9396f146915d3a1a36523086c3f1e7bb7bf4eac28b1563cb3560cab56eacf56d

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 18:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9396f146915d3a1a36523086c3f1e7bb7bf4eac28b1563cb3560cab56eacf56dN.exe
Size

468KB
MD5

1c03aab6cd0f394b59b9007d272dcff0
SHA1

7d11a44f0fae04f7310b400645b1c484ecaed425
SHA256

9396f146915d3a1a36523086c3f1e7bb7bf4eac28b1563cb3560cab56eacf56d
SHA512

0a61807606afdbc1be1cdee5ab04e14fd3dd0993ef018b80fb6e5750bf34a6a91f461b50451a5baf0c74a3ba0a9924e3744320b11a9619eac619336ec811ff85
SSDEEP

3072:1bAYogIdId5jtbYGPOtjcc8/52C4P3p5ymHekVqLRrkc4cb6BGElW:1browbjt5POjccnZiLRrtt2BG

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2424	Unicorn-157.exe
1652	Unicorn-45912.exe
2416	Unicorn-30967.exe
2860	Unicorn-22882.exe
2856	Unicorn-34156.exe
2616	Unicorn-26966.exe
2636	Unicorn-62331.exe
2660	Unicorn-1475.exe
3016	Unicorn-21630.exe
1980	Unicorn-56706.exe
2084	Unicorn-15674.exe
2436	Unicorn-61345.exe
1988	Unicorn-54568.exe
1884	Unicorn-17711.exe
2596	Unicorn-39554.exe
2704	Unicorn-63011.exe
448	Unicorn-47230.exe
1456	Unicorn-30147.exe
1260	Unicorn-54657.exe
1632	Unicorn-63587.exe
600	Unicorn-32760.exe
2040	Unicorn-47059.exe
376	Unicorn-16333.exe
984	Unicorn-31277.exe
2916	Unicorn-20417.exe
1564	Unicorn-39445.exe
2056	Unicorn-36753.exe
2924	Unicorn-1677.exe
2264	Unicorn-36753.exe
2396	Unicorn-53644.exe
2716	Unicorn-1842.exe
2884	Unicorn-57941.exe
2816	Unicorn-29252.exe
2792	Unicorn-26878.exe
2864	Unicorn-54075.exe
2612	Unicorn-54075.exe
2672	Unicorn-8403.exe
1984	Unicorn-15502.exe
2044	Unicorn-10349.exe
1712	Unicorn-56021.exe
1824	Unicorn-62673.exe
2272	Unicorn-26686.exe
1048	Unicorn-7946.exe
2908	Unicorn-59358.exe
2196	Unicorn-54459.exe
688	Unicorn-55850.exe
2244	Unicorn-37376.exe
1672	Unicorn-17510.exe
1540	Unicorn-12771.exe
1628	Unicorn-18902.exe
2184	Unicorn-42014.exe
2232	Unicorn-31154.exe
1836	Unicorn-3749.exe
1948	Unicorn-51574.exe
1992	Unicorn-63561.exe
2892	Unicorn-17318.exe
2888	Unicorn-45352.exe
2444	Unicorn-37184.exe
2932	Unicorn-60410.exe
2500	Unicorn-13255.exe
2840	Unicorn-7125.exe
3048	Unicorn-5642.exe
284	Unicorn-19862.exe
1548	Unicorn-28584.exe

