a94e942831d48bb0d5901989be58ad4d93dbb5b9941f7b7a14dd2283559d47fd

Analysis

max time kernel
114s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 01:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a94e942831d48bb0d5901989be58ad4d93dbb5b9941f7b7a14dd2283559d47fdN.exe
Size

468KB
MD5

3471e2d8c69060e0766eb3e9d567a260
SHA1

271c8735fe0f813bbedcab2713c4d4bedf603a3e
SHA256

a94e942831d48bb0d5901989be58ad4d93dbb5b9941f7b7a14dd2283559d47fd
SHA512

47c89f721f455d7cd91a6e1bf9206dda746b9bb8b0623777b7bd4d17240360782cd2064141210ef2e1ff9d1cbb60c5fcfed354f670bdcc3e7278fe13034fc469
SSDEEP

3072:VPqjovOWIg5vtzYZJgu5OfDtrrCdkqIpqlmHeVSwHvlUv5HU9SDKh:VPCoIQvt+JD5OfO0u1vlq1U9S

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3016	Unicorn-63826.exe
1312	Unicorn-37117.exe
2916	Unicorn-3738.exe
2860	Unicorn-52278.exe
2828	Unicorn-124.exe
2612	Unicorn-19990.exe
1800	Unicorn-13667.exe
2668	Unicorn-27515.exe
2232	Unicorn-22366.exe
560	Unicorn-25979.exe
3060	Unicorn-6335.exe
1124	Unicorn-37385.exe
2928	Unicorn-37650.exe
1640	Unicorn-37650.exe
2812	Unicorn-17784.exe
1084	Unicorn-17085.exe
1636	Unicorn-17661.exe
292	Unicorn-49819.exe
2136	Unicorn-53570.exe
2504	Unicorn-47287.exe
1340	Unicorn-34350.exe
540	Unicorn-60862.exe
2588	Unicorn-36628.exe
1784	Unicorn-45294.exe
2000	Unicorn-47697.exe
2004	Unicorn-47697.exe
2480	Unicorn-28599.exe
2448	Unicorn-48465.exe
1932	Unicorn-33214.exe
2076	Unicorn-1758.exe
1164	Unicorn-28326.exe
1736	Unicorn-34457.exe
564	Unicorn-47456.exe
2064	Unicorn-52246.exe
1860	Unicorn-15167.exe
3020	Unicorn-5816.exe
2348	Unicorn-58151.exe
2264	Unicorn-39641.exe
2892	Unicorn-49952.exe
2876	Unicorn-51898.exe
2632	Unicorn-37337.exe
2888	Unicorn-31974.exe
2604	Unicorn-44218.exe
2624	Unicorn-16912.exe
2472	Unicorn-45784.exe
2636	Unicorn-29875.exe
2168	Unicorn-16938.exe
2104	Unicorn-29744.exe
2704	Unicorn-32589.exe
1752	Unicorn-14425.exe
1724	Unicorn-11539.exe
1520	Unicorn-37005.exe
1928	Unicorn-22048.exe
2692	Unicorn-37773.exe
2996	Unicorn-34954.exe
1036	Unicorn-54820.exe
1156	Unicorn-22532.exe
712	Unicorn-49458.exe
1088	Unicorn-50955.exe
636	Unicorn-43352.exe
1720	Unicorn-39329.exe
2308	Unicorn-64379.exe
1984	Unicorn-42209.exe
988	Unicorn-31541.exe

