e190718aac6315c93675b7d186462d1909117ed88b9c6b8446b3279cd8f5ae8bba78

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28253.exe

Filesize
468KB

MD5
b49dd5da601d752aea1d11bd4378e75d

SHA1
95508ff99b5b0bedbe322fdc087f45fd997af489

SHA256
1ae8df816a15b412f17e1a9d82a87dc2a17b83450fc95a0add1d1fa572dac5da

SHA512
e5e558c0ea8b7c76930827c1635463b787f0a5aa4f8d8c7652406395f08448208ad1477f8549d1d2217c3d01c6528f6d9c3f91d5ef93d744771e3df796737779

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34646.exe

Filesize
468KB

MD5
88840a8d3501c88dd76117d9f4cbe3a7

SHA1
5f5c7d4765797dfa40afd45b148b9bd43061341f

SHA256
947dfb7bee5def07020dd105238387e1f5c58afb0bd5f2917e9acd93b67e497c

SHA512
f4d6f43ce35297bc0b9809891d9b19e8ecf72381b74d5bdd02509df072f324eb861dff054d65f93b127b9ab7c1a4efca65bf6db8d7376701cd5a8516a45f856f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37146.exe

Filesize
468KB

MD5
024175f0bc064a3d2699038aacdb632f

SHA1
89f2a845e1ce62377d78e6a6db2c82f12d007e0e

SHA256
541e8bb633b38c3d93a919389b29d5cda7531c4aa19bc989b1138e261000d6d8

SHA512
827f5847a01ff6d2867006c4a34b3922e78a7aec63df330821096faf77d80d47256f7dd0734cc319d17c1cc09b001bd6c46110de90f4f7ddb9219a7706233555

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40593.exe

Filesize
468KB

MD5
1649e143b481d3ea670657d87c409909

SHA1
510ecd74a0c0443f40e03e8711d18539179eb81d

SHA256
0e1d84156c6583e27cc065a2f7bb067e3080818f3c3a046fd1ed9236509987bb

SHA512
5bfce501a81991a2ca2f25dd10110abd1604e2b3deaf669da55166fdc395ccd5965c2e3d9b037c9a1315373c21489f1e775bd41336c7f6f198c025c997c0f528

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4578.exe

Filesize
468KB

MD5
0ca8232ef2c5d0c413ece9c3d71555ed

SHA1
000093afaf319415d5e716e2c4c022de4a6198f6

SHA256
fc216f3a6df7a0cdd438134921d708591c8a4e250c4dfbe93a603f7fa07c3b02

SHA512
ca24d10606bcc9ac740a28cced1e91f4a48665009894688d7413d4972009b6840e1456d670b7d2c97a2a12451e7a6518cfdea44d0996a1df06ed3ab45adde6ad

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60349.exe

Filesize
468KB

MD5
b8f9b8fae850bae7ebdc0557ab1446c2

SHA1
c0e90d703bb986c3920d941c3bb08733069e8cf3

SHA256
1886c65ce108ad8fc8ec4e235c0dc60779463c221b8f975ac2d399fa1f116685

SHA512
54f122577b207d770e66d6d23fc12d088ee6ceb435e0b87dc189fa6bc955cb66fbe9e870bedc5570aec468c9645467ca491be20a3a2e16d6119b572df6dc43fb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63042.exe

Filesize
468KB

MD5
8399da2ab4d67d55d036d50a75bdc4f4

SHA1
baacbb52c2f30192e4b7a3162209d2654f3b6b5d

SHA256
2be7816d731f634a9379edc0004fb0e8245f9ff4cffd65ad4515f6bbc69af253

SHA512
28a489ab2aa2a3074af7965689af86c40c357147ba6ad34a8a94c7d654e60d99e80169a538a36aeb6fd6cbd27b47ecf9b190fd295f7bdda677b66c19b69b0ff1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63326.exe

Filesize
468KB

MD5
86d07fc4faf9b785342722b77faff020

SHA1
b3455fef438fc7f531f9f654d1ad3d36b28a1a8e

SHA256
fee7f528f151accb87fb9d56fd9af96c877e697c261075e87555e477f0a5a191

SHA512
e86eec08f6e10c6a5318d84e6b62600408289d392b79364e85231be39ebf2c4e525c24ba2887a73bfa5cbe6d9caf05ec41f05194b46b1ad2bf7da5b87d640711

Download Submit
memory/316-429-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/556-266-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/660-428-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/696-275-0x00000000033C0000-0x0000000003435000-memory.dmp

Filesize
468KB

Download
memory/696-285-0x00000000033C0000-0x0000000003435000-memory.dmp

Filesize
468KB

Download
memory/696-151-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/784-183-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/896-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1080-431-0x0000000002390000-0x0000000002405000-memory.dmp

Filesize
468KB

Download
memory/1080-287-0x0000000002390000-0x0000000002405000-memory.dmp

Filesize
468KB

Download
memory/1080-138-0x0000000002390000-0x0000000002405000-memory.dmp

Filesize
468KB

Download
memory/1080-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1080-142-0x0000000002390000-0x0000000002405000-memory.dmp

