ac66b527b44e6efc256b058c08d1f936457bc83818998d40868492887983324b

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 19:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac66b527b44e6efc256b058c08d1f936457bc83818998d40868492887983324bN.exe
Size

468KB
MD5

c80acd4b78ba976c558b3374785255b0
SHA1

8a719aa245a19908bc0ef8e43547990b2075a41e
SHA256

ac66b527b44e6efc256b058c08d1f936457bc83818998d40868492887983324b
SHA512

f32dad8ac051c1b845168128611eea48553dd6497c3d1056d46b7a19250ba785103fda6c69f5139bf03c2be6fbf1b060554f36e1ea3f4c911e0bbbd3a0d266f4
SSDEEP

3072:pi3TotgKIP5UIbY1Hz4O/fJ/zCmrm0EknlHewVgkpm2LnE3gE1lM:pijoYxUI6HcO/fsNPypmYE3gE

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2784	Unicorn-15976.exe
2552	Unicorn-56022.exe
2796	Unicorn-1346.exe
2816	Unicorn-64273.exe
2564	Unicorn-36239.exe
3008	Unicorn-60189.exe
2424	Unicorn-8942.exe
2888	Unicorn-32561.exe
2380	Unicorn-56743.exe
1052	Unicorn-49665.exe
1676	Unicorn-11739.exe
996	Unicorn-63541.exe
2348	Unicorn-17870.exe
2356	Unicorn-44247.exe
2848	Unicorn-17870.exe
2476	Unicorn-23166.exe
2292	Unicorn-5246.exe
2440	Unicorn-47670.exe
2412	Unicorn-55738.exe
1976	Unicorn-55646.exe
788	Unicorn-45432.exe
924	Unicorn-6445.exe
1096	Unicorn-6445.exe
2104	Unicorn-6445.exe
968	Unicorn-10529.exe
2976	Unicorn-48033.exe
2512	Unicorn-7768.exe
2208	Unicorn-38494.exe
2084	Unicorn-37177.exe
2516	Unicorn-46108.exe
2312	Unicorn-4810.exe
2444	Unicorn-33555.exe
2320	Unicorn-38193.exe
1276	Unicorn-12942.exe
2264	Unicorn-4674.exe
1924	Unicorn-64089.exe
2776	Unicorn-33917.exe
2936	Unicorn-39393.exe
3032	Unicorn-55464.exe
2188	Unicorn-59813.exe
2540	Unicorn-41842.exe
1632	Unicorn-35885.exe
1508	Unicorn-54259.exe
2016	Unicorn-52221.exe
2588	Unicorn-52221.exe
1516	Unicorn-52221.exe
2876	Unicorn-7104.exe
3024	Unicorn-9797.exe
2240	Unicorn-2059.exe
1656	Unicorn-6342.exe
1616	Unicorn-15827.exe
2840	Unicorn-35693.exe
316	Unicorn-32163.exe
1648	Unicorn-11088.exe
576	Unicorn-65049.exe
2860	Unicorn-65049.exe
2168	Unicorn-26709.exe
1316	Unicorn-30793.exe
2436	Unicorn-44437.exe
2076	Unicorn-6097.exe
2112	Unicorn-48521.exe
2200	Unicorn-23916.exe
1556	Unicorn-16233.exe
2984	Unicorn-55682.exe