Loads dropped DLL 64 IoCs

pid	Process
2940	9396f146915d3a1a36523086c3f1e7bb7bf4eac28b1563cb3560cab56eacf56dN.exe
2940	9396f146915d3a1a36523086c3f1e7bb7bf4eac28b1563cb3560cab56eacf56dN.exe
2424	Unicorn-157.exe
2940	9396f146915d3a1a36523086c3f1e7bb7bf4eac28b1563cb3560cab56eacf56dN.exe
2424	Unicorn-157.exe
2940	9396f146915d3a1a36523086c3f1e7bb7bf4eac28b1563cb3560cab56eacf56dN.exe
1652	Unicorn-45912.exe
2940	9396f146915d3a1a36523086c3f1e7bb7bf4eac28b1563cb3560cab56eacf56dN.exe
1652	Unicorn-45912.exe
2940	9396f146915d3a1a36523086c3f1e7bb7bf4eac28b1563cb3560cab56eacf56dN.exe
2416	Unicorn-30967.exe
2416	Unicorn-30967.exe
2424	Unicorn-157.exe
2424	Unicorn-157.exe
2856	Unicorn-34156.exe
2856	Unicorn-34156.exe
2940	9396f146915d3a1a36523086c3f1e7bb7bf4eac28b1563cb3560cab56eacf56dN.exe
2940	9396f146915d3a1a36523086c3f1e7bb7bf4eac28b1563cb3560cab56eacf56dN.exe
2860	Unicorn-22882.exe
2860	Unicorn-22882.exe
2636	Unicorn-62331.exe
1652	Unicorn-45912.exe
2636	Unicorn-62331.exe
1652	Unicorn-45912.exe
2424	Unicorn-157.exe
2616	Unicorn-26966.exe
2616	Unicorn-26966.exe
2424	Unicorn-157.exe
2416	Unicorn-30967.exe
2416	Unicorn-30967.exe
2660	Unicorn-1475.exe
2660	Unicorn-1475.exe
2856	Unicorn-34156.exe
2856	Unicorn-34156.exe
3016	Unicorn-21630.exe
3016	Unicorn-21630.exe
2940	9396f146915d3a1a36523086c3f1e7bb7bf4eac28b1563cb3560cab56eacf56dN.exe
2940	9396f146915d3a1a36523086c3f1e7bb7bf4eac28b1563cb3560cab56eacf56dN.exe
2596	Unicorn-39554.exe
2596	Unicorn-39554.exe
2416	Unicorn-30967.exe
2416	Unicorn-30967.exe
1988	Unicorn-54568.exe
1988	Unicorn-54568.exe
2084	Unicorn-15674.exe
2616	Unicorn-26966.exe
2084	Unicorn-15674.exe
2616	Unicorn-26966.exe
1884	Unicorn-17711.exe
1884	Unicorn-17711.exe
2636	Unicorn-62331.exe
2636	Unicorn-62331.exe
2424	Unicorn-157.exe
2436	Unicorn-61345.exe
1980	Unicorn-56706.exe
2436	Unicorn-61345.exe
1980	Unicorn-56706.exe
2424	Unicorn-157.exe
2860	Unicorn-22882.exe
2860	Unicorn-22882.exe
1652	Unicorn-45912.exe
1652	Unicorn-45912.exe
448	Unicorn-47230.exe
448	Unicorn-47230.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1475.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19569.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1449.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3582.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3582.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45912.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1641.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42695.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16575.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11498.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15964.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26966.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22441.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55850.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13722.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16575.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19136.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51760.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31154.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52976.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55504.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19633.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34439.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11688.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4117.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60410.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24884.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35574.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25739.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21419.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4076.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48446.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4117.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8582.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14811.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53769.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43078.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16575.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2601.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8582.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63813.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64978.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24039.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21153.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43078.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7738.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9245.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35932.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32773.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48612.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6876.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11688.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31140.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36753.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41704.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25856.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34439.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14811.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29348.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9245.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2940	9396f146915d3a1a36523086c3f1e7bb7bf4eac28b1563cb3560cab56eacf56dN.exe
2424	Unicorn-157.exe
1652	Unicorn-45912.exe
2416	Unicorn-30967.exe
2856	Unicorn-34156.exe
2860	Unicorn-22882.exe
2636	Unicorn-62331.exe
2616	Unicorn-26966.exe
2660	Unicorn-1475.exe