Filesize
468KB

Download
memory/1136-153-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1136-242-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1136-237-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1152-199-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1152-359-0x0000000003370000-0x00000000033E5000-memory.dmp

Filesize
468KB

Download
memory/1152-358-0x0000000003370000-0x00000000033E5000-memory.dmp

Filesize
468KB

Download
memory/1232-218-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1232-343-0x0000000002800000-0x0000000002875000-memory.dmp

Filesize
468KB

Download
memory/1548-233-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1704-335-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1708-261-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1972-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2032-141-0x0000000002760000-0x00000000027D5000-memory.dmp

Filesize
468KB

Download
memory/2032-267-0x0000000002760000-0x00000000027D5000-memory.dmp

Filesize
468KB

Download
memory/2032-268-0x0000000002760000-0x00000000027D5000-memory.dmp

Filesize
468KB

Download
memory/2032-356-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2032-17-0x0000000002760000-0x00000000027D5000-memory.dmp

Filesize
468KB

Download
memory/2088-345-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2112-406-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2112-289-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2112-405-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2136-361-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2148-332-0x0000000001EF0000-0x0000000001F65000-memory.dmp

Filesize
468KB

Download
memory/2148-166-0x0000000001EF0000-0x0000000001F65000-memory.dmp

Filesize
468KB

Download
memory/2148-171-0x0000000001EF0000-0x0000000001F65000-memory.dmp

Filesize
468KB

Download
memory/2148-336-0x0000000001EF0000-0x0000000001F65000-memory.dmp

Filesize
468KB

Download
memory/2148-93-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2216-219-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2216-384-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2248-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2248-32-0x0000000000790000-0x0000000000805000-memory.dmp

Filesize
468KB

Download
memory/2248-6-0x0000000000790000-0x0000000000805000-memory.dmp

Filesize
468KB

Download
memory/2248-344-0x0000000000790000-0x0000000000805000-memory.dmp

Filesize
468KB

Download
memory/2248-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2248-232-0x0000000000790000-0x0000000000805000-memory.dmp

Filesize
468KB

Download
memory/2248-225-0x0000000000790000-0x0000000000805000-memory.dmp

Filesize
468KB

Download
memory/2248-31-0x0000000000790000-0x0000000000805000-memory.dmp

Filesize
468KB

Download
memory/2272-432-0x0000000002890000-0x0000000002905000-memory.dmp

Filesize
468KB

Download
memory/2272-291-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2300-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2472-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2524-174-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2524-313-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/2560-276-0x0000000002500000-0x0000000002575000-memory.dmp

Filesize
468KB

Download
memory/2560-77-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2560-284-0x0000000002500000-0x0000000002575000-memory.dmp

Filesize
468KB

Download
memory/2628-430-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2664-396-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2664-392-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2664-41-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2664-216-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2680-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2748-263-0x0000000001F20000-0x0000000001F95000-memory.dmp

Filesize
468KB

Download
memory/2748-265-0x0000000001F20000-0x0000000001F95000-memory.dmp

Filesize
468KB

Download
memory/2748-116-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2756-362-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2760-357-0x0000000001EA0000-0x0000000001F15000-memory.dmp

Filesize
468KB

Download
memory/2760-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2760-217-0x0000000001EA0000-0x0000000001F15000-memory.dmp

Filesize
468KB

Download
memory/2760-215-0x0000000001EA0000-0x0000000001F15000-memory.dmp

Filesize
468KB

Download
memory/2760-360-0x0000000001EA0000-0x0000000001F15000-memory.dmp

Filesize
468KB

Download
memory/2776-64-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2776-333-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2776-181-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2776-334-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2860-407-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2872-197-0x00000000026F0000-0x0000000002765000-memory.dmp

Filesize
468KB

Download
memory/2872-374-0x00000000026F0000-0x0000000002765000-memory.dmp

Filesize
468KB

Download
memory/2872-196-0x00000000026F0000-0x0000000002765000-memory.dmp

Filesize
468KB

Download
memory/2872-104-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2876-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2884-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2908-143-0x0000000002560000-0x00000000025D5000-memory.dmp

Filesize
468KB

Download
memory/2908-286-0x0000000002560000-0x00000000025D5000-memory.dmp

Filesize
468KB

Download
memory/2908-277-0x0000000002560000-0x00000000025D5000-memory.dmp

Filesize
468KB

Download
memory/2908-68-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2908-447-0x0000000002560000-0x00000000025D5000-memory.dmp

Filesize
468KB

Download
memory/2952-250-0x0000000002530000-0x00000000025A5000-memory.dmp

Filesize
468KB

Download
memory/2952-251-0x0000000002530000-0x00000000025A5000-memory.dmp

Filesize
468KB

Download
memory/2952-150-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3020-290-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3024-288-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3060-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download