Loads dropped DLL 64 IoCs

pid	Process
2688	ac66b527b44e6efc256b058c08d1f936457bc83818998d40868492887983324bN.exe
2688	ac66b527b44e6efc256b058c08d1f936457bc83818998d40868492887983324bN.exe
2784	Unicorn-15976.exe
2784	Unicorn-15976.exe
2688	ac66b527b44e6efc256b058c08d1f936457bc83818998d40868492887983324bN.exe
2688	ac66b527b44e6efc256b058c08d1f936457bc83818998d40868492887983324bN.exe
2552	Unicorn-56022.exe
2552	Unicorn-56022.exe
2784	Unicorn-15976.exe
2784	Unicorn-15976.exe
2796	Unicorn-1346.exe
2796	Unicorn-1346.exe
2688	ac66b527b44e6efc256b058c08d1f936457bc83818998d40868492887983324bN.exe
2688	ac66b527b44e6efc256b058c08d1f936457bc83818998d40868492887983324bN.exe
2816	Unicorn-64273.exe
2816	Unicorn-64273.exe
2552	Unicorn-56022.exe
2552	Unicorn-56022.exe
2564	Unicorn-36239.exe
2564	Unicorn-36239.exe
2784	Unicorn-15976.exe
3008	Unicorn-60189.exe
2796	Unicorn-1346.exe
2784	Unicorn-15976.exe
2796	Unicorn-1346.exe
3008	Unicorn-60189.exe
2424	Unicorn-8942.exe
2424	Unicorn-8942.exe
2688	ac66b527b44e6efc256b058c08d1f936457bc83818998d40868492887983324bN.exe
2688	ac66b527b44e6efc256b058c08d1f936457bc83818998d40868492887983324bN.exe
2888	Unicorn-32561.exe
2888	Unicorn-32561.exe
2816	Unicorn-64273.exe
2380	Unicorn-56743.exe
2816	Unicorn-64273.exe
2380	Unicorn-56743.exe
2552	Unicorn-56022.exe
2552	Unicorn-56022.exe
996	Unicorn-63541.exe
996	Unicorn-63541.exe
2796	Unicorn-1346.exe
2796	Unicorn-1346.exe
1052	Unicorn-49665.exe
2348	Unicorn-17870.exe
2848	Unicorn-17870.exe
1052	Unicorn-49665.exe
2348	Unicorn-17870.exe
2848	Unicorn-17870.exe
2356	Unicorn-44247.exe
2356	Unicorn-44247.exe
3008	Unicorn-60189.exe
3008	Unicorn-60189.exe
2564	Unicorn-36239.exe
2564	Unicorn-36239.exe
2424	Unicorn-8942.exe
2424	Unicorn-8942.exe
1676	Unicorn-11739.exe
1676	Unicorn-11739.exe
2688	ac66b527b44e6efc256b058c08d1f936457bc83818998d40868492887983324bN.exe
2688	ac66b527b44e6efc256b058c08d1f936457bc83818998d40868492887983324bN.exe
2784	Unicorn-15976.exe
2784	Unicorn-15976.exe
2476	Unicorn-23166.exe
2476	Unicorn-23166.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54698.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45572.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53282.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36658.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22423.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26607.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26640.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48521.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38110.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52630.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26152.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23964.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1346.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17870.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10508.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21355.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21545.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12874.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8165.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29885.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62610.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42142.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11457.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49165.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17057.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23112.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24155.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49165.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56743.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9517.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9651.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40500.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1406.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1413.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17057.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6342.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42238.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24155.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22183.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58495.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8942.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11567.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23964.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24155.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10420.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22423.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49165.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7635.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11088.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54660.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19653.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3098.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1943.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54660.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4820.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34287.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54333.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49035.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36216.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63461.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60500.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58909.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52221.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2688	ac66b527b44e6efc256b058c08d1f936457bc83818998d40868492887983324bN.exe
2784	Unicorn-15976.exe
2552	Unicorn-56022.exe
2796	Unicorn-1346.exe
2816	Unicorn-64273.exe