Loads dropped DLL 64 IoCs

pid	Process
2376	a94e942831d48bb0d5901989be58ad4d93dbb5b9941f7b7a14dd2283559d47fdN.exe
2376	a94e942831d48bb0d5901989be58ad4d93dbb5b9941f7b7a14dd2283559d47fdN.exe
3016	Unicorn-63826.exe
3016	Unicorn-63826.exe
2376	a94e942831d48bb0d5901989be58ad4d93dbb5b9941f7b7a14dd2283559d47fdN.exe
2376	a94e942831d48bb0d5901989be58ad4d93dbb5b9941f7b7a14dd2283559d47fdN.exe
1312	Unicorn-37117.exe
1312	Unicorn-37117.exe
2916	Unicorn-3738.exe
2916	Unicorn-3738.exe
3016	Unicorn-63826.exe
3016	Unicorn-63826.exe
2376	a94e942831d48bb0d5901989be58ad4d93dbb5b9941f7b7a14dd2283559d47fdN.exe
2376	a94e942831d48bb0d5901989be58ad4d93dbb5b9941f7b7a14dd2283559d47fdN.exe
2860	Unicorn-52278.exe
2860	Unicorn-52278.exe
1312	Unicorn-37117.exe
1312	Unicorn-37117.exe
2828	Unicorn-124.exe
2828	Unicorn-124.exe
3016	Unicorn-63826.exe
3016	Unicorn-63826.exe
2376	a94e942831d48bb0d5901989be58ad4d93dbb5b9941f7b7a14dd2283559d47fdN.exe
2916	Unicorn-3738.exe
1800	Unicorn-13667.exe
2376	a94e942831d48bb0d5901989be58ad4d93dbb5b9941f7b7a14dd2283559d47fdN.exe
1800	Unicorn-13667.exe
2612	Unicorn-19990.exe
2916	Unicorn-3738.exe
2612	Unicorn-19990.exe
2668	Unicorn-27515.exe
2668	Unicorn-27515.exe
2232	Unicorn-22366.exe
2232	Unicorn-22366.exe
2860	Unicorn-52278.exe
2860	Unicorn-52278.exe
1312	Unicorn-37117.exe
1312	Unicorn-37117.exe
560	Unicorn-25979.exe
560	Unicorn-25979.exe
3060	Unicorn-6335.exe
2828	Unicorn-124.exe
2828	Unicorn-124.exe
3060	Unicorn-6335.exe
2376	a94e942831d48bb0d5901989be58ad4d93dbb5b9941f7b7a14dd2283559d47fdN.exe
2376	a94e942831d48bb0d5901989be58ad4d93dbb5b9941f7b7a14dd2283559d47fdN.exe
3016	Unicorn-63826.exe
3016	Unicorn-63826.exe
2928	Unicorn-37650.exe
1640	Unicorn-37650.exe
2928	Unicorn-37650.exe
1640	Unicorn-37650.exe
2612	Unicorn-19990.exe
2812	Unicorn-17784.exe
2612	Unicorn-19990.exe
2812	Unicorn-17784.exe
2916	Unicorn-3738.exe
2916	Unicorn-3738.exe
292	Unicorn-49819.exe
292	Unicorn-49819.exe
2860	Unicorn-52278.exe
1636	Unicorn-17661.exe
1636	Unicorn-17661.exe
2860	Unicorn-52278.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36885.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63347.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5376.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49451.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59270.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17797.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44427.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62054.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62483.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50955.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19126.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3227.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57178.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46523.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54315.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64505.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17784.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29744.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2297.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32478.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54575.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2576.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47711.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30689.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3106.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52599.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3828.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54333.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31993.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2576.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38110.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24169.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4997.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46952.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13598.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38110.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56698.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17661.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54820.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2240.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29102.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41869.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47112.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11241.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41777.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3106.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47163.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13839.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47112.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22532.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29832.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53129.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31640.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17085.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59309.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2376	a94e942831d48bb0d5901989be58ad4d93dbb5b9941f7b7a14dd2283559d47fdN.exe
3016	Unicorn-63826.exe
1312	Unicorn-37117.exe
2916	Unicorn-3738.exe
2860	Unicorn-52278.exe
2828	Unicorn-124.exe
2612	Unicorn-19990.exe
1800	Unicorn-13667.exe
2668	Unicorn-27515.exe
2232	Unicorn-22366.exe
560	Unicorn-25979.exe
3060	Unicorn-6335.exe
1124	Unicorn-37385.exe
2928	Unicorn-37650.exe
2812	Unicorn-17784.exe
1640	Unicorn-37650.exe
292	Unicorn-49819.exe
1636	Unicorn-17661.exe
1084	Unicorn-17085.exe
2136	Unicorn-53570.exe
2504	Unicorn-47287.exe
1340	Unicorn-34350.exe
540	Unicorn-60862.exe
1784	Unicorn-45294.exe
2588	Unicorn-36628.exe
2000	Unicorn-47697.exe
2004	Unicorn-47697.exe
2480	Unicorn-28599.exe
2448	Unicorn-48465.exe
1932	Unicorn-33214.exe
2076	Unicorn-1758.exe
1164	Unicorn-28326.exe
564	Unicorn-47456.exe
1736	Unicorn-34457.exe
2064	Unicorn-52246.exe
1860	Unicorn-15167.exe
3020	Unicorn-5816.exe
2348	Unicorn-58151.exe
2892	Unicorn-49952.exe
2264	Unicorn-39641.exe
2876	Unicorn-51898.exe
2632	Unicorn-37337.exe
2888	Unicorn-31974.exe
2604	Unicorn-44218.exe
2624	Unicorn-16912.exe
2472	Unicorn-45784.exe
2636	Unicorn-29875.exe
2168	Unicorn-16938.exe
2104	Unicorn-29744.exe
2704	Unicorn-32589.exe
1752	Unicorn-14425.exe
1724	Unicorn-11539.exe
1520	Unicorn-37005.exe
1928	Unicorn-22048.exe
2692	Unicorn-37773.exe
2996	Unicorn-34954.exe
1036	Unicorn-54820.exe
1156	Unicorn-22532.exe
712	Unicorn-49458.exe
1088	Unicorn-50955.exe
636	Unicorn-43352.exe
1720	Unicorn-39329.exe
2308	Unicorn-64379.exe
1984	Unicorn-42209.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 3016	2376	a94e942831d48bb0d5901989be58ad4d93dbb5b9941f7b7a14dd2283559d47fdN.exe	30
PID 2376 wrote to memory of 3016	2376	a94e942831d48bb0d5901989be58ad4d93dbb5b9941f7b7a14dd2283559d47fdN.exe	30
PID 2376 wrote to memory of 3016	2376	a94e942831d48bb0d5901989be58ad4d93dbb5b9941f7b7a14dd2283559d47fdN.exe	30
PID 2376 wrote to memory of 3016	2376	a94e942831d48bb0d5901989be58ad4d93dbb5b9941f7b7a14dd2283559d47fdN.exe	30
PID 3016 wrote to memory of 1312	3016	Unicorn-63826.exe	31
PID 3016 wrote to memory of 1312	3016	Unicorn-63826.exe	31
PID 3016 wrote to memory of 1312	3016	Unicorn-63826.exe	31
PID 3016 wrote to memory of 1312	3016	Unicorn-63826.exe	31
PID 2376 wrote to memory of 2916	2376	a94e942831d48bb0d5901989be58ad4d93dbb5b9941f7b7a14dd2283559d47fdN.exe	32
PID 2376 wrote to memory of 2916	2376	a94e942831d48bb0d5901989be58ad4d93dbb5b9941f7b7a14dd2283559d47fdN.exe	32
PID 2376 wrote to memory of 2916	2376	a94e942831d48bb0d5901989be58ad4d93dbb5b9941f7b7a14dd2283559d47fdN.exe	32
PID 2376 wrote to memory of 2916	2376	a94e942831d48bb0d5901989be58ad4d93dbb5b9941f7b7a14dd2283559d47fdN.exe	32
PID 1312 wrote to memory of 2860	1312	Unicorn-37117.exe	33
PID 1312 wrote to memory of 2860	1312	Unicorn-37117.exe	33
PID 1312 wrote to memory of 2860	1312	Unicorn-37117.exe	33
PID 1312 wrote to memory of 2860	1312	Unicorn-37117.exe	33
PID 2916 wrote to memory of 2612	2916	Unicorn-3738.exe	34
PID 2916 wrote to memory of 2612	2916	Unicorn-3738.exe	34
PID 2916 wrote to memory of 2612	2916	Unicorn-3738.exe	34
PID 2916 wrote to memory of 2612	2916	Unicorn-3738.exe	34
PID 3016 wrote to memory of 2828	3016	Unicorn-63826.exe	35
PID 3016 wrote to memory of 2828	3016	Unicorn-63826.exe	35
PID 3016 wrote to memory of 2828	3016	Unicorn-63826.exe	35
PID 3016 wrote to memory of 2828	3016	Unicorn-63826.exe	35
PID 2376 wrote to memory of 1800	2376	a94e942831d48bb0d5901989be58ad4d93dbb5b9941f7b7a14dd2283559d47fdN.exe	36
PID 2376 wrote to memory of 1800	2376	a94e942831d48bb0d5901989be58ad4d93dbb5b9941f7b7a14dd2283559d47fdN.exe	36
PID 2376 wrote to memory of 1800	2376	a94e942831d48bb0d5901989be58ad4d93dbb5b9941f7b7a14dd2283559d47fdN.exe	36
PID 2376 wrote to memory of 1800	2376	a94e942831d48bb0d5901989be58ad4d93dbb5b9941f7b7a14dd2283559d47fdN.exe	36
PID 2860 wrote to memory of 2668	2860	Unicorn-52278.exe	37
PID 2860 wrote to memory of 2668	2860	Unicorn-52278.exe	37
PID 2860 wrote to memory of 2668	2860	Unicorn-52278.exe	37
PID 2860 wrote to memory of 2668	2860	Unicorn-52278.exe	37
PID 1312 wrote to memory of 2232	1312	Unicorn-37117.exe	38
PID 1312 wrote to memory of 2232	1312	Unicorn-37117.exe	38
PID 1312 wrote to memory of 2232	1312	Unicorn-37117.exe	38
PID 1312 wrote to memory of 2232	1312	Unicorn-37117.exe	38
PID 2828 wrote to memory of 560	2828	Unicorn-124.exe	39
PID 2828 wrote to memory of 560	2828	Unicorn-124.exe	39
PID 2828 wrote to memory of 560	2828	Unicorn-124.exe	39
PID 2828 wrote to memory of 560	2828	Unicorn-124.exe	39
PID 3016 wrote to memory of 3060	3016	Unicorn-63826.exe	40
PID 3016 wrote to memory of 3060	3016	Unicorn-63826.exe	40
PID 3016 wrote to memory of 3060	3016	Unicorn-63826.exe	40
PID 3016 wrote to memory of 3060	3016	Unicorn-63826.exe	40
PID 2376 wrote to memory of 1124	2376	a94e942831d48bb0d5901989be58ad4d93dbb5b9941f7b7a14dd2283559d47fdN.exe	41
PID 2376 wrote to memory of 1124	2376	a94e942831d48bb0d5901989be58ad4d93dbb5b9941f7b7a14dd2283559d47fdN.exe	41
PID 2376 wrote to memory of 1124	2376	a94e942831d48bb0d5901989be58ad4d93dbb5b9941f7b7a14dd2283559d47fdN.exe	41
PID 2376 wrote to memory of 1124	2376	a94e942831d48bb0d5901989be58ad4d93dbb5b9941f7b7a14dd2283559d47fdN.exe	41
PID 1800 wrote to memory of 2928	1800	Unicorn-13667.exe	43
PID 1800 wrote to memory of 2928	1800	Unicorn-13667.exe	43
PID 1800 wrote to memory of 2928	1800	Unicorn-13667.exe	43
PID 1800 wrote to memory of 2928	1800	Unicorn-13667.exe	43
PID 2916 wrote to memory of 2812	2916	Unicorn-3738.exe	42
PID 2916 wrote to memory of 2812	2916	Unicorn-3738.exe	42
PID 2916 wrote to memory of 2812	2916	Unicorn-3738.exe	42
PID 2916 wrote to memory of 2812	2916	Unicorn-3738.exe	42
PID 2612 wrote to memory of 1640	2612	Unicorn-19990.exe	44
PID 2612 wrote to memory of 1640	2612	Unicorn-19990.exe	44
PID 2612 wrote to memory of 1640	2612	Unicorn-19990.exe	44
PID 2612 wrote to memory of 1640	2612	Unicorn-19990.exe	44
PID 2668 wrote to memory of 1084	2668	Unicorn-27515.exe	46
PID 2668 wrote to memory of 1084	2668	Unicorn-27515.exe	46
PID 2668 wrote to memory of 1084	2668	Unicorn-27515.exe	46
PID 2668 wrote to memory of 1084	2668	Unicorn-27515.exe	46