3016	Unicorn-21630.exe
1980	Unicorn-56706.exe
2084	Unicorn-15674.exe
1884	Unicorn-17711.exe
2436	Unicorn-61345.exe
2596	Unicorn-39554.exe
1988	Unicorn-54568.exe
448	Unicorn-47230.exe
2704	Unicorn-63011.exe
1456	Unicorn-30147.exe
1260	Unicorn-54657.exe
1632	Unicorn-63587.exe
600	Unicorn-32760.exe
2040	Unicorn-47059.exe
376	Unicorn-16333.exe
984	Unicorn-31277.exe
2056	Unicorn-36753.exe
2916	Unicorn-20417.exe
2924	Unicorn-1677.exe
1564	Unicorn-39445.exe
2716	Unicorn-1842.exe
2396	Unicorn-53644.exe
2264	Unicorn-36753.exe
2884	Unicorn-57941.exe
2816	Unicorn-29252.exe
2792	Unicorn-26878.exe
2864	Unicorn-54075.exe
2612	Unicorn-54075.exe
2672	Unicorn-8403.exe
1984	Unicorn-15502.exe
1712	Unicorn-56021.exe
2044	Unicorn-10349.exe
1824	Unicorn-62673.exe
2272	Unicorn-26686.exe
2908	Unicorn-59358.exe
1048	Unicorn-7946.exe
2196	Unicorn-54459.exe
688	Unicorn-55850.exe
2244	Unicorn-37376.exe
1672	Unicorn-17510.exe
1540	Unicorn-12771.exe
1628	Unicorn-18902.exe
1948	Unicorn-51574.exe
2232	Unicorn-31154.exe
2184	Unicorn-42014.exe
1836	Unicorn-3749.exe
1992	Unicorn-63561.exe
2892	Unicorn-17318.exe
2888	Unicorn-45352.exe
2444	Unicorn-37184.exe
2932	Unicorn-60410.exe
2500	Unicorn-13255.exe
2840	Unicorn-7125.exe
3048	Unicorn-5642.exe
284	Unicorn-19862.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 2424	2940	9396f146915d3a1a36523086c3f1e7bb7bf4eac28b1563cb3560cab56eacf56dN.exe	30
PID 2940 wrote to memory of 2424	2940	9396f146915d3a1a36523086c3f1e7bb7bf4eac28b1563cb3560cab56eacf56dN.exe	30
PID 2940 wrote to memory of 2424	2940	9396f146915d3a1a36523086c3f1e7bb7bf4eac28b1563cb3560cab56eacf56dN.exe	30
PID 2940 wrote to memory of 2424	2940	9396f146915d3a1a36523086c3f1e7bb7bf4eac28b1563cb3560cab56eacf56dN.exe	30
PID 2424 wrote to memory of 2416	2424	Unicorn-157.exe	32
PID 2424 wrote to memory of 2416	2424	Unicorn-157.exe	32
PID 2424 wrote to memory of 2416	2424	Unicorn-157.exe	32
PID 2424 wrote to memory of 2416	2424	Unicorn-157.exe	32
PID 2940 wrote to memory of 1652	2940	9396f146915d3a1a36523086c3f1e7bb7bf4eac28b1563cb3560cab56eacf56dN.exe	33
PID 2940 wrote to memory of 1652	2940	9396f146915d3a1a36523086c3f1e7bb7bf4eac28b1563cb3560cab56eacf56dN.exe	33
PID 2940 wrote to memory of 1652	2940	9396f146915d3a1a36523086c3f1e7bb7bf4eac28b1563cb3560cab56eacf56dN.exe	33
PID 2940 wrote to memory of 1652	2940	9396f146915d3a1a36523086c3f1e7bb7bf4eac28b1563cb3560cab56eacf56dN.exe	33
PID 1652 wrote to memory of 2860	1652	Unicorn-45912.exe	34
PID 1652 wrote to memory of 2860	1652	Unicorn-45912.exe	34
PID 1652 wrote to memory of 2860	1652	Unicorn-45912.exe	34
PID 1652 wrote to memory of 2860	1652	Unicorn-45912.exe	34
PID 2940 wrote to memory of 2856	2940	9396f146915d3a1a36523086c3f1e7bb7bf4eac28b1563cb3560cab56eacf56dN.exe	35
PID 2940 wrote to memory of 2856	2940	9396f146915d3a1a36523086c3f1e7bb7bf4eac28b1563cb3560cab56eacf56dN.exe	35
PID 2940 wrote to memory of 2856	2940	9396f146915d3a1a36523086c3f1e7bb7bf4eac28b1563cb3560cab56eacf56dN.exe	35
PID 2940 wrote to memory of 2856	2940	9396f146915d3a1a36523086c3f1e7bb7bf4eac28b1563cb3560cab56eacf56dN.exe	35
PID 2416 wrote to memory of 2616	2416	Unicorn-30967.exe	36
PID 2416 wrote to memory of 2616	2416	Unicorn-30967.exe	36
PID 2416 wrote to memory of 2616	2416	Unicorn-30967.exe	36
PID 2416 wrote to memory of 2616	2416	Unicorn-30967.exe	36
PID 2424 wrote to memory of 2636	2424	Unicorn-157.exe	37
PID 2424 wrote to memory of 2636	2424	Unicorn-157.exe	37
PID 2424 wrote to memory of 2636	2424	Unicorn-157.exe	37
PID 2424 wrote to memory of 2636	2424	Unicorn-157.exe	37
PID 2856 wrote to memory of 2660	2856	Unicorn-34156.exe	38
PID 2856 wrote to memory of 2660	2856	Unicorn-34156.exe	38
PID 2856 wrote to memory of 2660	2856	Unicorn-34156.exe	38
PID 2856 wrote to memory of 2660	2856	Unicorn-34156.exe	38
PID 2940 wrote to memory of 3016	2940	9396f146915d3a1a36523086c3f1e7bb7bf4eac28b1563cb3560cab56eacf56dN.exe	39
PID 2940 wrote to memory of 3016	2940	9396f146915d3a1a36523086c3f1e7bb7bf4eac28b1563cb3560cab56eacf56dN.exe	39
PID 2940 wrote to memory of 3016	2940	9396f146915d3a1a36523086c3f1e7bb7bf4eac28b1563cb3560cab56eacf56dN.exe	39
PID 2940 wrote to memory of 3016	2940	9396f146915d3a1a36523086c3f1e7bb7bf4eac28b1563cb3560cab56eacf56dN.exe	39
PID 2860 wrote to memory of 1980	2860	Unicorn-22882.exe	40
PID 2860 wrote to memory of 1980	2860	Unicorn-22882.exe	40
PID 2860 wrote to memory of 1980	2860	Unicorn-22882.exe	40
PID 2860 wrote to memory of 1980	2860	Unicorn-22882.exe	40
PID 2636 wrote to memory of 2084	2636	Unicorn-62331.exe	41
PID 2636 wrote to memory of 2084	2636	Unicorn-62331.exe	41
PID 2636 wrote to memory of 2084	2636	Unicorn-62331.exe	41
PID 2636 wrote to memory of 2084	2636	Unicorn-62331.exe	41
PID 1652 wrote to memory of 2436	1652	Unicorn-45912.exe	42
PID 1652 wrote to memory of 2436	1652	Unicorn-45912.exe	42
PID 1652 wrote to memory of 2436	1652	Unicorn-45912.exe	42
PID 1652 wrote to memory of 2436	1652	Unicorn-45912.exe	42
PID 2616 wrote to memory of 1988	2616	Unicorn-26966.exe	44
PID 2616 wrote to memory of 1988	2616	Unicorn-26966.exe	44
PID 2616 wrote to memory of 1988	2616	Unicorn-26966.exe	44
PID 2616 wrote to memory of 1988	2616	Unicorn-26966.exe	44
PID 2424 wrote to memory of 1884	2424	Unicorn-157.exe	43
PID 2424 wrote to memory of 1884	2424	Unicorn-157.exe	43
PID 2424 wrote to memory of 1884	2424	Unicorn-157.exe	43
PID 2424 wrote to memory of 1884	2424	Unicorn-157.exe	43
PID 2416 wrote to memory of 2596	2416	Unicorn-30967.exe	45
PID 2416 wrote to memory of 2596	2416	Unicorn-30967.exe	45
PID 2416 wrote to memory of 2596	2416	Unicorn-30967.exe	45
PID 2416 wrote to memory of 2596	2416	Unicorn-30967.exe	45
PID 2660 wrote to memory of 2704	2660	Unicorn-1475.exe	46
PID 2660 wrote to memory of 2704	2660	Unicorn-1475.exe	46
PID 2660 wrote to memory of 2704	2660	Unicorn-1475.exe	46
PID 2660 wrote to memory of 2704	2660	Unicorn-1475.exe	46