2564	Unicorn-36239.exe
2424	Unicorn-8942.exe
3008	Unicorn-60189.exe
2888	Unicorn-32561.exe
2380	Unicorn-56743.exe
1676	Unicorn-11739.exe
996	Unicorn-63541.exe
2356	Unicorn-44247.exe
1052	Unicorn-49665.exe
2848	Unicorn-17870.exe
2348	Unicorn-17870.exe
2476	Unicorn-23166.exe
2292	Unicorn-5246.exe
2440	Unicorn-47670.exe
2412	Unicorn-55738.exe
1976	Unicorn-55646.exe
788	Unicorn-45432.exe
924	Unicorn-6445.exe
1096	Unicorn-6445.exe
2104	Unicorn-6445.exe
968	Unicorn-10529.exe
2512	Unicorn-7768.exe
2976	Unicorn-48033.exe
2208	Unicorn-38494.exe
2516	Unicorn-46108.exe
2084	Unicorn-37177.exe
2312	Unicorn-4810.exe
2444	Unicorn-33555.exe
2320	Unicorn-38193.exe
1276	Unicorn-12942.exe
2264	Unicorn-4674.exe
1924	Unicorn-64089.exe
2776	Unicorn-33917.exe
2936	Unicorn-39393.exe
3032	Unicorn-55464.exe
2188	Unicorn-59813.exe
2540	Unicorn-41842.exe
1516	Unicorn-52221.exe
1632	Unicorn-35885.exe
2016	Unicorn-52221.exe
2588	Unicorn-52221.exe
1508	Unicorn-54259.exe
2876	Unicorn-7104.exe
1656	Unicorn-6342.exe
3024	Unicorn-9797.exe
2240	Unicorn-2059.exe
1616	Unicorn-15827.exe
1648	Unicorn-11088.exe
2840	Unicorn-35693.exe
316	Unicorn-32163.exe
2860	Unicorn-65049.exe
576	Unicorn-65049.exe
2168	Unicorn-26709.exe
1316	Unicorn-30793.exe
2436	Unicorn-44437.exe
2076	Unicorn-6097.exe
2200	Unicorn-23916.exe
2112	Unicorn-48521.exe
1556	Unicorn-16233.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2784	2688	ac66b527b44e6efc256b058c08d1f936457bc83818998d40868492887983324bN.exe	30
PID 2688 wrote to memory of 2784	2688	ac66b527b44e6efc256b058c08d1f936457bc83818998d40868492887983324bN.exe	30
PID 2688 wrote to memory of 2784	2688	ac66b527b44e6efc256b058c08d1f936457bc83818998d40868492887983324bN.exe	30
PID 2688 wrote to memory of 2784	2688	ac66b527b44e6efc256b058c08d1f936457bc83818998d40868492887983324bN.exe	30
PID 2784 wrote to memory of 2552	2784	Unicorn-15976.exe	31
PID 2784 wrote to memory of 2552	2784	Unicorn-15976.exe	31
PID 2784 wrote to memory of 2552	2784	Unicorn-15976.exe	31
PID 2784 wrote to memory of 2552	2784	Unicorn-15976.exe	31
PID 2688 wrote to memory of 2796	2688	ac66b527b44e6efc256b058c08d1f936457bc83818998d40868492887983324bN.exe	32
PID 2688 wrote to memory of 2796	2688	ac66b527b44e6efc256b058c08d1f936457bc83818998d40868492887983324bN.exe	32
PID 2688 wrote to memory of 2796	2688	ac66b527b44e6efc256b058c08d1f936457bc83818998d40868492887983324bN.exe	32
PID 2688 wrote to memory of 2796	2688	ac66b527b44e6efc256b058c08d1f936457bc83818998d40868492887983324bN.exe	32
PID 2552 wrote to memory of 2816	2552	Unicorn-56022.exe	33
PID 2552 wrote to memory of 2816	2552	Unicorn-56022.exe	33
PID 2552 wrote to memory of 2816	2552	Unicorn-56022.exe	33
PID 2552 wrote to memory of 2816	2552	Unicorn-56022.exe	33
PID 2784 wrote to memory of 2564	2784	Unicorn-15976.exe	34
PID 2784 wrote to memory of 2564	2784	Unicorn-15976.exe	34
PID 2784 wrote to memory of 2564	2784	Unicorn-15976.exe	34
PID 2784 wrote to memory of 2564	2784	Unicorn-15976.exe	34
PID 2796 wrote to memory of 3008	2796	Unicorn-1346.exe	35
PID 2796 wrote to memory of 3008	2796	Unicorn-1346.exe	35
PID 2796 wrote to memory of 3008	2796	Unicorn-1346.exe	35
PID 2796 wrote to memory of 3008	2796	Unicorn-1346.exe	35
PID 2688 wrote to memory of 2424	2688	ac66b527b44e6efc256b058c08d1f936457bc83818998d40868492887983324bN.exe	36
PID 2688 wrote to memory of 2424	2688	ac66b527b44e6efc256b058c08d1f936457bc83818998d40868492887983324bN.exe	36
PID 2688 wrote to memory of 2424	2688	ac66b527b44e6efc256b058c08d1f936457bc83818998d40868492887983324bN.exe	36
PID 2688 wrote to memory of 2424	2688	ac66b527b44e6efc256b058c08d1f936457bc83818998d40868492887983324bN.exe	36
PID 2816 wrote to memory of 2888	2816	Unicorn-64273.exe	37
PID 2816 wrote to memory of 2888	2816	Unicorn-64273.exe	37
PID 2816 wrote to memory of 2888	2816	Unicorn-64273.exe	37
PID 2816 wrote to memory of 2888	2816	Unicorn-64273.exe	37
PID 2552 wrote to memory of 2380	2552	Unicorn-56022.exe	38
PID 2552 wrote to memory of 2380	2552	Unicorn-56022.exe	38
PID 2552 wrote to memory of 2380	2552	Unicorn-56022.exe	38
PID 2552 wrote to memory of 2380	2552	Unicorn-56022.exe	38
PID 2564 wrote to memory of 1052	2564	Unicorn-36239.exe	39
PID 2564 wrote to memory of 1052	2564	Unicorn-36239.exe	39
PID 2564 wrote to memory of 1052	2564	Unicorn-36239.exe	39
PID 2564 wrote to memory of 1052	2564	Unicorn-36239.exe	39
PID 2784 wrote to memory of 1676	2784	Unicorn-15976.exe	40
PID 2784 wrote to memory of 1676	2784	Unicorn-15976.exe	40
PID 2784 wrote to memory of 1676	2784	Unicorn-15976.exe	40
PID 2784 wrote to memory of 1676	2784	Unicorn-15976.exe	40
PID 2796 wrote to memory of 996	2796	Unicorn-1346.exe	42
PID 2796 wrote to memory of 996	2796	Unicorn-1346.exe	42
PID 2796 wrote to memory of 996	2796	Unicorn-1346.exe	42
PID 2796 wrote to memory of 996	2796	Unicorn-1346.exe	42
PID 3008 wrote to memory of 2348	3008	Unicorn-60189.exe	41
PID 3008 wrote to memory of 2348	3008	Unicorn-60189.exe	41
PID 3008 wrote to memory of 2348	3008	Unicorn-60189.exe	41
PID 3008 wrote to memory of 2348	3008	Unicorn-60189.exe	41
PID 2424 wrote to memory of 2848	2424	Unicorn-8942.exe	43
PID 2424 wrote to memory of 2848	2424	Unicorn-8942.exe	43
PID 2424 wrote to memory of 2848	2424	Unicorn-8942.exe	43
PID 2424 wrote to memory of 2848	2424	Unicorn-8942.exe	43
PID 2688 wrote to memory of 2356	2688	ac66b527b44e6efc256b058c08d1f936457bc83818998d40868492887983324bN.exe	44
PID 2688 wrote to memory of 2356	2688	ac66b527b44e6efc256b058c08d1f936457bc83818998d40868492887983324bN.exe	44
PID 2688 wrote to memory of 2356	2688	ac66b527b44e6efc256b058c08d1f936457bc83818998d40868492887983324bN.exe	44
PID 2688 wrote to memory of 2356	2688	ac66b527b44e6efc256b058c08d1f936457bc83818998d40868492887983324bN.exe	44
PID 2888 wrote to memory of 2476	2888	Unicorn-32561.exe	45
PID 2888 wrote to memory of 2476	2888	Unicorn-32561.exe	45
PID 2888 wrote to memory of 2476	2888	Unicorn-32561.exe	45
PID 2888 wrote to memory of 2476	2888	Unicorn-32561.exe	45