C:\Users\Admin\AppData\Local\Temp\a94e942831d48bb0d5901989be58ad4d93dbb5b9941f7b7a14dd2283559d47fdN.exe
"C:\Users\Admin\AppData\Local\Temp\a94e942831d48bb0d5901989be58ad4d93dbb5b9941f7b7a14dd2283559d47fdN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63826.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63826.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37117.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37117.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52278.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27515.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17085.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52246.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64379.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35113.exe
        9⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32901.exe
        9⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
        9⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63939.exe
        9⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45994.exe
        9⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63789.exe
        8⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46637.exe
        8⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
        8⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23227.exe
        8⤵
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64505.exe
        8⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42209.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27494.exe
        8⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36004.exe
        8⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
        8⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23227.exe
        8⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46523.exe
        8⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25544.exe
        7⤵
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20737.exe
        7⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2576.exe
        7⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6692.exe
        7⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16033.exe
        7⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15167.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10015.exe
        7⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63347.exe
        8⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57453.exe
        8⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38110.exe
        8⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46523.exe
        8⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5009.exe
        7⤵
        
        PID:956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31458.exe
        7⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58192.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56454.exe
        7⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63060.exe
        7⤵
        
        PID:6504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49451.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13598.exe
        7⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11932.exe
        7⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44427.exe
        7⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52599.exe
        7⤵
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17410.exe
        6⤵
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47711.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38641.exe
        6⤵
        