C:\Users\Admin\AppData\Local\Temp\9396f146915d3a1a36523086c3f1e7bb7bf4eac28b1563cb3560cab56eacf56dN.exe
"C:\Users\Admin\AppData\Local\Temp\9396f146915d3a1a36523086c3f1e7bb7bf4eac28b1563cb3560cab56eacf56dN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Users\Admin\AppData\Local\Temp\Unicorn-157.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-157.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30967.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30967.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26966.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54568.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47059.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55850.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21315.exe
        8⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49192.exe
        9⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        9⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        9⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27802.exe
        9⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14811.exe
        9⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40208.exe
        8⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6876.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe
        8⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19136.exe
        8⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59394.exe
        7⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36235.exe
        8⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10098.exe
        8⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35574.exe
        7⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe
        7⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19136.exe
        7⤵
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17510.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51522.exe
        7⤵
        
        PID:700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        7⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        7⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27802.exe
        7⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64012.exe
        7⤵
        
        PID:6716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28863.exe
        6⤵
        
        PID:1736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12741.exe
        6⤵
        
        PID:3980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13775.exe
        6⤵
        
        PID:4900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2601.exe
        6⤵
        
        PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31277.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37184.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53769.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        7⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        7⤵
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19633.exe
        7⤵
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22037.exe
        7⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31140.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63753.exe
        6⤵
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6876.exe
        6⤵
        
        PID:3556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe
        6⤵
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19136.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60410.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55907.exe
        6⤵
        
        PID:108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26775.exe
        7⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        6⤵
        
        PID:4052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        6⤵
        
        PID:4980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19633.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49814.exe
        6⤵
        
        PID:4188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24039.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4076.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62777.exe
        5⤵
        
        PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19666.exe
        5⤵
        
        PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59347.exe
        5⤵
        
        PID:6852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39554.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63587.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15502.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18108.exe
        7⤵
        
        PID:836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30910.exe
        8⤵
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        8⤵
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19633.exe
        8⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25117.exe
        8⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21158.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6876.exe
        7⤵
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe
        7⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19136.exe
        7⤵
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53473.exe
        6⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59882.exe
        7⤵
        
        PID:892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8267.exe
        7⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46364.exe
        7⤵
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56500.exe
        7⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25739.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12741.exe
        6⤵
        
        PID:3908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13775.exe
        6⤵
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59970.exe
        6⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22567.exe
        6⤵
        
        PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56021.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36966.exe
        6⤵
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35954.exe
        7⤵
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        7⤵
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19633.exe
        7⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51760.exe
        7⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34370.exe
        6⤵
        
        PID:1116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3582.exe
        6⤵
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9022.exe
        6⤵
        
        PID:4500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52025.exe
        6⤵
        
        PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48049.exe
        5⤵
        
        PID:1772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41704.exe
        6⤵
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53654.exe
        6⤵
        
        PID:4740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25804.exe
        6⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25117.exe
        6⤵
        
