cc0e32936e4b8997cb2a7a8d0dd48f317fe7f7686eb8047d55054fba5bcee1b3

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-10-2024 17:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc0e32936e4b8997cb2a7a8d0dd48f317fe7f7686eb8047d55054fba5bcee1b3N.exe
Size

468KB
MD5

611a5d1490965f37a647e736f4b4a940
SHA1

b3729a209464cc46f5a46fc831b09273c79004fb
SHA256

cc0e32936e4b8997cb2a7a8d0dd48f317fe7f7686eb8047d55054fba5bcee1b3
SHA512

7f03aad4101caad5b5af7a236ab42302867fea515c5f370743431292c3bfd531cf116630087fa2f3b50d8bd8f4efbde7c361e83c2a7095c50ca01a0eab261ac0
SSDEEP

3072:1G3HogIKI05TtbYfHzcOcf8/zChaP066nLHeTVPNg45LxClg/slv:1G3oD8TtUH4Ocfu3LTg4VAlg/

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2088	Unicorn-29009.exe
824	Unicorn-20431.exe
2424	Unicorn-12817.exe
2728	Unicorn-31972.exe
2792	Unicorn-57223.exe
2548	Unicorn-15636.exe
2564	Unicorn-50538.exe
2584	Unicorn-54948.exe
2924	Unicorn-10578.exe
1660	Unicorn-18192.exe
2340	Unicorn-13842.exe
2268	Unicorn-14107.exe
2060	Unicorn-53862.exe
1688	Unicorn-40126.exe
1976	Unicorn-56930.exe
1988	Unicorn-27486.exe
2196	Unicorn-62388.exe
1900	Unicorn-56458.exe
1728	Unicorn-60542.exe
1928	Unicorn-33223.exe
1792	Unicorn-47522.exe
1948	Unicorn-7236.exe
1576	Unicorn-26837.exe
1712	Unicorn-6681.exe
620	Unicorn-6681.exe
1468	Unicorn-40100.exe
1464	Unicorn-39546.exe
1904	Unicorn-30615.exe
2476	Unicorn-11512.exe
2972	Unicorn-61549.exe
2200	Unicorn-39083.exe
1852	Unicorn-61741.exe
2176	Unicorn-45405.exe
1532	Unicorn-25539.exe
2896	Unicorn-28804.exe
2884	Unicorn-28493.exe
2412	Unicorn-32577.exe
3008	Unicorn-25155.exe
1952	Unicorn-45021.exe
2732	Unicorn-58788.exe
2692	Unicorn-16935.exe
2708	Unicorn-41897.exe
2452	Unicorn-58980.exe
2536	Unicorn-9224.exe
2608	Unicorn-22223.exe
2920	Unicorn-42089.exe
1724	Unicorn-31874.exe
1412	Unicorn-33921.exe
324	Unicorn-33921.exe
2016	Unicorn-57087.exe
2512	Unicorn-9809.exe
2304	Unicorn-9809.exe
2324	Unicorn-12924.exe
1944	Unicorn-58041.exe
1524	Unicorn-4434.exe
2436	Unicorn-20216.exe
1504	Unicorn-60287.exe
1012	Unicorn-9478.exe
2344	Unicorn-26028.exe
1304	Unicorn-34942.exe
964	Unicorn-54808.exe
972	Unicorn-38207.exe
1884	Unicorn-18052.exe
788	Unicorn-30282.exe