        PID:6072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42058.exe
        6⤵
        
        PID:6988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49819.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1758.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43352.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47360.exe
        8⤵
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38303.exe
        8⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
        8⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62498.exe
        8⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21785.exe
        8⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37027.exe
        7⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26115.exe
        7⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
        7⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23227.exe
        7⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6597.exe
        7⤵
        
        PID:6576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39329.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4429.exe
        7⤵
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43182.exe
        8⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33529.exe
        8⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20651.exe
        8⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5611.exe
        8⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63347.exe
        7⤵
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16229.exe
        7⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44427.exe
        7⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46715.exe
        7⤵
        
        PID:6704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56182.exe
        6⤵
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63347.exe
        7⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7375.exe
        7⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38110.exe
        7⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46523.exe
        7⤵
        
        PID:6924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25378.exe
        6⤵
        
        PID:1652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42527.exe
        6⤵
        
        PID:4092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51578.exe
        6⤵
        
        PID:4796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23757.exe
        6⤵
        
        PID:5996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60039.exe
        6⤵
        
        PID:7148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28326.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3453.exe
        6⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24875.exe
        7⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17797.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35761.exe
        7⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36063.exe
        7⤵
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7468.exe
        6⤵
        
        PID:2228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9132.exe
        6⤵
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exe
        6⤵
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53129.exe
        6⤵
        
        PID:6376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56460.exe
        5⤵
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54315.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61911.exe
        7⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17797.exe
        7⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35761.exe
        7⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36063.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11545.exe
        6⤵
        
        PID:3596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63215.exe
        6⤵
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35761.exe
        6⤵
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36063.exe
        6⤵
        
        PID:6412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53382.exe
        5⤵
        
        PID:2652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20723.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49646.exe
        6⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-514.exe
        6⤵
        
        PID:6720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13839.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46440.exe
        5⤵
        
        PID:4660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14761.exe
        5⤵
        
        PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26263.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22366.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17661.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34457.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59823.exe
        7⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47736.exe
        8⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1137.exe
        8⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
        8⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        8⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63059.exe
        8⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48732.exe
        7⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30689.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2576.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64469.exe
        7⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41529.exe
        7⤵
        
        PID:6532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19340.exe
        6⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36885.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1137.exe
        7⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
        7⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        7⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63059.exe
        7⤵
        
        PID:7020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20737.exe
        6⤵
        
        PID:3916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2576.exe
        6⤵
        
        PID:4172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21575.exe
        6⤵
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48130.exe
        6⤵
        
        PID:6740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47456.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31541.exe
        6⤵
        Executes dropped EXE
        
        PID:988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56457.exe
        7⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-229.exe
        7⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
        7⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62498.exe
        7⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21785.exe
        7⤵
        
        PID:6524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3395.exe
        6⤵
        
        PID:2944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1987.exe
        6⤵
        
        PID:3260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
        6⤵
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38110.exe
        6⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46523.exe
        6⤵
        
        PID:6972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2297.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51409.exe
        6⤵
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2240.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1137.exe
        7⤵
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
        7⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        7⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63059.exe
        7⤵
        
        PID:7044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52328.exe
        6⤵
        
        PID:1880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14872.exe
        6⤵
        
        PID:3964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
        6⤵
        
        PID:5072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23227.exe
        6⤵
        
        PID:1048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64505.exe
        6⤵
        
        PID:6236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36453.exe
        5⤵
        
        PID:2788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63347.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7375.exe
        6⤵
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38110.exe
        6⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46523.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22265.exe
        5⤵
        
        PID:3172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6257.exe
        5⤵
        
        PID:4204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58722.exe
        5⤵
        
        PID:5324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51988.exe
        5⤵
        
        PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36194.exe
        5⤵
        
        PID:6500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53570.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5816.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55581.exe
        6⤵
        
        PID:764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63347.exe
        7⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33826.exe
        7⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44427.exe
        7⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52599.exe
        7⤵
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59270.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17797.exe
        6⤵
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35761.exe
        6⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36063.exe
        6⤵
        
        PID:6328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35715.exe
        5⤵
        
        PID:264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2715.exe
        6⤵
        
        PID:3272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57178.exe
        6⤵
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26027.exe
        6⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24169.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11545.exe
        5⤵
        
        PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22094.exe
        5⤵
        
        PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35761.exe
        5⤵
        
        PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36063.exe
        5⤵
        
        PID:6292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58151.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        5⤵
        
        PID:2868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29947.exe
        6⤵
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1137.exe
        6⤵
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62155.exe
        6⤵
        
        PID:4712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17104.exe
        6⤵
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60878.exe
        6⤵
        
        PID:6844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32478.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14872.exe
        5⤵
        
        PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
        5⤵
        
        PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38110.exe
        5⤵
        
        PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46523.exe
        5⤵
        
        PID:6908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33949.exe
      4⤵
      PID:1872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31709.exe
        5⤵
        
        PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22268.exe
        5⤵
        
        PID:3812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
        5⤵
        
        PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        5⤵
        
        PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63059.exe
        5⤵
        
        PID:7068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46118.exe
      4⤵
      PID:2108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65254.exe
      4⤵
      PID:3256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47112.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11775.exe
      4⤵
      PID:6060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40923.exe
      4⤵
      PID:6872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-124.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-124.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25979.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47287.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39641.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29832.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12205.exe
        8⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47257.exe
        8⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10252.exe
        8⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5658.exe
        8⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52304.exe
        7⤵
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57350.exe
        7⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44427.exe
        7⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52599.exe
        7⤵
        
        PID:6460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64652.exe
        6⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11545.exe
        7⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64247.exe
        7⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21575.exe
        7⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63589.exe
        7⤵
        
        PID:6828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41230.exe
        6⤵
        
        PID:1028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41869.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2576.exe
        6⤵
        
        PID:4336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6692.exe
        6⤵
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16033.exe
        6⤵
        