        PID:6648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61445.exe
        5⤵
        
        PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62777.exe
        5⤵
        
        PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11498.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30759.exe
        5⤵
        
        PID:6240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32760.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26686.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13722.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22836.exe
        7⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35367.exe
        7⤵
        
        PID:5276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21838.exe
        6⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        6⤵
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27802.exe
        6⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14811.exe
        6⤵
        
        PID:7148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22829.exe
        5⤵
        
        PID:1720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24844.exe
        6⤵
        
        PID:4632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1351.exe
        6⤵
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27917.exe
        6⤵
        
        PID:6560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37795.exe
        5⤵
        
        PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10968.exe
        5⤵
        
        PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
        5⤵
        
        PID:6600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7946.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53639.exe
        5⤵
        
        PID:2504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6876.exe
        5⤵
        
        PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe
        5⤵
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10968.exe
        5⤵
        
        PID:5248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33764.exe
      4⤵
      PID:752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29540.exe
        5⤵
        
        PID:832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29342.exe
        5⤵
        
        PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36415.exe
        5⤵
        
        PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34439.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25117.exe
        5⤵
        
        PID:6352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19040.exe
      4⤵
      PID:2828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40808.exe
      4⤵
      PID:3416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49474.exe
      4⤵
      PID:4640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48446.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58213.exe
      4⤵
      PID:6776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62331.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62331.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15674.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16333.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59358.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24330.exe
        7⤵
        
        PID:572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9010.exe
        8⤵
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29342.exe
        8⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40499.exe
        8⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15964.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25117.exe
        8⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58766.exe
        7⤵
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43078.exe
        7⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22976.exe
        7⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21410.exe
        7⤵
        
        PID:6292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24884.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34823.exe
        7⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49519.exe
        7⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
        7⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11688.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14811.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28692.exe
        6⤵
        
        PID:3460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3582.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17190.exe
        6⤵
        
        PID:4596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52025.exe
        6⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25648.exe
        6⤵
        
        PID:6368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54459.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32306.exe
        6⤵
        
        PID:564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21419.exe
        7⤵
        
        PID:380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41542.exe
        7⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42549.exe
        7⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11688.exe
        7⤵
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25117.exe
        7⤵
        
        PID:6640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28771.exe
        6⤵
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63254.exe
        6⤵
        
        PID:4368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56582.exe
        6⤵
        
        PID:4216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3023.exe
        6⤵
        
        PID:6120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
        6⤵
        
        PID:6632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54764.exe
        5⤵
        
        PID:2800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21419.exe
        6⤵
        
        PID:1292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49519.exe
        6⤵
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50717.exe
        6⤵
        
        PID:4336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11688.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25117.exe
        6⤵
        
        PID:6416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21153.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52478.exe
        5⤵
        
        PID:4108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23213.exe
        5⤵
        
        PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3553.exe
        5⤵
        
        PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4117.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39445.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37376.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55798.exe
        6⤵
        
        PID:2480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        6⤵
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        6⤵
        
        PID:4956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19633.exe
        6⤵
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51760.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56353.exe
        5⤵
        
        PID:1860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6876.exe
        5⤵
        
        PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe
        5⤵
        
        PID:5060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19136.exe
        5⤵
        
        PID:5588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12771.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64978.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21419.exe
        6⤵
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20930.exe
        6⤵
        
        PID:4232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
        6⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11688.exe
        6⤵
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14811.exe
        6⤵
        
        PID:6260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19041.exe
        5⤵
        
        PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63254.exe
        5⤵
        
        PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25856.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3023.exe
        5⤵
        
        PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
        5⤵
        
        PID:6520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21241.exe
      4⤵
      PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41704.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2840.exe
        5⤵
        
        PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13768.exe
        5⤵
        
        PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58287.exe
        5⤵
        
        PID:7016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32773.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51384.exe
      4⤵
      PID:4160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64389.exe
      4⤵
      PID:6056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64319.exe
      4⤵
      PID:6612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17711.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17711.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20417.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51574.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1553.exe
        6⤵
        
        PID:1560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16383.exe
        6⤵
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13603.exe
        6⤵
        
        PID:4624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9245.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8304.exe
        5⤵
        
        PID:2148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43078.exe
        5⤵
        
        PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46364.exe
        5⤵
        
        PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7299.exe
        5⤵
        
        PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
        5⤵
        
        PID:6592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17318.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-100.exe
        5⤵
        
        PID:2756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23742.exe
        6⤵
        
        PID:6676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        5⤵
        
        PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27802.exe
        5⤵
        
        PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14811.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4084.exe
      4⤵
      PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31051.exe
        5⤵
        
        PID:5216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5467.exe
      4⤵
      PID:3448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21163.exe
      4⤵
      PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7829.exe
      4⤵
      PID:5288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4117.exe
      4⤵
      PID:6388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1677.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1677.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31154.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31154.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21315.exe
        5⤵
        