Loads dropped DLL 64 IoCs

pid	Process
2416	cc0e32936e4b8997cb2a7a8d0dd48f317fe7f7686eb8047d55054fba5bcee1b3N.exe
2416	cc0e32936e4b8997cb2a7a8d0dd48f317fe7f7686eb8047d55054fba5bcee1b3N.exe
2088	Unicorn-29009.exe
2088	Unicorn-29009.exe
2416	cc0e32936e4b8997cb2a7a8d0dd48f317fe7f7686eb8047d55054fba5bcee1b3N.exe
2416	cc0e32936e4b8997cb2a7a8d0dd48f317fe7f7686eb8047d55054fba5bcee1b3N.exe
824	Unicorn-20431.exe
824	Unicorn-20431.exe
2088	Unicorn-29009.exe
2088	Unicorn-29009.exe
2424	Unicorn-12817.exe
2424	Unicorn-12817.exe
2416	cc0e32936e4b8997cb2a7a8d0dd48f317fe7f7686eb8047d55054fba5bcee1b3N.exe
2416	cc0e32936e4b8997cb2a7a8d0dd48f317fe7f7686eb8047d55054fba5bcee1b3N.exe
2728	Unicorn-31972.exe
2728	Unicorn-31972.exe
824	Unicorn-20431.exe
824	Unicorn-20431.exe
2564	Unicorn-50538.exe
2564	Unicorn-50538.exe
2416	cc0e32936e4b8997cb2a7a8d0dd48f317fe7f7686eb8047d55054fba5bcee1b3N.exe
2792	Unicorn-57223.exe
2416	cc0e32936e4b8997cb2a7a8d0dd48f317fe7f7686eb8047d55054fba5bcee1b3N.exe
2792	Unicorn-57223.exe
2088	Unicorn-29009.exe
2424	Unicorn-12817.exe
2088	Unicorn-29009.exe
2424	Unicorn-12817.exe
2548	Unicorn-15636.exe
2548	Unicorn-15636.exe
2924	Unicorn-10578.exe
2924	Unicorn-10578.exe
824	Unicorn-20431.exe
824	Unicorn-20431.exe
1688	Unicorn-40126.exe
1688	Unicorn-40126.exe
2060	Unicorn-53862.exe
2060	Unicorn-53862.exe
2424	Unicorn-12817.exe
2424	Unicorn-12817.exe
2268	Unicorn-14107.exe
2268	Unicorn-14107.exe
2792	Unicorn-57223.exe
2792	Unicorn-57223.exe
2088	Unicorn-29009.exe
2088	Unicorn-29009.exe
2340	Unicorn-13842.exe
2584	Unicorn-54948.exe
2340	Unicorn-13842.exe
2584	Unicorn-54948.exe
2728	Unicorn-31972.exe
1660	Unicorn-18192.exe
2416	cc0e32936e4b8997cb2a7a8d0dd48f317fe7f7686eb8047d55054fba5bcee1b3N.exe
2728	Unicorn-31972.exe
1660	Unicorn-18192.exe
2416	cc0e32936e4b8997cb2a7a8d0dd48f317fe7f7686eb8047d55054fba5bcee1b3N.exe
2564	Unicorn-50538.exe
2564	Unicorn-50538.exe
1976	Unicorn-56930.exe
1976	Unicorn-56930.exe
2548	Unicorn-15636.exe
2548	Unicorn-15636.exe
1988	Unicorn-27486.exe
1988	Unicorn-27486.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19011.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6323.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58410.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42449.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19011.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19011.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6951.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31874.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65485.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45476.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2113.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9897.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27583.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37143.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2378.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28590.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43301.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14107.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64921.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38473.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12817.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46054.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7262.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22794.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19011.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61741.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56163.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59468.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20460.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25539.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9897.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20364.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50736.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8076.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2476.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27486.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7262.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7707.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39546.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48477.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19011.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34942.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26745.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7707.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15384.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59747.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21811.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12160.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59876.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11240.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8732.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48964.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2416	cc0e32936e4b8997cb2a7a8d0dd48f317fe7f7686eb8047d55054fba5bcee1b3N.exe
2088	Unicorn-29009.exe
824	Unicorn-20431.exe
2424	Unicorn-12817.exe
2728	Unicorn-31972.exe
2792	Unicorn-57223.exe
2548	Unicorn-15636.exe
2564	Unicorn-50538.exe
2584	Unicorn-54948.exe
2924	Unicorn-10578.exe
2340	Unicorn-13842.exe
1688	Unicorn-40126.exe
1660	Unicorn-18192.exe
2268	Unicorn-14107.exe
2060	Unicorn-53862.exe
1976	Unicorn-56930.exe
1988	Unicorn-27486.exe
2196	Unicorn-62388.exe
1900	Unicorn-56458.exe