C:\Users\Admin\AppData\Local\Temp\ac66b527b44e6efc256b058c08d1f936457bc83818998d40868492887983324bN.exe
"C:\Users\Admin\AppData\Local\Temp\ac66b527b44e6efc256b058c08d1f936457bc83818998d40868492887983324bN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15976.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15976.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56022.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56022.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64273.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32561.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23166.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33555.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16233.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29466.exe
        9⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22423.exe
        9⤵
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62770.exe
        9⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49165.exe
        9⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63461.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30021.exe
        8⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19383.exe
        8⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32132.exe
        8⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55682.exe
        7⤵
        Executes dropped EXE
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11567.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22423.exe
        8⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42238.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17550.exe
        8⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38110.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21355.exe
        7⤵
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51769.exe
        7⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8165.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38193.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13025.exe
        7⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13985.exe
        8⤵
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10508.exe
        8⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35168.exe
        8⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26607.exe
        8⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37679.exe
        7⤵
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54660.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59970.exe
        7⤵
        
        PID:776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36216.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10979.exe
        6⤵
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36435.exe
        7⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59336.exe
        8⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45709.exe
        8⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24290.exe
        7⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3098.exe
        7⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44275.exe
        7⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14187.exe
        6⤵
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58240.exe
        6⤵
        
        PID:3900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60500.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19499.exe
        6⤵
        
        PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5246.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12942.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17110.exe
        7⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-747.exe
        8⤵
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25922.exe
        9⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23342.exe
        9⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10508.exe
        8⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35168.exe
        8⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26607.exe
        8⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46419.exe
        7⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42678.exe
        8⤵
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47696.exe
        8⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19679.exe
        8⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40108.exe
        8⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30792.exe
        7⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45572.exe
        7⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41030.exe
        7⤵
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4343.exe
        6⤵
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16124.exe
        7⤵
        
        PID:1868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22258.exe
        8⤵
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24155.exe
        8⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17654.exe
        8⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54698.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17057.exe
        7⤵
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24155.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58495.exe
        7⤵
        
        PID:800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19887.exe
        7⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60154.exe
        6⤵
        
        PID:588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39928.exe
        7⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62237.exe
        7⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30109.exe
        6⤵
        
        PID:3536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27551.exe
        6⤵
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62127.exe
        6⤵
        
        PID:2464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4674.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40545.exe
        6⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
        7⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10420.exe
        7⤵
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52630.exe
        7⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16300.exe
        7⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17057.exe
        6⤵
        
        PID:3088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24155.exe
        6⤵
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17654.exe
        6⤵
        
        PID:4336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7635.exe
        6⤵
        
        PID:6076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4400.exe
        5⤵
        
        PID:1328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
        6⤵
        
        PID:3300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10420.exe
        6⤵
        
        PID:276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52630.exe
        6⤵
        
        PID:3772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16300.exe
        6⤵
        
        PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27992.exe
        5⤵
        
        PID:3096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4820.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50360.exe
        5⤵
        
        PID:5060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52171.exe
        5⤵
        
        PID:6104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56743.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47670.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64089.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40545.exe
        7⤵
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35688.exe
        8⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22423.exe
        8⤵
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62770.exe
        8⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61417.exe
        8⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50441.exe
        7⤵
        
        PID:388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36159.exe
        7⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16882.exe
        7⤵
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23964.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46253.exe
        6⤵
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        7⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22423.exe
        7⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62770.exe
        7⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26607.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37918.exe
        6⤵
        
        PID:2580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21355.exe
        6⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26152.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37620.exe
        6⤵
        
        PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33917.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7379.exe
        6⤵
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
        7⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10420.exe
        7⤵
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9651.exe
        7⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16300.exe
        7⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17057.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24155.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
        6⤵
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7635.exe
        6⤵
        
        PID:5936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27891.exe
        5⤵
        
        PID:1576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27629.exe
        6⤵
        
        PID:1652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19383.exe
        6⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62859.exe
        6⤵
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53513.exe
        5⤵
        
        PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56109.exe
        5⤵
        
        PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43434.exe
        5⤵
        
        PID:3052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53282.exe
        5⤵
        
        PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55738.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39393.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58334.exe
        6⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1069.exe
        7⤵
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49066.exe
        7⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25548.exe
        7⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40500.exe
        7⤵
        
        PID:5356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16590.exe
        6⤵
        
        PID:2668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38681.exe
        6⤵
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3098.exe
        6⤵
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40500.exe
        6⤵
        
        PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28930.exe
        5⤵
        
        PID:2892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
        6⤵
        
        PID:3352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22183.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57333.exe
        6⤵
        
        PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30792.exe
        5⤵
        
        PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62721.exe
        5⤵
        
        PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31751.exe
        5⤵
        
        PID:5152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55464.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58334.exe
        5⤵
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48625.exe
        6⤵
        
        PID:1152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23112.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3098.exe
        6⤵
        
        PID:4656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-728.exe
        6⤵
        
        PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1048.exe
        5⤵
        
        PID:1348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36159.exe
        5⤵
        
        PID:3484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16882.exe
        5⤵
        
        PID:5040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1406.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39866.exe
      4⤵
      PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
        5⤵
        
        PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5236.exe
        5⤵
        
        PID:4164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44275.exe
        5⤵
        
        PID:5260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11457.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21885.exe
      4⤵
      PID:3800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47303.exe
      4⤵
      PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46836.exe
      4⤵
      PID:5248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36239.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36239.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49665.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6445.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52221.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54670.exe
        7⤵
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2527.exe
        7⤵
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59970.exe
        7⤵
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23964.exe
        7⤵
        
        PID:5608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42142.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40852.exe
        7⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48411.exe
        6⤵
        
        PID:3844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43555.exe
        6⤵
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5689.exe
        6⤵
        
        PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9797.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9517.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53171.exe
        7⤵
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49035.exe
        7⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43300.exe
        7⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10508.exe
        6⤵
        
        PID:3660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37690.exe
        6⤵
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14354.exe
        6⤵
        
        PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32743.exe
        5⤵
        
        PID:1132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
        6⤵
        
        PID:3308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10420.exe
        6⤵
        
        PID:932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52630.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16300.exe
        6⤵
        
        PID:6128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36658.exe
        5⤵
        
        PID:3144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21355.exe
        5⤵
        
        PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33294.exe
        5⤵
        
        PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26640.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7768.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35885.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-747.exe
        6⤵
        
        PID:1836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10508.exe
        6⤵
        
        PID:3668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37690.exe
        6⤵
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26607.exe
        6⤵
        
        PID:5324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42142.exe
        5⤵
        
        PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24243.exe
        5⤵
        
        PID:3548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
        5⤵
        
        PID:4584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13857.exe
        5⤵
        
        PID:2480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54259.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28568.exe
        5⤵
        
        PID:1100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1069.exe
        6⤵
        
        PID:972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24155.exe
        6⤵
        
        PID:4124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
        6⤵
        
        PID:5072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26109.exe
        6⤵
        
        PID:5820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16590.exe
        5⤵
        
        PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30021.exe
        5⤵
        
        PID:3788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19383.exe
        5⤵
        
        PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32132.exe
        5⤵
        
        PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52807.exe
      4⤵
      PID:3000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11754.exe
        5⤵
        
        PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49035.exe
        5⤵
        
        PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55552.exe
        5⤵
        
        PID:5204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21443.exe
      4⤵
      PID:3596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe
      4⤵
      PID:4728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41030.exe
      4⤵
      PID:5516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46108.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65049.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4577.exe
        6⤵
        
        PID:1352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45174.exe
        6⤵
        
        PID:3716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25548.exe
        6⤵
        
        PID:4908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40500.exe
        6⤵
        
        PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36159.exe
        5⤵
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3098.exe
        5⤵
        
        PID:4664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17941.exe
        5⤵
        
        PID:5484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30793.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26046.exe
        5⤵
        
        PID:2832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17349.exe
        6⤵
        
        PID:4312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38894.exe
        6⤵
        
        PID:3792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10435.exe
        6⤵
        
        PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17057.exe
        5⤵
        
        PID:3104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24155.exe
        5⤵
        
        PID:3608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38075.exe
        5⤵
        
        PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7635.exe
        5⤵
        
        PID:6096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46558.exe
      4⤵
      PID:1948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6876.exe
        5⤵
        
        PID:3676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49035.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51468.exe
        5⤵
        
        PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36658.exe
      4⤵
      PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21355.exe
      4⤵
      PID:3856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12874.exe
      4⤵
      PID:1744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8165.exe
      4⤵
      PID:5960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4810.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4810.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52221.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35059.exe
        5⤵
        
        PID:4032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42238.exe
        5⤵
        
        PID:1884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58583.exe
        5⤵
        
        PID:5816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1733.exe
      4⤵
      PID:2672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48795.exe
      4⤵
      PID:3084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16882.exe
      4⤵
      PID:4944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23964.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6342.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6342.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16399.exe
      4⤵
      PID:608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10508.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37690.exe
      4⤵
      PID:5016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49165.exe
      4⤵
      PID:5540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18343.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18343.exe
    3⤵
    PID:1136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46525.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46525.exe
    3⤵
    PID:3272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38969.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38969.exe
    3⤵
    PID:4392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26416.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26416.exe
    3⤵
    PID:5168
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1346.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1346.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60189.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60189.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17870.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6445.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44437.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-747.exe
        7⤵
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10508.exe
        7⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37690.exe
        7⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49165.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36112.exe
        6⤵
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
        7⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10420.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9651.exe
        7⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34775.exe
        7⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30792.exe
        6⤵
        
        PID:3192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30021.exe
        6⤵
        
        PID:3772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45572.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53282.exe
        6⤵
        
        PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6097.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37826.exe
        6⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
        7⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10420.exe
        7⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9651.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28553.exe
        7⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17057.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24155.exe
        6⤵
        
        PID:3556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58495.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7635.exe
        6⤵
        
        PID:6024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11083.exe
        5⤵
        
        PID:668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42024.exe
        5⤵
        
        PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-347.exe
        5⤵
        
        PID:4924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6219.exe
        5⤵
        
        PID:5704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48033.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48521.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9517.exe
        6⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9180.exe
        7⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61453.exe
        7⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22687.exe
        7⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34675.exe
        6⤵
        
        PID:3828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37690.exe
        6⤵
        
        PID:4984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49165.exe
        6⤵
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
        5⤵
        
        PID:2184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25958.exe
        6⤵
        
        PID:2568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22423.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62770.exe
        6⤵
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26607.exe
        6⤵
        
        PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1353.exe
        5⤵
        
        PID:2900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21355.exe
        5⤵
        
        PID:3748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51769.exe
        5⤵
        
        PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8165.exe
        5⤵
        
        PID:6032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23916.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37826.exe
        5⤵
        
        PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22423.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62770.exe
        5⤵
        
        PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49165.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37369.exe
      4⤵
      PID:536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33358.exe
      4⤵
      PID:4056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43434.exe
      4⤵
      PID:4400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25420.exe
      4⤵
      PID:5644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63541.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63541.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55646.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7104.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63378.exe
        6⤵
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12262.exe
        7⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62191.exe
        7⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61341.exe
        7⤵
        