        PID:2804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49768.exe
        6⤵
        
        PID:3504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59519.exe
        6⤵
        
        PID:4816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13054.exe
        6⤵
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26093.exe
        5⤵
        
        PID:2080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43078.exe
        5⤵
        
        PID:3396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42280.exe
        5⤵
        
        PID:4572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56500.exe
        5⤵
        
        PID:5960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59394.exe
      4⤵
      PID:2668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38284.exe
        5⤵
        
        PID:2632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63254.exe
        5⤵
        
        PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56582.exe
        5⤵
        
        PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3023.exe
        5⤵
        
        PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
        5⤵
        
        PID:6456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5018.exe
      4⤵
      PID:2992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60454.exe
      4⤵
      PID:4440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31381.exe
      4⤵
      PID:4320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3553.exe
      4⤵
      PID:5284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4117.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3749.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3749.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2238.exe
      4⤵
      PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16386.exe
        5⤵
        
        PID:6128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50510.exe
      4⤵
      PID:3356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
      4⤵
      PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19633.exe
      4⤵
      PID:5192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25117.exe
      4⤵
      PID:6472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52424.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52424.exe
    3⤵
    PID:2772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38700.exe
      4⤵
      PID:5988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4606.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4606.exe
    3⤵
    PID:3512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58311.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58311.exe
    3⤵
    PID:4856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
    3⤵
    PID:5636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58213.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58213.exe
    3⤵
    PID:6768
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45912.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45912.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22882.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22882.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56706.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36753.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18902.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65061.exe
        7⤵
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21419.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41542.exe
        8⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42549.exe
        8⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11688.exe
        8⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25117.exe
        8⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35574.exe
        7⤵
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe
        7⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19136.exe
        7⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20834.exe
        7⤵
        
        PID:6820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47910.exe
        6⤵
        
        PID:2692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64245.exe
        6⤵
        
        PID:3316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe
        6⤵
        
        PID:5108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10968.exe
        6⤵
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
        6⤵
        
        PID:6376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42014.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31102.exe
        6⤵
        
        PID:2364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        6⤵
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        6⤵
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19633.exe
        6⤵
        
        PID:948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51760.exe
        6⤵
        
        PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
        5⤵
        
        PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12741.exe
        5⤵
        
        PID:3872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13775.exe
        5⤵
        
        PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2601.exe
        5⤵
        
        PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15341.exe
        5⤵
        
        PID:6928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53644.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45352.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42695.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17288.exe
        7⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29342.exe
        7⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40499.exe
        7⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32919.exe
        7⤵
        
        PID:6032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5750.exe
        6⤵
        
        PID:3120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3582.exe
        6⤵
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47917.exe
        6⤵
        
        PID:4192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53885.exe
        6⤵
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22829.exe
        5⤵
        
        PID:1968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-817.exe
        6⤵
        
        PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7068.exe
        5⤵
        
        PID:3168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe
        5⤵
        
        PID:5084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19136.exe
        5⤵
        
        PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63813.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7125.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42695.exe
        5⤵
        
        PID:2388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41704.exe
        6⤵
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2840.exe
        6⤵
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21936.exe
        6⤵
        
        PID:5644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23477.exe
        6⤵
        
        PID:6760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28444.exe
        5⤵
        
        PID:4088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        5⤵
        
        PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27802.exe
        5⤵
        
        PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14811.exe
        5⤵
        
        PID:7140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42430.exe
      4⤵
      PID:2476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29431.exe
        5⤵
        
        PID:2732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29342.exe
        5⤵
        
        PID:3140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40499.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58351.exe
        5⤵
        
        PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35046.exe
      4⤵
      PID:1524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27774.exe
      4⤵
      PID:3472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5468.exe
      4⤵
      PID:4648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53781.exe
      4⤵
      PID:5916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54012.exe
      4⤵
      PID:6828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61345.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61345.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36753.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13255.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35705.exe
        6⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44818.exe
        7⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16128.exe
        7⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21838.exe
        6⤵
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        6⤵
        
        PID:4940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50360.exe
        6⤵
        
        PID:4524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22037.exe
        6⤵
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-414.exe
        6⤵
        
        PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1449.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43977.exe
        6⤵
        
        PID:1708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41542.exe
        6⤵
        
        PID:4120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38465.exe
        6⤵
        
        PID:4584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20048.exe
        6⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25117.exe
        6⤵
        
        PID:6424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15288.exe
        5⤵
        
        PID:908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3582.exe
        5⤵
        
        PID:4432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39749.exe
        5⤵
        
        PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52025.exe
        5⤵
        
        PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15341.exe
        5⤵
        
        PID:6864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5642.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29348.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        5⤵
        