1728	Unicorn-60542.exe
1928	Unicorn-33223.exe
1792	Unicorn-47522.exe
620	Unicorn-6681.exe
1576	Unicorn-26837.exe
1948	Unicorn-7236.exe
1712	Unicorn-6681.exe
1468	Unicorn-40100.exe
1904	Unicorn-30615.exe
1464	Unicorn-39546.exe
2476	Unicorn-11512.exe
2972	Unicorn-61549.exe
2200	Unicorn-39083.exe
1852	Unicorn-61741.exe
2176	Unicorn-45405.exe
1532	Unicorn-25539.exe
2896	Unicorn-28804.exe
2884	Unicorn-28493.exe
2412	Unicorn-32577.exe
3008	Unicorn-25155.exe
1952	Unicorn-45021.exe
2732	Unicorn-58788.exe
2692	Unicorn-16935.exe
2708	Unicorn-41897.exe
2608	Unicorn-22223.exe
2536	Unicorn-9224.exe
2452	Unicorn-58980.exe
2920	Unicorn-42089.exe
1724	Unicorn-31874.exe
1412	Unicorn-33921.exe
324	Unicorn-33921.exe
2016	Unicorn-57087.exe
2512	Unicorn-9809.exe
2324	Unicorn-12924.exe
2304	Unicorn-9809.exe
1524	Unicorn-4434.exe
1944	Unicorn-58041.exe
2436	Unicorn-20216.exe
1504	Unicorn-60287.exe
1012	Unicorn-9478.exe
2344	Unicorn-26028.exe
1304	Unicorn-34942.exe
964	Unicorn-54808.exe
1884	Unicorn-18052.exe
972	Unicorn-38207.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2088	2416	cc0e32936e4b8997cb2a7a8d0dd48f317fe7f7686eb8047d55054fba5bcee1b3N.exe	31
PID 2416 wrote to memory of 2088	2416	cc0e32936e4b8997cb2a7a8d0dd48f317fe7f7686eb8047d55054fba5bcee1b3N.exe	31
PID 2416 wrote to memory of 2088	2416	cc0e32936e4b8997cb2a7a8d0dd48f317fe7f7686eb8047d55054fba5bcee1b3N.exe	31
PID 2416 wrote to memory of 2088	2416	cc0e32936e4b8997cb2a7a8d0dd48f317fe7f7686eb8047d55054fba5bcee1b3N.exe	31
PID 2088 wrote to memory of 824	2088	Unicorn-29009.exe	32
PID 2088 wrote to memory of 824	2088	Unicorn-29009.exe	32
PID 2088 wrote to memory of 824	2088	Unicorn-29009.exe	32
PID 2088 wrote to memory of 824	2088	Unicorn-29009.exe	32
PID 2416 wrote to memory of 2424	2416	cc0e32936e4b8997cb2a7a8d0dd48f317fe7f7686eb8047d55054fba5bcee1b3N.exe	33
PID 2416 wrote to memory of 2424	2416	cc0e32936e4b8997cb2a7a8d0dd48f317fe7f7686eb8047d55054fba5bcee1b3N.exe	33
PID 2416 wrote to memory of 2424	2416	cc0e32936e4b8997cb2a7a8d0dd48f317fe7f7686eb8047d55054fba5bcee1b3N.exe	33
PID 2416 wrote to memory of 2424	2416	cc0e32936e4b8997cb2a7a8d0dd48f317fe7f7686eb8047d55054fba5bcee1b3N.exe	33
PID 824 wrote to memory of 2728	824	Unicorn-20431.exe	34
PID 824 wrote to memory of 2728	824	Unicorn-20431.exe	34
PID 824 wrote to memory of 2728	824	Unicorn-20431.exe	34
PID 824 wrote to memory of 2728	824	Unicorn-20431.exe	34
PID 2088 wrote to memory of 2792	2088	Unicorn-29009.exe	35
PID 2088 wrote to memory of 2792	2088	Unicorn-29009.exe	35
PID 2088 wrote to memory of 2792	2088	Unicorn-29009.exe	35
PID 2088 wrote to memory of 2792	2088	Unicorn-29009.exe	35
PID 2424 wrote to memory of 2548	2424	Unicorn-12817.exe	36
PID 2424 wrote to memory of 2548	2424	Unicorn-12817.exe	36
PID 2424 wrote to memory of 2548	2424	Unicorn-12817.exe	36
PID 2424 wrote to memory of 2548	2424	Unicorn-12817.exe	36
PID 2416 wrote to memory of 2564	2416	cc0e32936e4b8997cb2a7a8d0dd48f317fe7f7686eb8047d55054fba5bcee1b3N.exe	37
PID 2416 wrote to memory of 2564	2416	cc0e32936e4b8997cb2a7a8d0dd48f317fe7f7686eb8047d55054fba5bcee1b3N.exe	37
PID 2416 wrote to memory of 2564	2416	cc0e32936e4b8997cb2a7a8d0dd48f317fe7f7686eb8047d55054fba5bcee1b3N.exe	37
PID 2416 wrote to memory of 2564	2416	cc0e32936e4b8997cb2a7a8d0dd48f317fe7f7686eb8047d55054fba5bcee1b3N.exe	37
PID 2728 wrote to memory of 2584	2728	Unicorn-31972.exe	38
PID 2728 wrote to memory of 2584	2728	Unicorn-31972.exe	38
PID 2728 wrote to memory of 2584	2728	Unicorn-31972.exe	38
PID 2728 wrote to memory of 2584	2728	Unicorn-31972.exe	38
PID 824 wrote to memory of 2924	824	Unicorn-20431.exe	39
PID 824 wrote to memory of 2924	824	Unicorn-20431.exe	39
PID 824 wrote to memory of 2924	824	Unicorn-20431.exe	39
PID 824 wrote to memory of 2924	824	Unicorn-20431.exe	39
PID 2564 wrote to memory of 1660	2564	Unicorn-50538.exe	40
PID 2564 wrote to memory of 1660	2564	Unicorn-50538.exe	40
PID 2564 wrote to memory of 1660	2564	Unicorn-50538.exe	40
PID 2564 wrote to memory of 1660	2564	Unicorn-50538.exe	40
PID 2416 wrote to memory of 2340	2416	cc0e32936e4b8997cb2a7a8d0dd48f317fe7f7686eb8047d55054fba5bcee1b3N.exe	41
PID 2416 wrote to memory of 2340	2416	cc0e32936e4b8997cb2a7a8d0dd48f317fe7f7686eb8047d55054fba5bcee1b3N.exe	41
PID 2416 wrote to memory of 2340	2416	cc0e32936e4b8997cb2a7a8d0dd48f317fe7f7686eb8047d55054fba5bcee1b3N.exe	41
PID 2792 wrote to memory of 2268	2792	Unicorn-57223.exe	42
PID 2416 wrote to memory of 2340	2416	cc0e32936e4b8997cb2a7a8d0dd48f317fe7f7686eb8047d55054fba5bcee1b3N.exe	41
PID 2792 wrote to memory of 2268	2792	Unicorn-57223.exe	42
PID 2792 wrote to memory of 2268	2792	Unicorn-57223.exe	42
PID 2792 wrote to memory of 2268	2792	Unicorn-57223.exe	42
PID 2088 wrote to memory of 2060	2088	Unicorn-29009.exe	43
PID 2088 wrote to memory of 2060	2088	Unicorn-29009.exe	43
PID 2088 wrote to memory of 2060	2088	Unicorn-29009.exe	43
PID 2088 wrote to memory of 2060	2088	Unicorn-29009.exe	43
PID 2424 wrote to memory of 1688	2424	Unicorn-12817.exe	44
PID 2424 wrote to memory of 1688	2424	Unicorn-12817.exe	44
PID 2424 wrote to memory of 1688	2424	Unicorn-12817.exe	44
PID 2424 wrote to memory of 1688	2424	Unicorn-12817.exe	44
PID 2548 wrote to memory of 1976	2548	Unicorn-15636.exe	45
PID 2548 wrote to memory of 1976	2548	Unicorn-15636.exe	45
PID 2548 wrote to memory of 1976	2548	Unicorn-15636.exe	45
PID 2548 wrote to memory of 1976	2548	Unicorn-15636.exe	45
PID 2924 wrote to memory of 1988	2924	Unicorn-10578.exe	46
PID 2924 wrote to memory of 1988	2924	Unicorn-10578.exe	46
PID 2924 wrote to memory of 1988	2924	Unicorn-10578.exe	46
PID 2924 wrote to memory of 1988	2924	Unicorn-10578.exe	46