        PID:5492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17057.exe
        6⤵
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24155.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
        6⤵
        
        PID:4828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1413.exe
        6⤵
        
        PID:6044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33206.exe
        5⤵
        
        PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24243.exe
        5⤵
        
        PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1406.exe
        5⤵
        
        PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35683.exe
        5⤵
        
        PID:3780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15827.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38127.exe
        5⤵
        
        PID:2696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35059.exe
        5⤵
        
        PID:4080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62770.exe
        5⤵
        
        PID:4576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26607.exe
        5⤵
        
        PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25582.exe
      4⤵
      PID:572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54660.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-347.exe
      4⤵
      PID:4976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53282.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45432.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45432.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59813.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62610.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34427.exe
        6⤵
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35059.exe
        6⤵
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62770.exe
        6⤵
        
        PID:4580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26607.exe
        6⤵
        
        PID:5428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28759.exe
        5⤵
        
        PID:3068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58909.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3098.exe
        5⤵
        
        PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40500.exe
        5⤵
        
        PID:5344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9880.exe
      4⤵
      PID:2684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11567.exe
        5⤵
        
        PID:2260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24155.exe
        5⤵
        
        PID:3496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17654.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7635.exe
        5⤵
        
        PID:5996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38110.exe
      4⤵
      PID:1824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42024.exe
      4⤵
      PID:3440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-347.exe
      4⤵
      PID:4980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41030.exe
      4⤵
      PID:5524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41842.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41842.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62610.exe
      4⤵
      PID:2012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
        5⤵
        
        PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5236.exe
        5⤵
        
        PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5689.exe
        5⤵
        
        PID:5784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17057.exe
      4⤵
      PID:3220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24155.exe
      4⤵
      PID:4116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
      4⤵
      PID:2080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1413.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20815.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20815.exe
    3⤵
    PID:2708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
      4⤵
      PID:3344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10420.exe
      4⤵
      PID:3736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9651.exe
      4⤵
      PID:4872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28553.exe
      4⤵
      PID:5896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11457.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11457.exe
    3⤵
    PID:3212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21885.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21885.exe
    3⤵
    PID:4100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51387.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51387.exe
    3⤵
    PID:4904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65311.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65311.exe
    3⤵
    PID:5864
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8942.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8942.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17870.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17870.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6445.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65049.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10176.exe
        6⤵
        
        PID:1800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10508.exe
        6⤵
        
        PID:3620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41500.exe
        6⤵
        
        PID:4764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40500.exe
        6⤵
        
        PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7415.exe
        5⤵
        
        PID:1256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48795.exe
        5⤵
        
        PID:2908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3098.exe
        5⤵
        
        PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5689.exe
        5⤵
        
        PID:5792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26709.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7571.exe
        5⤵
        
        PID:1720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15086.exe
        6⤵
        
        PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17057.exe
        5⤵
        
        PID:3184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24155.exe
        5⤵
        
        PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
        5⤵
        
        PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7635.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3387.exe
      4⤵
      PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39975.exe
        5⤵
        
        PID:5212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58697.exe
      4⤵
      PID:3680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34889.exe
      4⤵
      PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16224.exe
      4⤵
      PID:5372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38494.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38494.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46637.exe
      4⤵
      PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
        5⤵
        
        PID:3360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10420.exe
        5⤵
        
        PID:4108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34287.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58621.exe
        5⤵
        
        PID:5124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30792.exe
      4⤵
      PID:3120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45572.exe
      4⤵
      PID:4168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53282.exe
      4⤵
      PID:4188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11088.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11088.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-986.exe
      4⤵
      PID:2916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62199.exe
      4⤵
      PID:3532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3098.exe
      4⤵
      PID:4640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40500.exe
      4⤵
      PID:5400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60804.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60804.exe
    3⤵
    PID:600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31604.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31604.exe
    3⤵
    PID:3404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43434.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43434.exe
    3⤵
    PID:1740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53282.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53282.exe
    3⤵
    PID:5128
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44247.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44247.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10529.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10529.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35693.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49071.exe
        5⤵
        
        PID:2700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36159.exe
        5⤵
        
        PID:4020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3098.exe
        5⤵
        
        PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29885.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13985.exe
      4⤵
      PID:2820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48795.exe
      4⤵
      PID:4088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16882.exe
      4⤵
      PID:4948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23964.exe
      4⤵
      PID:5632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32163.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32163.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-747.exe
      4⤵
      PID:888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10550.exe
        5⤵
        
        PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61453.exe
        5⤵
        
        PID:2736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28909.exe
        5⤵
        
        PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10508.exe
      4⤵
      PID:3584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37690.exe
      4⤵
      PID:5024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49165.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19121.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19121.exe
    3⤵
    PID:2772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59481.exe
      4⤵
      PID:3396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8448.exe
      4⤵
      PID:4480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16657.exe
      4⤵
      PID:4328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36658.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36658.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21355.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21355.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12874.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12874.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1943.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1943.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6084
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37177.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37177.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52221.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52221.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22429.exe
      4⤵
      PID:2268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37826.exe
        5⤵
        
        PID:2716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22423.exe
        5⤵
        
        PID:4028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62770.exe
        5⤵
        
        PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49165.exe
        5⤵
        
        PID:5548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5516.exe
      4⤵
      PID:1700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36159.exe
      4⤵
      PID:3500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3098.exe
      4⤵
      PID:4672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17941.exe
      4⤵
      PID:5292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58562.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58562.exe
    3⤵
    PID:2092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48795.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48795.exe
    3⤵
    PID:3076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3098.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3098.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40500.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40500.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5440
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2059.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2059.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11738.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11738.exe
    3⤵
    PID:2136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64655.exe
      4⤵
      PID:3888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51173.exe
      4⤵
      PID:4152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8489.exe
      4⤵
      PID:5756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10508.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10508.exe
    3⤵
    PID:3524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21545.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21545.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49165.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49165.exe
    3⤵
    PID:5572
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40863.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40863.exe
  2⤵
  PID:1808
- C:\Users\Admin\AppData\Local\Temp\Unicorn-443.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-443.exe
  2⤵
  PID:3568
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61455.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61455.exe
  2⤵
  PID:4736
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49090.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49090.exe
  2⤵
  PID:5712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1346.exe

Filesize
468KB

MD5
12bde723095737cea89929a8d665986d

SHA1
e3ace79f54df5f05d89607c64d2c73cdfafe2684

SHA256
0d2420d065ba6b06468de5c05243f6e1c109f5916aa1aafae6a5c400eebfc03b

SHA512
941b7c7c3114a3f921a269e6c0bf811668577b8ee13c8e0d29e209fbcaaafad251c532a0b9dd676620550a451507597a8ff43895c676bd13221bf19d96f6d917

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36239.exe

Filesize
468KB

MD5
f6b3fa40dbfe7291dc5c9987f88dac23

SHA1
82e575a5ded5140be074423f5d3ef52e85a7f162

SHA256
c8def061412117edbfce92060043a3af4a016cd5fb9f387044a437b3f057eb4f

SHA512
bf8637d7261d9a786471ae9fdaf0a65a006fe4b14c5364263edfbf011406136f9f715f30692152ae9fdad48d9cfef7fcfc68b68df966db796d869d8cbe3d42b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44247.exe

Filesize
468KB

MD5
e45f0341cf0f54a3ec84cd07c8c4b0cd

SHA1
b8f6ed7611e54e111fbf174b29a2b4f0fa89443c

SHA256
9e023c21ee92ecfb0fdb8d058eee69be45623c6260720e3be6bb7215ca47b4f7

SHA512
948f5a6fe40ad648ea896abee251b28103c77e1538575932deed02c9f504aeee7744672fcd12d4f3b9a9a133a08e6ab2580b93ad08f4cd5369c7e2a22e284718

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52807.exe

Filesize
468KB

MD5
9e16e0302f2f776529a2680cd32b120a

SHA1
7855d552466ad1f1df63491883748adff5a91b7d

SHA256
1684bc5909f9fa76bde87f0eeab097de918b7aa66a122e5a0ffe7abd430a8940

SHA512
7f791f544fa87c92131e3d69307f93d1dd9140e494936e4083c7e5b8f41c6554000b95c759281c98b875ad9f2a82ef78c648b5be80a1c2aac6676bc89cf61d22

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60189.exe

Filesize
468KB

MD5
ccdc03489a671e9197738786f311982f

SHA1
7bf8c673950fa698f0a0494bbb7f4f406123f5fc

SHA256
133b45c4b7a725bbecb07726cf294780d0b3128705f43e35bdc108cc7561dfc9

SHA512
23b0f1a9b4733a8555858241b319a59fb78499e7200abd3f32b212648f42921bb0b08f1e810974abf470bb3e2506d65733d3f7d2faf01087141046b42291765b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62191.exe

Filesize
468KB

MD5
894fbdfc96adb552b21f7062761d83d5

SHA1
4aa9ca71f72f9a92475d421b2cda4f062116b122

SHA256
bd56ebde2905c3c72a48a51bf6999829970ec9e239f9c1084a1e99325c56fb25

SHA512
d2baf8c30fc044f96b71a5d4ce103b180745fa4dfd36ed3114e12595ed7e1d0a82a64e2f34eb52cd622a2f75f93d50327274d31701c9597f783d1aa6eba2243f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe

Filesize
468KB

MD5
b78ea09ab794b9c9f66d4eedc5b507d0

SHA1
bce9d32f1ee1cf22d30fc75837c9da082c4dd0ff

SHA256
6bb300975523b89740726fd41036a1942e12b101bfe879dc3445aedb1243e9c8

SHA512
c7cbc4329d6a368199a8eb6315ac47a5ac55bd393d4a53e32777fb7bd363b68fa8b4c8a1a1795b3fe5a814cca481c5f364c85d5aaaa307090648a30f426fc2da

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15976.exe

Filesize
468KB

MD5
c4f68e83a8bdd5b5d8986220180993d0

SHA1
723cfb92e1868e04b89c4cfa236ad95b401d4b99

SHA256
9f63ff6f06a6ac2b7c45a04a46b7df7f60e0164a8f1a2e0b222abf5e1cbe1cfa

SHA512
9d1519509020b3d6241fe517054e55ce75cdb41a4e65c0cb1cfa854b96f0a5e0c351dbe12665f85e514cba62028ab03ad9d32c044846ac1446d477f06c0e12e5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17870.exe

Filesize
468KB

MD5
1060602abaa3821d07a8b334d8c99998

SHA1
0cc31979ff4d3bd0f87904bb25e1bc20f6b5ca57

SHA256
964168afa2badc39ef0fa5f8fe805abd741b249b31a98df45e1d40839eb3472d

SHA512
537a8e9e1acc9058150b32c2751851ec12f53e7cf2510da482e72e3f42998fdc5bb027d2b3812d876aad119418ad800fd65ef107ce5f2fe97dd65c022319f604