        PID:5520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51898.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24202.exe
        6⤵
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1137.exe
        6⤵
        
        PID:4044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
        6⤵
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62498.exe
        6⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21785.exe
        6⤵
        
        PID:6800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3380.exe
        5⤵
        
        PID:2608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20737.exe
        5⤵
        
        PID:3908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2576.exe
        5⤵
        
        PID:4748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21575.exe
        5⤵
        
        PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63589.exe
        5⤵
        
        PID:6860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60862.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16912.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55581.exe
        6⤵
        
        PID:876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50592.exe
        7⤵
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18913.exe
        7⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25671.exe
        7⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61264.exe
        7⤵
        
        PID:6420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63347.exe
        6⤵
        
        PID:3652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16805.exe
        6⤵
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17851.exe
        6⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45947.exe
        6⤵
        
        PID:6608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35715.exe
        5⤵
        
        PID:2124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41659.exe
        6⤵
        
        PID:916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1137.exe
        6⤵
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
        6⤵
        
        PID:4904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31893.exe
        6⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63059.exe
        6⤵
        
        PID:7076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58409.exe
        5⤵
        
        PID:1792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20737.exe
        5⤵
        
        PID:3876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2576.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6692.exe
        5⤵
        
        PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16033.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45784.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4229.exe
        5⤵
        
        PID:2740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24875.exe
        6⤵
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25592.exe
        6⤵
        
        PID:4248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1320.exe
        6⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7452.exe
        6⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45994.exe
        6⤵
        
        PID:7144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59270.exe
        5⤵
        
        PID:960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17797.exe
        5⤵
        
        PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35761.exe
        5⤵
        
        PID:5604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36063.exe
        5⤵
        
        PID:6344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43575.exe
      4⤵
      PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6649.exe
        5⤵
        
        PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30169.exe
        5⤵
        
        PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
        5⤵
        
        PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        5⤵
        
        PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63059.exe
        5⤵
        
        PID:7052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31159.exe
      4⤵
      PID:2616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25529.exe
      4⤵
      PID:3844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3106.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2227.exe
      4⤵
      PID:5428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36723.exe
      4⤵
      PID:6884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6335.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6335.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:3060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34350.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37337.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4997.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13598.exe
        7⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11857.exe
        7⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38983.exe
        7⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13496.exe
        7⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62028.exe
        7⤵
        
        PID:6696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11545.exe
        6⤵
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54575.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35761.exe
        6⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36063.exe
        6⤵
        
        PID:6388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23014.exe
        5⤵
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65143.exe
        6⤵
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49474.exe
        6⤵
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20651.exe
        6⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55497.exe
        6⤵
        
        PID:6660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62154.exe
        5⤵
        
        PID:3232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9132.exe
        5⤵
        
        PID:4448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exe
        5⤵
        
        PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53129.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44218.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        5⤵
        
        PID:2628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13598.exe
        6⤵
        
        PID:3136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11857.exe
        6⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11932.exe
        6⤵
        
        PID:4524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44427.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52599.exe
        6⤵
        
        PID:6428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11545.exe
        5⤵
        
        PID:3756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64247.exe
        5⤵
        
        PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21575.exe
        5⤵
        
        PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63589.exe
        5⤵
        
        PID:6820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19126.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13598.exe
        5⤵
        
        PID:3128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11932.exe
        5⤵
        
        PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44427.exe
        5⤵
        
        PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31640.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31699.exe
      4⤵
      PID:3204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22792.exe
      4⤵
      PID:4256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41656.exe
      4⤵
      PID:5300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7982.exe
      4⤵
      PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41529.exe
      4⤵
      PID:1484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45294.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45294.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22532.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35950.exe
        5⤵
        
        PID:1728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41174.exe
        6⤵
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57178.exe
        6⤵
        
        PID:4340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26027.exe
        6⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24169.exe
        6⤵
        
        PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63347.exe
        5⤵
        
        PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48710.exe
        5⤵
        
        PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44427.exe
        5⤵
        
        PID:5704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52599.exe
        5⤵
        
        PID:6452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31543.exe
      4⤵
      PID:1336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30411.exe
        5⤵
        
        PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31993.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41103.exe
        5⤵
        
        PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55497.exe
        5⤵
        
        PID:6652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11545.exe
      4⤵
      PID:3720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63215.exe
      4⤵
      PID:4580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35761.exe
      4⤵
      PID:5580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36063.exe
      4⤵
      PID:6284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50955.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50955.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13516.exe
      4⤵
      PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24546.exe
        5⤵
        
        PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51595.exe
        5⤵
        
        PID:6588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24823.exe
      4⤵
      PID:4080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
      4⤵
      PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38110.exe
      4⤵
      PID:6080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46523.exe
      4⤵
      PID:6964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43411.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43411.exe
    3⤵
    PID:2520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12602.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12602.exe
    3⤵
    PID:3924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47112.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47112.exe
    3⤵
    PID:4816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62429.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62429.exe
    3⤵
    PID:5992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58905.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58905.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6200
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3738.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3738.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19990.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19990.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37650.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47697.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16938.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45900.exe
        7⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58761.exe
        8⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50691.exe
        8⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
        8⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        8⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63059.exe
        8⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17410.exe
        7⤵
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45910.exe
        7⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exe
        7⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53129.exe
        7⤵
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59309.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13598.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11932.exe
        7⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44427.exe
        7⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52599.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17410.exe
        6⤵
        
        PID:3692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13429.exe
        6⤵
        
        PID:4828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exe
        6⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53129.exe
        6⤵
        
        PID:6368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14425.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41477.exe
        6⤵
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31723.exe
        7⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47257.exe
        7⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10252.exe
        7⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5658.exe
        7⤵
        
        PID:6476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10301.exe
        6⤵
        
        PID:3940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47265.exe
        6⤵
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26517.exe
        6⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46832.exe
        6⤵
        
        PID:6628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64475.exe
        5⤵
        
        PID:2140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20737.exe
        5⤵
        