C:\Users\Admin\AppData\Local\Temp\cc0e32936e4b8997cb2a7a8d0dd48f317fe7f7686eb8047d55054fba5bcee1b3N.exe
"C:\Users\Admin\AppData\Local\Temp\cc0e32936e4b8997cb2a7a8d0dd48f317fe7f7686eb8047d55054fba5bcee1b3N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29009.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29009.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20431.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20431.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31972.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54948.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6681.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9224.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30771.exe
        8⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11907.exe
        9⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39452.exe
        9⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        9⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3623.exe
        9⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13078.exe
        9⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53111.exe
        8⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59514.exe
        8⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
        8⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64579.exe
        8⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13724.exe
        8⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2161.exe
        7⤵
        
        PID:112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2378.exe
        8⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8076.exe
        8⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51377.exe
        7⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9712.exe
        7⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9400.exe
        7⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13724.exe
        7⤵
        
        PID:6660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22223.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31778.exe
        7⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2378.exe
        8⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29565.exe
        8⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21305.exe
        7⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3847.exe
        7⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9897.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25647.exe
        6⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57152.exe
        7⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21811.exe
        7⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36822.exe
        6⤵
        
        PID:3404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46164.exe
        6⤵
        
        PID:3612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58402.exe
        6⤵
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19541.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40100.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33921.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27886.exe
        7⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exe
        8⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13848.exe
        8⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4032.exe
        8⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13194.exe
        8⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exe
        7⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27583.exe
        7⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28590.exe
        7⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32948.exe
        7⤵
        
        PID:7132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52260.exe
        6⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26745.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35678.exe
        7⤵
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31863.exe
        7⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47101.exe
        6⤵
        
        PID:3572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57460.exe
        6⤵
        
        PID:3616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62685.exe
        6⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2476.exe
        6⤵
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9809.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52452.exe
        6⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8732.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49560.exe
        7⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9751.exe
        7⤵
        
        PID:6552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43017.exe
        6⤵
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45208.exe
        6⤵
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1232.exe
        6⤵
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6560.exe
        6⤵
        
        PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31513.exe
        5⤵
        
        PID:1008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2378.exe
        6⤵
        
        PID:4184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8076.exe
        6⤵
        
        PID:5500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32240.exe
        5⤵
        
        PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50049.exe
        5⤵
        
        PID:3332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9930.exe
        5⤵
        
        PID:288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52395.exe
        5⤵
        
        PID:6648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10578.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27486.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61741.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29728.exe
        7⤵
        
        PID:1124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20460.exe
        8⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48218.exe
        8⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2113.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40501.exe
        8⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50454.exe
        7⤵
        
        PID:900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46769.exe
        7⤵
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
        7⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52327.exe
        7⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56337.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46811.exe
        6⤵
        
        PID:568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58410.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56163.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63295.exe
        7⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24709.exe
        7⤵
        
        PID:6704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9254.exe
        6⤵
        
        PID:444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33449.exe
        6⤵
        
        PID:3148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1232.exe
        6⤵
        
        PID:4612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13724.exe
        6⤵
        
        PID:6688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25539.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1139.exe
        6⤵
        
        PID:1004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exe
        7⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8445.exe
        7⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60992.exe
        7⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23095.exe
        7⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exe
        6⤵
        
        PID:916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27583.exe
        6⤵
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9897.exe
        6⤵
        
        PID:940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        5⤵
        
        PID:1736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20460.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-839.exe
        7⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49560.exe
        7⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30171.exe
        7⤵
        
        PID:6504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11461.exe
        6⤵
        
        PID:3348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        6⤵
        
        PID:4896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3623.exe
        6⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49484.exe
        6⤵
        
        PID:7052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16878.exe
        5⤵
        
        PID:2400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56221.exe
        5⤵
        
        PID:3392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59515.exe
        5⤵
        
        PID:4112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62388.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45405.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18052.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52390.exe
        7⤵
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28597.exe
        8⤵
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13848.exe
        8⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4032.exe
        8⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16000.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65140.exe
        7⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43008.exe
        7⤵
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60495.exe
        7⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32948.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-839.exe
        7⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49560.exe
        7⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59876.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59053.exe
        6⤵
        
        PID:4040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4462.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48043.exe
        6⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19541.exe
        6⤵
        
        PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30282.exe
        5⤵
        Executes dropped EXE
        
        PID:788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6588.exe
        6⤵
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33365.exe
        6⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51595.exe
        6⤵
        
        PID:3520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9897.exe
        6⤵
        
        PID:4536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7335.exe
        6⤵
        
        PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45767.exe
        5⤵
        
        PID:2064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2378.exe
        6⤵
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8076.exe
        6⤵
        
        PID:6168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48882.exe
        5⤵
        
        PID:3624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36542.exe
        5⤵
        
        PID:3192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50234.exe
        5⤵
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41031.exe
        5⤵
        
        PID:6228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28804.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59468.exe
        5⤵
        
        PID:912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exe
        6⤵
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37143.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22794.exe
        6⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32948.exe
        6⤵
        
        PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exe
        5⤵
        
        PID:2352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27583.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5813.exe
        5⤵
        
        PID:4128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
        5⤵
        
        PID:5808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62105.exe
      4⤵
      PID:2104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31778.exe
        5⤵
        
        PID:1848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33128.exe
        6⤵
        
        PID:960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49560.exe
        6⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30171.exe
        6⤵
        
        PID:6516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48035.exe
        5⤵
        
        PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
        5⤵
        
        PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60495.exe
        5⤵
        
        PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32948.exe
        5⤵
        
        PID:7076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51429.exe
      4⤵
      PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2378.exe
        5⤵
        
        PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8076.exe
        5⤵
        
        PID:4916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32771.exe
      4⤵
      PID:3252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45583.exe
      4⤵
      PID:3652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48601.exe
      4⤵
      PID:4492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50736.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57223.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57223.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14107.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47522.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41897.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1798.exe
        7⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exe
        8⤵
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13848.exe
        8⤵
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12200.exe
        8⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27677.exe
        8⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exe
        7⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27583.exe
        7⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9897.exe
        7⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40501.exe
        7⤵
        
        PID:6344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3313.exe
        6⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34581.exe
        7⤵
        
        PID:772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41391.exe
        7⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21811.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44052.exe
        6⤵
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33619.exe
        6⤵
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61025.exe
        6⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36075.exe
        6⤵
        
        PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22027.exe
        6⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3867.exe
        7⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21811.exe
        7⤵
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17221.exe
        6⤵
        
        PID:3396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48964.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9897.exe
        6⤵
        
        PID:1956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32424.exe
        5⤵
        
        PID:2040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16651.exe
        6⤵
        
        PID:2084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1129.exe
        6⤵
        
        PID:3128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31382.exe
        6⤵
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3623.exe
        6⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49484.exe
        6⤵
        
        PID:7044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16577.exe
        5⤵
        
        PID:2824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56989.exe
        5⤵
        
        PID:3940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53464.exe
        5⤵
        
        PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65109.exe
        5⤵
        
        PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19500.exe
        5⤵
        
        PID:6356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7236.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42089.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11118.exe
        6⤵
        