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23166.exe

Filesize
468KB

MD5
eba6536d0cfdc3907d45185e101aacb9

SHA1
0f771fefb5d304553c93811ec53befeef7192a82

SHA256
9e080d3db55f4a3f729c26a85dbac113abd8b02f812bf130469287dfbdf5b9d2

SHA512
92f336236f41841e492058263530f4320e268ef37a2f040196ba061dae6def1ff35e6c5b875b389b34e2e16265070249f758c6a1bf60078b338b73d8031f4d7b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32561.exe

Filesize
468KB

MD5
81261a6267fd7a1cd3cf08166c1bb6f0

SHA1
d73d566fc9be903962fce6aabd662640ba91e38c

SHA256
4068c0f7f8169e6028d86d9a46f863b6e9aa3e321a29deebd22d615eaaba6e3c

SHA512
abb50876624739a8d52ca8e47673b0f3af92564e47cf9175acf65767d749df5dcc4b2c0b056af3ae7cc768d7ce85633982250f0cf188d91c026ce9b085a5270e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47670.exe

Filesize
468KB

MD5
54e862719c092ba7d9ca88728ed4fc56

SHA1
bb213a05f88e8d7c9b2b877a30191fd98d6cddfc

SHA256
29c561583623a3e033664940c4ba13cafd2e74f933e085bfda7999a56f0752aa

SHA512
2681daf9360e3c96b3225eb81d3578677e1c9e910c8c91e9ddeb7727d72e00cb31b47e8c338b36db954d40560e066bb02370744857b73204201a83d1787140b1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49665.exe

Filesize
468KB

MD5
e0a53ad83f9456c29c01638a72b7e21f

SHA1
c91469172b8bbddd4e41ecf5e6fcc19cb674a60c

SHA256
5dcb0dd1c9d4847dad7c73511c565207d43c7af3ebcf93e22102a10e111e1954

SHA512
f96f153fa729ffbf06d846f74415ee37b6ef8a948de27e690b9d1398e562a337f4a766e2c0a822784fe41d8f21804a6817c25a90bc0d760a7559dd66f4291f40

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-5246.exe

Filesize
468KB

MD5
53a1cb4af16f70de4045c77eba6c978f

SHA1
fd7b16e25b6fb83184a250ef0772154374965fe5

SHA256
2a6f10e40e10caa44b2047f6a5c62013c5f91dfec27d057abaf6e0be9a058c3d

SHA512
f24f126ab49e95d8e11e301485aca860c89bbfb08b9489baf8f8a1d0b9b165a1386dd2a3195003a193dd2f791c2186bb2fbe598d888e9030eb60d747f9a9d0a6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56022.exe

Filesize
468KB

MD5
be705029a57665714abe91221a9e3ac1

SHA1
b42eee709a3a1b9d5259c0b3afc2efd2cdfd7f88

SHA256
3055cdeacf267d7c7e76e66b8e1100ed596b535280e0180c53263a6cde5b396c

SHA512
aa97d1eaaeff5e9aad6dc1480aaba13ce85f027d779cbd81a5d1ff8605e065fa8b6fb6212affb8a46659254ea625a64e1fbf2216f06fd61097e386c3adc40e62

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56743.exe

Filesize
468KB

MD5
7437a32d3f00b34d33e8d02383848788

SHA1
2695e7aecf429633b2c60ae7a344e0e23a00e9d0

SHA256
1f590f7dc01eba5571c9268e38661787e5a7ca86d2eb1fe0fab543bb2f1fa357

SHA512
c994391200846a99a3f0a6c186144db962cd5efdb6f26e33342438a8cbb1573737652617bb1faefebb2319f6abb239ac75d35b529af9ba8cc15cce960cc7c261

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63541.exe

Filesize
468KB

MD5
e8c28b2dde15c4c7c84deeac7ef2e8e0

SHA1
703058103d7e25db341961e1f8e57d90b2332b96

SHA256
6e9f94b9ccc5af2289fc73275838c57f59437eeb4cdd6284e7c95ad73109ddab

SHA512
bde0302c1d78577900005b0f226ca03d896b96da4972232c34902c02db7fe2c14408dcc1c7f77316cfb1b796d524dc690f8bbec6cc3c96ab621a2b92b8e081e3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64273.exe

Filesize
468KB

MD5
5a64b7b8a2c06f9faddc119d5ed5aeee

SHA1
300a59c526b68d66def79b0803bdb7e5c6ef3709

SHA256
e2edd5c81bdca1e1d6bc21097d241d85318defc29c09e6646f6a642a5fe3376a

SHA512
20fa7f65ed73b165d9c0d7948d529563ce9b496416370e7091fa5fa7306628ad2fd2afd036209e743fc6d7cb1a9555d4d5e8fec984c6197b6d6b95730ab685e8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8942.exe

Filesize
468KB

MD5
a4f2119e22696fdd83ccf27710ced8e2

SHA1
6cc27a7bfb22f4c50f85c828b0c55bf502ebefb8

SHA256
b9016d5c4a44f0dcfa0d0c2394a58bfb363ede006f1af7bc2cce5cc4507d18dc

SHA512
cd7e6a98d729da203a376688515b4e9490165ff634c3b05d8f78f93478698124b1cb8da9962af050f744818bc4f5c942ef99103ec020c58df0424b2cbbb76976

Download Submit