        PID:3852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2576.exe
        5⤵
        
        PID:4220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6692.exe
        5⤵
        
        PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16033.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28599.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54820.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3828.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24823.exe
        6⤵
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
        6⤵
        
        PID:4156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23227.exe
        6⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64505.exe
        6⤵
        
        PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10229.exe
        5⤵
        
        PID:836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14872.exe
        5⤵
        
        PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
        5⤵
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38110.exe
        5⤵
        
        PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46523.exe
        5⤵
        
        PID:6892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49458.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55581.exe
        5⤵
        
        PID:1808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7297.exe
        6⤵
        
        PID:3168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56290.exe
        6⤵
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25770.exe
        6⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11876.exe
        6⤵
        
        PID:6980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63347.exe
        5⤵
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-962.exe
        5⤵
        
        PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44427.exe
        5⤵
        
        PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52599.exe
        5⤵
        
        PID:6488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23054.exe
      4⤵
      PID:1844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22565.exe
        5⤵
        
        PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57178.exe
        5⤵
        
        PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26027.exe
        5⤵
        
        PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24169.exe
        5⤵
        
        PID:7156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8745.exe
      4⤵
      PID:3668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47163.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36292.exe
      4⤵
      PID:5684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
      4⤵
      PID:6352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17784.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17784.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48465.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37773.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-870.exe
        6⤵
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1137.exe
        6⤵
        
        PID:4036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62043.exe
        6⤵
        
        PID:6032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62483.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46952.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14872.exe
        5⤵
        
        PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
        5⤵
        
        PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23227.exe
        5⤵
        
        PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64505.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34954.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46381.exe
        5⤵
        
        PID:880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1137.exe
        5⤵
        
        PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
        5⤵
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        5⤵
        
        PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63059.exe
        5⤵
        
        PID:7012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62747.exe
      4⤵
      PID:2260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15104.exe
        5⤵
        
        PID:6204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56698.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20737.exe
      4⤵
      PID:3884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2576.exe
      4⤵
      PID:4192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6692.exe
      4⤵
      PID:5820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16033.exe
      4⤵
      PID:6312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33214.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33214.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37005.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32443.exe
        5⤵
        
        PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24823.exe
        5⤵
        
        PID:1536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23227.exe
        5⤵
        
        PID:5868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64505.exe
        5⤵
        
        PID:7116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49500.exe
      4⤵
      PID:2160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30689.exe
      4⤵
      PID:4056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2576.exe
      4⤵
      PID:4328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21575.exe
      4⤵
      PID:5372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48130.exe
      4⤵
      PID:6748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22048.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22048.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36397.exe
      4⤵
      PID:2144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1137.exe
      4⤵
      PID:4004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
      4⤵
      PID:4928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
      4⤵
      PID:6100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63059.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30180.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30180.exe
    3⤵
    PID:2844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31556.exe
      4⤵
      PID:3336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57178.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29748.exe
      4⤵
      PID:5504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6187.exe
      4⤵
      PID:6852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22553.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22553.exe
    3⤵
    PID:3116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47112.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47112.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60482.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60482.exe
    3⤵
    PID:5964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58905.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58905.exe
    3⤵
    PID:5968
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13667.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13667.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37650.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37650.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47697.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29875.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27343.exe
        6⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24875.exe
        7⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31591.exe
        7⤵
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
        7⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62498.exe
        7⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21785.exe
        7⤵
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59270.exe
        6⤵
        
        PID:1740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11984.exe
        6⤵
        
        PID:4240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1316.exe
        6⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50123.exe
        6⤵
        
        PID:6676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50669.exe
        5⤵
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50380.exe
        6⤵
        
        PID:3064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32901.exe
        6⤵
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
        6⤵
        
        PID:4900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        6⤵
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63059.exe
        6⤵
        
        PID:7092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44660.exe
        5⤵
        
        PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52502.exe
        5⤵
        
        PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2576.exe
        5⤵
        
        PID:4264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6692.exe
        5⤵
        
        PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16033.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55581.exe
        5⤵
        
        PID:644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18118.exe
        6⤵
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56204.exe
        6⤵
        
        PID:3340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
        6⤵
        
        PID:4320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23227.exe
        6⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46523.exe
        6⤵
        
        PID:6916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54381.exe
        5⤵
        
        PID:2296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13964.exe
        5⤵
        
        PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
        5⤵
        
        PID:4164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23227.exe
        5⤵
        
        PID:932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64505.exe
        5⤵
        
        PID:6224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51781.exe
      4⤵
      PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13598.exe
        5⤵
        
        PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11857.exe
        5⤵
        
        PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60992.exe
        5⤵
        
        PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16117.exe
        5⤵
        
        PID:5816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62530.exe
        5⤵
        
        PID:6616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17410.exe
      4⤵
      PID:3676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54550.exe
      4⤵
      PID:4588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exe
      4⤵
      PID:5628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53129.exe
      4⤵
      PID:6264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31974.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31974.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55581.exe
      4⤵
      PID:2060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24875.exe
        5⤵
        
        PID:2356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17797.exe
        5⤵
        
        PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35761.exe
        5⤵
        
        PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36063.exe
        5⤵
        
        PID:6404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5009.exe
      4⤵
      PID:2164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45327.exe
      4⤵
      PID:3248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
      4⤵
      PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23227.exe
      4⤵
      PID:5848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64505.exe
      4⤵
      PID:7124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14605.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14605.exe
    3⤵
    PID:1688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17892.exe
      4⤵
      PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1137.exe
      4⤵
      PID:3984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
      4⤵
      PID:4936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
      4⤵
      PID:6116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63059.exe
      4⤵
      PID:7084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43170.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43170.exe
    3⤵
    PID:1092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61074.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61074.exe
    3⤵
    PID:3936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3106.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3106.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2227.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2227.exe
    3⤵
    PID:5444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54704.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54704.exe
    3⤵
    PID:7132
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37385.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37385.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49952.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49952.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21041.exe
      4⤵
      PID:2528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41838.exe
        5⤵
        