        PID:860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38473.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49560.exe
        7⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59876.exe
        7⤵
        
        PID:6720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53188.exe
        6⤵
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
        6⤵
        
        PID:4820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64579.exe
        6⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13724.exe
        6⤵
        
        PID:6672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56214.exe
        5⤵
        
        PID:1216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33237.exe
        6⤵
        
        PID:4948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49560.exe
        6⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59876.exe
        6⤵
        
        PID:6772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9820.exe
        5⤵
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
        5⤵
        
        PID:4776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60495.exe
        5⤵
        
        PID:6076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32948.exe
        5⤵
        
        PID:7100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31874.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21228.exe
        5⤵
        
        PID:2932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45286.exe
        5⤵
        
        PID:3432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        5⤵
        
        PID:4840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7707.exe
        5⤵
        
        PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23095.exe
        5⤵
        
        PID:5220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29214.exe
      4⤵
      PID:768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39885.exe
      4⤵
      PID:3540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53464.exe
      4⤵
      PID:4796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61025.exe
      4⤵
      PID:5712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52395.exe
      4⤵
      PID:6620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53862.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53862.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60542.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28493.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25343.exe
        6⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13402.exe
        7⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58680.exe
        7⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1842.exe
        7⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49166.exe
        7⤵
        
        PID:6308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exe
        6⤵
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27583.exe
        6⤵
        
        PID:3152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9897.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23095.exe
        6⤵
        
        PID:6116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26089.exe
        5⤵
        
        PID:2568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34389.exe
        6⤵
        
        PID:4172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49560.exe
        6⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59876.exe
        6⤵
        
        PID:6756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9254.exe
        5⤵
        
        PID:2612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34342.exe
        5⤵
        
        PID:4468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35791.exe
        5⤵
        
        PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19541.exe
        5⤵
        
        PID:6148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25155.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59468.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exe
        6⤵
        
        PID:3104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13848.exe
        6⤵
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12200.exe
        6⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37490.exe
        6⤵
        
        PID:5828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exe
        5⤵
        
        PID:1548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27583.exe
        5⤵
        
        PID:3212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9897.exe
        5⤵
        
        PID:4664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7335.exe
        5⤵
        
        PID:5732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8413.exe
      4⤵
      PID:2056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exe
        5⤵
        
        PID:2576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13848.exe
        5⤵
        
        PID:3676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65485.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27677.exe
        5⤵
        
        PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15119.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24783.exe
      4⤵
      PID:3588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50234.exe
      4⤵
      PID:4552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19541.exe
      4⤵
      PID:5448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26837.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26837.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33921.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17205.exe
        5⤵
        
        PID:1104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50661.exe
        5⤵
        
        PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
        5⤵
        
        PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64579.exe
        5⤵
        
        PID:5636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49027.exe
      4⤵
      PID:2736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21945.exe
        5⤵
        
        PID:1452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49560.exe
        5⤵
        
        PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38279.exe
        5⤵
        
        PID:6984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61953.exe
      4⤵
      PID:3312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
      4⤵
      PID:4724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64579.exe
      4⤵
      PID:5516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2476.exe
      4⤵
      PID:5484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57087.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57087.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19095.exe
      4⤵
      PID:1892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2378.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29565.exe
        5⤵
        
        PID:6220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48035.exe
      4⤵
      PID:4004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
      4⤵
      PID:4848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51376.exe
      4⤵
      PID:5792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50014.exe
      4⤵
      PID:6868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55274.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55274.exe
    3⤵
    PID:2856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2378.exe
      4⤵
      PID:4384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8076.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29387.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29387.exe
    3⤵
    PID:4028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43663.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43663.exe
    3⤵
    PID:4764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38359.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38359.exe
    3⤵
    PID:6108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65149.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65149.exe
    3⤵
    PID:6936
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12817.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12817.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15636.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15636.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56930.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61549.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26028.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46739.exe
        7⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33116.exe
        7⤵
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        7⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7707.exe
        7⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
        7⤵
        
        PID:6192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50994.exe
        6⤵
        
        PID:1868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42816.exe
        6⤵
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1232.exe
        6⤵
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2476.exe
        6⤵
        
        PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34942.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62499.exe
        6⤵
        
        PID:776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33116.exe
        6⤵
        
        PID:4088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32534.exe
        6⤵
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7707.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62196.exe
        6⤵
        
        PID:6596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41098.exe
        5⤵
        
        PID:3480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15930.exe
        5⤵
        
        PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50234.exe
        5⤵
        
        PID:808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7865.exe
        5⤵
        
        PID:5600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39083.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54808.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25551.exe
        6⤵
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36951.exe
        6⤵
        
        PID:4220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1729.exe
        6⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27583.exe
        5⤵
        
        PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9897.exe
        5⤵
        
        PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
        5⤵
        
        PID:5824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38207.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20953.exe
        5⤵
        
        PID:2376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59747.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29565.exe
        6⤵
        
        PID:6236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46852.exe
        5⤵
        
        PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54736.exe
        5⤵
        
        PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60495.exe
        5⤵
        
        PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32948.exe
        5⤵
        
        PID:7108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55686.exe
      4⤵
      PID:2460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33852.exe
      4⤵
      PID:4064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4992.exe
      4⤵
      PID:4864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39494.exe
      4⤵
      PID:6068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23148.exe
      4⤵
      PID:6944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40126.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40126.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56458.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32577.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58591.exe
        6⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exe
        7⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13848.exe
        7⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4032.exe
        7⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31761.exe
        7⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exe
        6⤵
        
        PID:2456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27583.exe
        6⤵
        
        PID:3892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28590.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32948.exe
        6⤵
        
        PID:7084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51170.exe
        5⤵
        
        PID:1908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exe
        6⤵
        
        PID:3080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13848.exe
        6⤵
        
        PID:3688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65485.exe
        6⤵
        
        PID:4248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27677.exe
        6⤵
        
        PID:5472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9254.exe
        5⤵
        
        PID:2392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33449.exe
        5⤵
        