        PID:4080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        5⤵
        
        PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27802.exe
        5⤵
        
        PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14811.exe
        5⤵
        
        PID:6216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55890.exe
      4⤵
      PID:2900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12741.exe
      4⤵
      PID:3864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13775.exe
      4⤵
      PID:4892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2601.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1842.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1842.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41028.exe
      4⤵
      PID:2736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20796.exe
        5⤵
        
        PID:1308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        5⤵
        
        PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        5⤵
        
        PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19633.exe
        5⤵
        
        PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25117.exe
        5⤵
        
        PID:6344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53368.exe
      4⤵
      PID:2380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12741.exe
      4⤵
      PID:3528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13775.exe
      4⤵
      PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59970.exe
      4⤵
      PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52290.exe
      4⤵
      PID:6200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63561.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63561.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42695.exe
      4⤵
      PID:1668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46629.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27090.exe
        5⤵
        
        PID:5188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17611.exe
        5⤵
        
        PID:6844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17837.exe
      4⤵
      PID:3260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
      4⤵
      PID:4848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19633.exe
      4⤵
      PID:5152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25117.exe
      4⤵
      PID:6488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23458.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23458.exe
    3⤵
    PID:2276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10977.exe
      4⤵
      PID:4036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53654.exe
      4⤵
      PID:4820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54859.exe
      4⤵
      PID:5380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25117.exe
      4⤵
      PID:6584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24681.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24681.exe
    3⤵
    PID:2404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14305.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14305.exe
    3⤵
    PID:4792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55504.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55504.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64319.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64319.exe
    3⤵
    PID:6656
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34156.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34156.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1475.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1475.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63011.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26878.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42695.exe
        6⤵
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59447.exe
        7⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40395.exe
        6⤵
        
        PID:3272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        6⤵
        
        PID:4996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27802.exe
        6⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14811.exe
        6⤵
        
        PID:6228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22829.exe
        5⤵
        
        PID:968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64241.exe
        6⤵
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29342.exe
        6⤵
        
        PID:3112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40499.exe
        6⤵
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65165.exe
        6⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14811.exe
        6⤵
        
        PID:6196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37847.exe
        5⤵
        
        PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3582.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9022.exe
        5⤵
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19635.exe
        5⤵
        
        PID:6088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54075.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31922.exe
        5⤵
        
        PID:2540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54947.exe
        6⤵
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35574.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50854.exe
        7⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3317.exe
        7⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25648.exe
        7⤵
        
        PID:6504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9674.exe
        6⤵
        
        PID:1204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43078.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13603.exe
        6⤵
        
        PID:4680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9245.exe
        6⤵
        
        PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41111.exe
        5⤵
        
        PID:2304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21419.exe
        6⤵
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2648.exe
        6⤵
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7738.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17910.exe
        6⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14811.exe
        6⤵
        
        PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35574.exe
        5⤵
        
        PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18356.exe
        5⤵
        
        PID:4688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45779.exe
        5⤵
        
        PID:5236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19569.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35574.exe
        5⤵
        
        PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe
        5⤵
        
        PID:4840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39689.exe
        5⤵
        
        PID:6008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27905.exe
      4⤵
      PID:2052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40278.exe
      4⤵
      PID:3432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53940.exe
      4⤵
      PID:4708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9775.exe
      4⤵
      PID:5876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47230.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47230.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57941.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19862.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53852.exe
        6⤵
        
        PID:2468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8267.exe
        6⤵
        
        PID:4004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46364.exe
        6⤵
        
        PID:4228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7299.exe
        6⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
        6⤵
        
        PID:6464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35932.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6876.exe
        5⤵
        
        PID:3560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe
        5⤵
        
        PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19136.exe
        5⤵
        
        PID:5688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28584.exe
      4⤵
      Executes dropped EXE
      PID:1548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33816.exe
        5⤵
        
        PID:2620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16275.exe
        5⤵
        
        PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        5⤵
        
        PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27802.exe
        5⤵
        
        PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14811.exe
        5⤵
        
        PID:6184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11157.exe
      4⤵
      PID:568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48943.exe
      4⤵
      PID:3204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37698.exe
      4⤵
      PID:4264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56301.exe
      4⤵
      PID:4644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25648.exe
      4⤵
      PID:6664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29252.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29252.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24330.exe
      4⤵
      PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44506.exe
        5⤵
        
        PID:2296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29342.exe
        5⤵
        
        PID:3192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40499.exe
        5⤵
        
        PID:1856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59562.exe
        5⤵
        
        PID:5860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18418.exe
      4⤵
      PID:596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43078.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13603.exe
      4⤵
      PID:4672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9245.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44485.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44485.exe
    3⤵
    PID:2308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29348.exe
      4⤵
      PID:1484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43078.exe
      4⤵
      PID:3256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46364.exe
      4⤵
      PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7299.exe
      4⤵
      PID:5244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
      4⤵
      PID:6496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53090.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53090.exe
    3⤵
    PID:1476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53078.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53078.exe
    3⤵
    PID:3452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29853.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29853.exe
    3⤵
    PID:4152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11799.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11799.exe
    3⤵
    PID:5148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2982.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2982.exe
    3⤵
    PID:6572
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21630.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21630.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:3016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30147.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30147.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8403.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54480.exe
        5⤵
        