        PID:3104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-857.exe
        5⤵
        
        PID:4176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20651.exe
        5⤵
        
        PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55497.exe
        5⤵
        
        PID:6620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63347.exe
      4⤵
      PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7375.exe
      4⤵
      PID:4456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38110.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46523.exe
      4⤵
      PID:6956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29819.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29819.exe
    3⤵
    PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2632.exe
      4⤵
      PID:3044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56204.exe
      4⤵
      PID:4084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
      4⤵
      PID:4232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38110.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46523.exe
      4⤵
      PID:6932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58496.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58496.exe
    3⤵
    PID:1032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61626.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61626.exe
    3⤵
    PID:3580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51578.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51578.exe
    3⤵
    PID:4804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38641.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38641.exe
    3⤵
    PID:6140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42058.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42058.exe
    3⤵
    PID:6996
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36628.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36628.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32589.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32589.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33890.exe
      4⤵
      PID:1744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61911.exe
        5⤵
        
        PID:1444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50455.exe
        5⤵
        
        PID:3784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
        5⤵
        
        PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62498.exe
        5⤵
        
        PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21785.exe
        5⤵
        
        PID:6044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5009.exe
      4⤵
      PID:324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45327.exe
      4⤵
      PID:4068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
      4⤵
      PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38110.exe
      4⤵
      PID:5248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31064.exe
      4⤵
      PID:6756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12322.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12322.exe
    3⤵
    PID:2508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10199.exe
      4⤵
      PID:6596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3227.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3227.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53130.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53130.exe
    3⤵
    PID:5092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12952.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12952.exe
    3⤵
    PID:5852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59176.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59176.exe
    3⤵
    PID:6804
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11539.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11539.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14616.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14616.exe
    3⤵
    PID:680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14125.exe
      4⤵
      PID:5888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51595.exe
      4⤵
      PID:2956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29102.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29102.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
    3⤵
    PID:4912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63171.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63171.exe
    3⤵
    PID:6068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45994.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45994.exe
    3⤵
    PID:6780
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14457.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14457.exe
  2⤵
  PID:2392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2545.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2545.exe
    3⤵
    PID:5432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62054.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62054.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65330.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65330.exe
    3⤵
    PID:2408
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56608.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56608.exe
  2⤵
  PID:3856
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41777.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41777.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4700
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15975.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15975.exe
  2⤵
  PID:5288
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13187.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13187.exe
  2⤵
  PID:6812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-124.exe

Filesize
468KB

MD5
da001b949ae2a292b859c58d39451ed3

SHA1
4a634d18d3ad5c58fd147c7ea3ba7827e04e53ab

SHA256
f05cef950aa7298d12b882d99369bdb9c92c8bbebe7da2e9cfc75019671acf3e

SHA512
9ea6a04dfb1017ee5da3075eb5ba0d30dd9cd96d52ab1f96d0f751ce2597728199447a8b01ad0ed8532e2a06ac3a4b326137223faa0d6da8a3f9999bc31bc381

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13667.exe

Filesize
468KB

MD5
ef50187e6701dbfd5edddedfd9fdc158

SHA1
44d3591f80bf746178c08a09e9062d11c7aebb98

SHA256
72b0cd4a5e9c7ee531c87bafe5595bd1bd72b8a32030f41011e1b3e7df911d0d

SHA512
3d9ddae2c43ddc3cdc4766e8e1c29700561633854578f71b15101969e80aa661408ef2cc019c5f76e56396100cd26495cdd3474b716cda501659396f93682c0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17661.exe

Filesize
468KB

MD5
0426963089fac9282a2dd1cbd99ad957

SHA1
d81f33b50e9fe4a532fc0651d2fe1e512fbae631

SHA256
5ebef597e697b2f778af034f8403b1f49f6a25a80849f772e9bc8667a2b9f2ac

SHA512
d0ec2385f117681682b1f686873a59dcff26e0e865cfe0f4a4b1e1aeda5c0c9614628ab1f18ecc6efb97ba8d128358cbfa6e92125304481e2780234c7fee0307

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27515.exe

Filesize
468KB

MD5
63aa58e280ed6969e1065c7516a5a59c

SHA1
0458990cbcf36b9fce7107a5c355adb622fea13e

SHA256
df54643b4395010182389540552fd132fc0533ef889836b2c7f0b51b21b9a456

SHA512
07b1fbced381a4d5398f3b7ed8fda170024ecd70f3b588ac88608840cb2aca7efd73add424ecdd4144d8f7fe418d2e3395cdd857de5aff7cabda49b83caaa346

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5816.exe

Filesize
468KB

MD5
36cac641b8d44bae12cd2151f924eb14

SHA1
c578051c875393c03e43a462c0ec3d37b7b1a920

SHA256
6dd7618784ebd6bc4fd219496a4e68e1e94aa2f5c13f222624e924d35fbf5256

SHA512
fe09ab03558313d65c2e3d83e72ea96132562de4dd69822c13f04610a0ccd4d6c3ed1ee5cab9036f1efd32f0f69875b96cae6dea13cb31d4f528d8005a9db804

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6335.exe

Filesize
468KB

MD5
08ba0e17065809fc53ee5b1d1cf0666d

SHA1
cb87ab27f8cbad119bcc72d45d1d6657ac117d7f

SHA256
fb450210b5291e383d313ba745987ed84c99118b65538694a27335925bba268e

SHA512
37d6d8e498f58f0f1bcbc5880b220687d6eea1fb5357ab6a729f5cc994d50659307978e7e7cff7b5b8838e7cec26e736994573014e0f347db338e958ee636f92

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17085.exe

Filesize
468KB

MD5
a8cb805bcf9f8f9f626de70993ee7b9c

SHA1
f9872cb3fbb3bc801e8987280bf12b4ab2f367b9

SHA256
ed4d43b9eedba372618592537e78490a02e5f10456914ad478e76f70b6e49c13

SHA512
89b7352e81ffa2510ce56fc65a25c2f0482f6d8150e6de7cad9d7a7086e48fa3e77040f2501cd5462ddb90efa0552f89ef2ef8932cf368b236ab90a86ec5e9e1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17784.exe