        PID:3164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9400.exe
        5⤵
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2476.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58788.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13282.exe
        5⤵
        
        PID:2648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12566.exe
        6⤵
        
        PID:1720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46054.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3623.exe
        6⤵
        
        PID:6004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6951.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42093.exe
        5⤵
        
        PID:2760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46852.exe
        5⤵
        
        PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54736.exe
        5⤵
        
        PID:4328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60495.exe
        5⤵
        
        PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32948.exe
        5⤵
        
        PID:7092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20364.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33237.exe
        5⤵
        
        PID:4956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49560.exe
        5⤵
        
        PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38279.exe
        5⤵
        
        PID:7016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15119.exe
      4⤵
      PID:1676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24783.exe
      4⤵
      PID:3596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50234.exe
      4⤵
      PID:4596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7865.exe
      4⤵
      PID:5720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33223.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33223.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45021.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22027.exe
        5⤵
        
        PID:1204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43081.exe
        6⤵
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45476.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21811.exe
        6⤵
        
        PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45810.exe
        5⤵
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3847.exe
        5⤵
        
        PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9897.exe
        5⤵
        
        PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23095.exe
        5⤵
        
        PID:5224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51554.exe
      4⤵
      PID:2276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37263.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5021.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        5⤵
        
        PID:4872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7707.exe
        5⤵
        
        PID:5660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23095.exe
        5⤵
        
        PID:4704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64921.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43081.exe
        5⤵
        
        PID:4264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64002.exe
        5⤵
        
        PID:4144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43301.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52717.exe
      4⤵
      PID:3992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46071.exe
      4⤵
      PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43959.exe
      4⤵
      PID:5908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27902.exe
      4⤵
      PID:6524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16935.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16935.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26495.exe
      4⤵
      PID:2552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55001.exe
        5⤵
        
        PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49560.exe
        5⤵
        
        PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52284.exe
        5⤵
        
        PID:6988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35233.exe
      4⤵
      PID:3492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24596.exe
      4⤵
      PID:3444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7203.exe
      4⤵
      PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8613.exe
      4⤵
      PID:6896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21840.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21840.exe
    3⤵
    PID:1068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12707.exe
      4⤵
      PID:2208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8076.exe
      4⤵
      PID:5584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10422.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10422.exe
    3⤵
    PID:3136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25314.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25314.exe
    3⤵
    PID:3928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41684.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41684.exe
    3⤵
    PID:4164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14165.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14165.exe
    3⤵
    PID:6300
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50538.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50538.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18192.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18192.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39546.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12924.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64642.exe
        6⤵
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2378.exe
        7⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1408.exe
        7⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17221.exe
        6⤵
        
        PID:3416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48964.exe
        6⤵
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9897.exe
        6⤵
        
        PID:2464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28056.exe
        5⤵
        
        PID:1788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exe
        6⤵
        
        PID:1048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13848.exe
        6⤵
        
        PID:3708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9665.exe
        6⤵
        
        PID:5972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32948.exe
        6⤵
        
        PID:7124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9254.exe
        5⤵
        
        PID:2000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19400.exe
        5⤵
        
        PID:4656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38473.exe
        6⤵
        
        PID:4132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49560.exe
        6⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59876.exe
        6⤵
        
        PID:6748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18012.exe
        5⤵
        
        PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43578.exe
        5⤵
        
        PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58212.exe
        5⤵
        
        PID:5704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4434.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9058.exe
        5⤵
        
        PID:792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28949.exe
        5⤵
        
        PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        5⤵
        
        PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7707.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23095.exe
        5⤵
        
        PID:2232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43193.exe
      4⤵
      PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4201.exe
      4⤵
      PID:3764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4462.exe
      4⤵
      PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43959.exe
      4⤵
      PID:5932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50014.exe
      4⤵
      PID:6876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11512.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11512.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43302.exe
      4⤵
      PID:2380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37263.exe
        5⤵
        
        PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50138.exe
        5⤵
        
        PID:3884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22794.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32948.exe
        5⤵
        
        PID:7140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64921.exe
      4⤵
      PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13848.exe
        5⤵
        
        PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37256.exe
        5⤵
        
        PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49484.exe
        5⤵
        
        PID:7060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15119.exe
      4⤵
      PID:1932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17807.exe
      4⤵
      PID:4420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65109.exe
      4⤵
      PID:5724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52395.exe
      4⤵
      PID:6608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9809.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9809.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6588.exe
      4⤵
      PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63831.exe
        5⤵
        
        PID:316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8076.exe
        5⤵
        
        PID:6044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33365.exe
      4⤵
      PID:3552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51595.exe
      4⤵
      PID:3664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9897.exe
      4⤵
      PID:4672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6323.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6323.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2378.exe
      4⤵
      PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8076.exe
      4⤵
      PID:5372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44301.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44301.exe
    3⤵
    PID:3560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36343.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36343.exe
    3⤵
    PID:3660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1762.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1762.exe
    3⤵
    PID:4712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63548.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63548.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6160
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13842.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13842.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6681.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6681.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20216.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30771.exe
        5⤵
        
        PID:332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20876.exe
        6⤵
        
        PID:4640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53644.exe
        6⤵
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25895.exe
        6⤵
        
        PID:6140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16422.exe
        5⤵
        
        PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        5⤵
        
        PID:4904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3623.exe
        5⤵
        
        PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49484.exe
        5⤵
        
        PID:7036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10329.exe
      4⤵
      PID:1856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8924.exe
        5⤵
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53644.exe
        5⤵
        
        PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21859.exe
        5⤵
        
        PID:6652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4699.exe
      4⤵
      PID:3904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42449.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19541.exe
      4⤵
      PID:4912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9478.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9478.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54590.exe
      4⤵
      PID:2816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37803.exe
        5⤵
        
        PID:2524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33116.exe
        5⤵
        