Filesize
468KB

MD5
4cf1ec47aa6acd3055fe0df25f783199

SHA1
f40efb7d95562f6d89176b7c9b786815258526fd

SHA256
929b31bbeea3b5b24b81070f7b463132026ae07dee754a1901458a8f319dc835

SHA512
502d229d25be5e1444e30eaee07cfea1e3c623b3aa85c9eb4f586005fe31751c41da42fe73e51cb0c32d8e56f845167ba95ef617b3900b0856a5cf777b20cbeb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19990.exe

Filesize
468KB

MD5
6529fd353b2f2f19b6d82cf28c7cafd8

SHA1
05656fce70e8c415fa9276bd132d8a625332b69c

SHA256
a2f85828c68f5db82c21ca822a8abc231ae34860b6359df8ab255e86adddc5c5

SHA512
aafb8d34e86ea694fc264abb4bdeadae2f162917b9f1c5e8b1873f494afcd3b971d19df96af248455c2943b268a9a81e78f3ef0684f07361284a1ee28b3806c0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22366.exe

Filesize
468KB

MD5
1e565a8dfaec396f4c77f322e65cd4a7

SHA1
8674fa6ccf1e6e3266023fde67b357b3e36493b5

SHA256
78ea9158afb43d69555cf096c3b1febd5b4383e66e9c4bdd4799be869e5b618d

SHA512
f9e9e5848dff4ad23de20390437c9f5f1f6201df7f0696bdda8cca19a7330e5ad4e3822e72bbbf687df38c7c19a2014dce8acfae347099ec719ed200b8aeafb4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25979.exe

Filesize
468KB

MD5
dceca801c53581df52225ffbc67bc5fc

SHA1
df599f70964d8e405a13229d665b7d80ad5c0f56

SHA256
b6893ddedf18f644f57c1af4f1845b137e47d47ed69427456ff09605c77e5b15

SHA512
5615714ce1821cb2c22dcf89da968b920b60e0b3ec4b69f0903aed1e1495e6b67220dc17e46d15928e5ddd3b98ef197496b8c35c0a6bdfdf6bd3901088baa101

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37117.exe

Filesize
468KB

MD5
da907ba20fc003c7eb12320f1e5e1021

SHA1
d6d945625c9a2ff797479695f4ae42ed323fb4d9

SHA256
ea0121d42b41bc5181d63858ce57bdc96e2c6b842ccc2a4ccce2b9cb48d9f9e3

SHA512
a7b5d0d74f406effbd2f389b89804977a0c7ed87b7f912c51c9dd5fefe8143d390458f152a6e01b1953431a1d3826b6292de17a2821c7dc3aa27bd02fa33c7d8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3738.exe

Filesize
468KB

MD5
1a3b985454033d699221e45702142ed1

SHA1
5d2dc33208f11b8ee59779d5f7cf87851c249f41

SHA256
b163840f1fad86cd4d31743a2d4bc376c3493b1181ce571813d44dddd875e335

SHA512
1e59d48a01a3f81df6e851e81c849aa85ac40e24552995cab14a2795ea61d1778fa8a8c191179ea3603d18f73adbef9592fce40b9c60c81641d45b11363d7a20

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37385.exe

Filesize
468KB

MD5
9f539926e7a4fca55105042761f7c5aa

SHA1
c5f58dd675fddb96e2ac0051d41038d052ab4ac9

SHA256
e7ca95c9ddba45614da871509afc19507854f8f09b23451ad2df536a857ff7be

SHA512
b9d6269e87d49cb35705d8a5803033f2dbe7966896f507960d7638d70e6ad040e5669982204cffc3d9f59fe5fa2ffba00111b36c735b6428784c079ff747eb28

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37650.exe

Filesize
468KB

MD5
25a1ba4e63b62ba789b77824d955eadd

SHA1
0b0b043e87ebdb0d8acd96954bdfc897d7cb990f

SHA256
05e031af21a27e02d540ecce402c72150bb1edbd36b2d8f2b91ea8e3ac50a475

SHA512
cc6eed0acebf37b0ae0e76f82994173c76cb4abd766a4e198de7e03026410e82ef54995b0fdc483f26cb5276ee4c152d498b5685af7658c12ec4b37b6ea9bd08

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49819.exe

Filesize
468KB

MD5
92e7967d4a64936e917948720460a668

SHA1
b5a67f2895dfa0b867bc717ba8cd2640c0627c27

SHA256
5ba3debe6aa2095629caeb4e46b544a07ffe2df3b022e00d9536b6dc3ba94662

SHA512
0d461d6fcfe3873abc7c3f6bab12a390a399bd9278a7ef0ba93e24744d42d2ec495e205401de3b2350182f5061d98503dba2048960cd5235a6fb1613b1365fef

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52278.exe

Filesize
468KB

MD5
b403070990db898c8da92a5efdf962f0

SHA1
2c0b5a3cdec716df74cebe0b5d18a708d978739b

SHA256
924c2021b011fc02b15ac1abf20bffeb8719f1d9ebdaed05c301c7afcd1b2e81

SHA512
ccd4475a205c233a37042628a6c35dc6cee1bd1fcc39b8d74762728e9e8427dc2427b807b193991e8a7c978ba68f4db3ed8ddef3f6161c098871d6c343932b9c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63826.exe

Filesize
468KB

MD5
434c0350572d93c003a5547d3e8eb07c

SHA1
ce6cfa396729a740a89128dc6c03980af777f3f2

SHA256
7ef1e77b360c6f6c729dd7e2bef20ff8dac294c8b5861b1d63b2089a13c29b25

SHA512
6d6a4048b09acff6289ddfc9e8525385e9dffa9ffc3f50e64c215b4e80c889739e65b837cd46a2c113d64d4b1299715df8dc4bad32bc1c529b3863f14394f6d3

Download Submit