        PID:3124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        5⤵
        
        PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3623.exe
        5⤵
        
        PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13078.exe
        5⤵
        
        PID:7000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exe
      4⤵
      PID:2272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27583.exe
      4⤵
      PID:3216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28590.exe
      4⤵
      PID:5284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32948.exe
      4⤵
      PID:7148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25647.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25647.exe
    3⤵
    PID:1016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exe
      4⤵
      PID:2908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13848.exe
      4⤵
      PID:3656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4032.exe
      4⤵
      PID:2244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27677.exe
      4⤵
      PID:6136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15119.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15119.exe
    3⤵
    PID:2844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17807.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17807.exe
    3⤵
    PID:4432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61025.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61025.exe
    3⤵
    PID:5924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28483.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28483.exe
    3⤵
    PID:6928
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30615.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30615.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58041.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58041.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31778.exe
      4⤵
      PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2378.exe
        5⤵
        
        PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12160.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58254.exe
      4⤵
      PID:3436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61216.exe
      4⤵
      PID:3196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18065.exe
      4⤵
      PID:5168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
      4⤵
      PID:5328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11912.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11912.exe
    3⤵
    PID:1544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2378.exe
      4⤵
      PID:4412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8076.exe
      4⤵
      PID:5312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35040.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35040.exe
    3⤵
    PID:3260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9712.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9712.exe
    3⤵
    PID:3320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1232.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1232.exe
    3⤵
    PID:4592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23965.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23965.exe
    3⤵
    PID:6324
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60287.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60287.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60558.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60558.exe
    3⤵
    PID:2704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28585.exe
      4⤵
      PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25720.exe
      4⤵
      PID:6812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17221.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17221.exe
    3⤵
    PID:3424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48964.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48964.exe
    3⤵
    PID:3468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9897.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9897.exe
    3⤵
    PID:4688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5776
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47882.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47882.exe
  2⤵
  PID:1708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9296.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9296.exe
    3⤵
    PID:6580
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11240.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11240.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3268
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40248.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40248.exe
  2⤵
  PID:3352
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44633.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44633.exe
  2⤵
  PID:4624
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38761.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38761.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-15636.exe

Filesize
468KB

MD5
86a9739f434128f9944df47046d405a3

SHA1
7a7a1600464ff9b12402e88713510faeed68d9fb

SHA256
371b031c6384f0cccc0492ed438af1d1ce112852dc6688c42dc3153b3adf0922

SHA512
77cc18d9b5d2262cb67cc8fc224d2b3deae7cb054d7abf7cb864471240aaf00b373481b5e281f940bf25d10f0ebe137c3370eccce8a7a6718c446073308067ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20431.exe

Filesize
468KB

MD5
7eea84b14c97f345b2edac5b8c21518d

SHA1
b6cf926333da526c7795af67d423160b6076b87a

SHA256
af649c0acd88bfab78c3802d979db72055ddddc9d8a384b0c8ef2a4150045581

SHA512
4ffbb2368df0308100729a92e25b68ca133726c15293d40edc7633cbcfadef0ca3cd85c3e4bbecc7162df9e125f0c534f391adaa4a897c3381a69758ba614ac3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40100.exe

Filesize
468KB

MD5
4d45654094a55486bd3352182fe564e9

SHA1
7e7848efcdd7d4077a79d31f8f56032006f6c710

SHA256
84e0909ac4d8230a249f80234e8e070b9493b6aafb5b504b07e0af48abfeb0ee

SHA512
c0ab4e8ceba955a88a0a242b75da639413ec4cb9f8b8802aebcac3a5859f68b811a570f556c378c2fe82756195683fc1993e242e6dae57b268685c824e70c687

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40126.exe

Filesize
468KB

MD5
ecee8187d1207b291722d247903651ca

SHA1
92960d75ee7e4cf6f1bf37a0fa7823eda3ca3abb

SHA256
28c1623ec728fb4298aba9c70363c35b3f58f8bd256fe1dad747b801ce1c8253

SHA512
02fbf996b3a1e99a571160587d48d15cdeb4a411a45c563e37aaff5512bfa9657a0b8256dcf565da7658e0da8fdd57262cabe92c780d9add3706731dfc678bda

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57223.exe

Filesize
468KB

MD5
efbfa05b21836c7ee8cb6ba301fd2a14

SHA1
af5267ca19825fc347dee27ac5a73cc5b0b505e8

SHA256
d10240f189f169332e27aa4819bde0aa5343def092d17dbac9ad49147e8e0a6f

SHA512
d68ee4eb2c8261b22f2d1388c3060133488bb21d7bd0b9c6cfa4f2d6592fa94eb510056ff20b66ed6a8c99cc8b9496235a824db1df29e4c6ce1e61e43b729066

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62388.exe

Filesize
468KB

MD5
485d9b8877639f6740c93f4c4053abe8

SHA1
c9bf38bd5bde33bf6d54cf36e68587fbd1eb5e52

SHA256
91e63846e2b24e60a3c44a0a6fa5500cb0e6ca96dbaac008553ec487b7dec08c

SHA512
ce2c08e6a48ef0862c0f049c712622d960d23ffbd27861694098e1d08ab1e8c295fddaedf2d5d205129d79c5e6225003465a741b0c50b987b8006c88341ec23e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-10578.exe

Filesize
468KB

MD5
c7ed24a8d14ac2604843f23b466f6aed

SHA1
de4c76dfb1e429ba8be6da25a12466182d7154d0

SHA256
c47eb09ea82527e2d63c9b531cec72338149c0b5262e28aa0b9e01c4404cf24e

SHA512
ab199a32e0b7774e5ad111f791d764b622ad38ca084b4a8a7dedee61647694e3ce4785dd3deea7e60685045c4a5096af4f0e37fd22ff791b1e2b112e023bfe3b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12817.exe

Filesize
468KB

MD5
c185b8920d9b33fa5a0936a59480b2e8

SHA1
ed809ab4db584d3453b71ef58b2909fe47d043b5

SHA256
4ca0faa8a20cfb39d441253857329a1a0b17bc2a62dc890b6139488253137375

SHA512
5ee93a27eb790dee31e20f780b4ea328cd8d72960fe254ae5d44d3012ca2cc48d8c79cf7d402f9d38631f694756ce73df02b3b48a9dd68a56a7f0d93583f1c99

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13842.exe

Filesize
468KB

MD5
5a50080e31b36f5a436ceb598e5aaa6e

SHA1
1eacf9180037c8284abd1c6f54bf667219642666

SHA256
de1e8949a0ff16bd35bef9c38cd38916be9e963715c61952fd4662c17cfe9397

SHA512
497d0076e4e0e99d0d4fc0262cf81b70ecc555e3d178a9e8c82a077b718f03c0ccf832afdd59d99d4c27d8382ec925ddf3180e79a7a42d4e5669cc2d39c2bd46

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14107.exe

Filesize
468KB

MD5
b9ee10229fb90c557e9c2ec9ec724c1c

SHA1
3e6301fbaa74d50c510de5ba81664715495cd2d3

SHA256
0ff9597becce06a1d866992760ec64ef98bb12c95f8b9e2d2338da8a83adec3a

SHA512
da6849ebfeb357007fd4bd87765b0f001d22599bf54f8b781389d2438e8de29a3b1af01e3f9b47d28e8202dbd6bfe427be828e52aeed97a497d5d035d3acb4d6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18192.exe

Filesize
468KB

MD5
74a17e485db472b3bf2b50f30f342f23

SHA1
920e61e8d525ebeb9841c09ebc886cdc3104197c

SHA256
8d938f46d7e0d526d23ac9963ddb44604e306c6a3631e8277915c20370b60aa0

SHA512
9127f164e460211a3b40b5fd4739576a0ea110b40dc1056c8154376dd710b99b8dae2211ffc21bce260b4827d2b651233ed500031ba5a117ffd651e5d81aa78b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27486.exe

Filesize
468KB

MD5
cbbd64e150e25a2af3e805cdfd18ed22

SHA1
6cd109fe19011b15b8b155c28a3f3cc633b8ae69

SHA256
1308155f452413eb22c5a9f9691f7949f3d5df347029b3f639c11241589d01a8

SHA512
7fb0344bbc24b1a3aa68dea89f496c4f5ad20c6226a47a02e5702feee231172c4945c2b5f9e88d3fc87609d20a9d8392763d2ec83d2a226a8928ed48a79f7272

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29009.exe

Filesize
468KB

MD5
e28005a3eb6a4018af49231341bbca73

SHA1
c30e7bcfcd2fa940fad5444c430cbe67c90a9203

SHA256
95acd2c10edb02977b8064893ae1bbdc3c4aa04840f928e6223707ff0eea20e0

SHA512
a0f645430eeaed1f3313f183ba722b20051c56848256572f6f92f5fa0c756ee0961b8bd92c39230051f1a2a6e2cca860fb50e1899418c5731acece883d317515

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31972.exe

Filesize
468KB

MD5
83ab1be466c8555aefc97f44549c5419

SHA1
ce9d5bf0338c629cbb73f5c356f7b2842f2d7a55

SHA256
d05b86415f2b7cc20fb1d100e936033d3c63082cccaafa8f706a206e85897717

SHA512
ba0535b6cdc71025bc25ff187208b20082bd669f479e739fd459d912d7eb0c0f03eabd4748a6540bf6528ac51eda6c72bb0c8a01316cc7185ce9d54cf26a5677

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-50538.exe

Filesize
468KB

MD5
04870c073dc7ae3a3fc215984340a29e

SHA1
e14f99e4c2236358e24058f495fa67f2d93b377f

SHA256
7b0ac3c1efd68d3494de306281d550939be2c9f5f497f2fc23ced160a90557a7

SHA512
bd081b0b5118e9defb9a987e85b21b5a7f9eb9cb7c60e447ffd6be47869d565cbf5b0d4dce957c5f9f2bed9a688c0303b97be98d7c35cdaba29a38f63ca86ca3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53862.exe

Filesize
468KB

MD5
c23cb13fab5003a9275a2fc3f48d2a7d

SHA1
bb9901c6fd5e322c1be20b48ef95ab70250dcc72

SHA256
f9382b12ca4d79cd1516d2102d95014adeb2da6a174a8deaa9b16b0090400777

SHA512
2e23ad0a3a746810c63618c68046f75d2209ef9b7b01e1e70cc15f0621adee23f6f92151261c30b1ce411a9a752d2ac0d0215bca0256da810a97cc5ba587aa24

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54948.exe

Filesize
468KB

MD5
52c6c1d7e5eda85d0cc1fa521e9d66f1

SHA1
0598a324cd713a531f4f69a61bb53ad7829718c2

SHA256
3266757e070da32278754a3ff3fdb078b41f6d82687d8fe311249ef34ab16c43

SHA512
512ca76b9fee74d0381906964feb1fcb357aa10eaff25095bc6e930027749c18d812e2f84b922161a0c0a98c31365e2ade02fa513583293d72d43d83a2a11599

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56458.exe

Filesize
468KB

MD5
b1e66a02daad31d58611ed4ba586934e

SHA1
34baed4c8abea4db94f51cc1aab469ef43db4450

SHA256
879a683cbc651ae3dd70191d9b8c2bf584ac2fea50cc18eddcbf9d1472c0cff8

SHA512
04fc3ce22fded6160de85b52f609d3a8e2b52b547f75d7c68a39a8c15f439b888ab6fac8ea2b9e70b1c1b5a96a91d27b301ce04e1feeb92321be24319b3573ae

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56930.exe

Filesize
468KB

MD5
c55572e3513c2ebb028b132fdae5bd9a

SHA1
54a074aaa377f456034da4cdb9459435d1e5a0d7

SHA256
01d5e80beea4e2372f2b0ee7fc895c1214f1996cfe580e908054ab14b2eb7a15

SHA512
ab4b3e9c374814cd5e8a074b9585b5e8d69d4246d25287556da83686656796bdae9826715c5645b5ac6daaf8787c976afd0a4c587044bf223acd4b87f9287fef

Download Submit