        PID:1816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37599.exe
        6⤵
        
        PID:2092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29342.exe
        6⤵
        
        PID:3160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36415.exe
        6⤵
        
        PID:4568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34439.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25117.exe
        6⤵
        
        PID:6400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1553.exe
        5⤵
        
        PID:2696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55278.exe
        5⤵
        
        PID:3428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48414.exe
        5⤵
        
        PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3023.exe
        5⤵
        
        PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
        5⤵
        
        PID:6408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9918.exe
      4⤵
      PID:328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11148.exe
        5⤵
        
        PID:236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29342.exe
        5⤵
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40499.exe
        5⤵
        
        PID:2128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34439.exe
        5⤵
        
        PID:6024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14811.exe
        5⤵
        
        PID:7132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5018.exe
      4⤵
      PID:1792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48943.exe
      4⤵
      PID:3220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37698.exe
      4⤵
      PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9238.exe
      4⤵
      PID:6036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54075.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54075.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60894.exe
      4⤵
      PID:2748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15965.exe
        5⤵
        
        PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49519.exe
        5⤵
        
        PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
        5⤵
        
        PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11688.exe
        5⤵
        
        PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14811.exe
        5⤵
        
        PID:7156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21838.exe
      4⤵
      PID:3920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
      4⤵
      PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27802.exe
      4⤵
      PID:5748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14811.exe
      4⤵
      PID:7164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35797.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35797.exe
    3⤵
    PID:1440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44304.exe
      4⤵
      PID:3388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59540.exe
      4⤵
      PID:4696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12045.exe
      4⤵
      PID:5812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60425.exe
      4⤵
      PID:6208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41439.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41439.exe
    3⤵
    PID:3888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13775.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13775.exe
    3⤵
    PID:4864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29243.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29243.exe
    3⤵
    PID:5220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25648.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25648.exe
    3⤵
    PID:6624
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54657.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54657.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10349.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10349.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44558.exe
      4⤵
      PID:1520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21419.exe
        5⤵
        
        PID:3080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53654.exe
        5⤵
        
        PID:4748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57106.exe
        5⤵
        
        PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14811.exe
        5⤵
        
        PID:6192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34993.exe
      4⤵
      PID:3208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63254.exe
      4⤵
      PID:4388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52498.exe
      4⤵
      PID:4620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3023.exe
      4⤵
      PID:5368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
      4⤵
      PID:6536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1641.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1641.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21419.exe
      4⤵
      PID:2100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53654.exe
      4⤵
      PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34673.exe
      4⤵
      PID:5980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44645.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44645.exe
    3⤵
    PID:3180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3582.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3582.exe
    3⤵
    PID:4476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9022.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9022.exe
    3⤵
    PID:4224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19635.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19635.exe
    3⤵
    PID:5956
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62673.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62673.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30910.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30910.exe
    3⤵
    PID:1016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
    3⤵
    PID:4008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
    3⤵
    PID:4948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19633.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19633.exe
    3⤵
    PID:4208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51760.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51760.exe
    3⤵
    PID:5936
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63350.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63350.exe
  2⤵
  PID:2644
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48612.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48612.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3500
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52976.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52976.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4780
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54369.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54369.exe
  2⤵
  PID:4616
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1888.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1888.exe
  2⤵
  PID:6176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-21630.exe

Filesize
468KB

MD5
96c328c83eee4e82a1e74f26183506fa

SHA1
f5cc002a6542bd60370355c8f30cdcf13824b98b

SHA256
7beb1de8de9daad263abeb3d2ac342cbda756fdfeade7f31c0275a4f6174c67d

SHA512
738a2046b8b0d09748aed919cff9ce825e9cb1a8e843351d78825e87530f8e8b1d4ffe882a41bf4fb59d88180518730b1bc037b94c441cf03d11d41aaabb149a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26966.exe

Filesize
468KB

MD5
7022db35188944c724768e18fc13a033

SHA1
ce9ac72304ddf2175cebe70b8123765a934ec47b

SHA256
cb40cc41d3bcd3589867cc11ab4780616ea98f8e62752789f6298b1c29bb728c

SHA512
60be7eda363bd301d74f920a4df06804cccb9492c7264dbfae4c440ff0b9f50be0287d0b49da65b6e7da5199e3dd40943a6729bab4baea9d8dd69d57b887eb2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34156.exe

Filesize
468KB

MD5
e558fb16fcfd0955ac13eb2863f57623

SHA1
a6cca1bafe8815e321e0d22b4028dd7e2e91a748

SHA256
d21ed4b6f16858c9b7d481552f66011719444616b6d2d437ea2df296f134b95a

SHA512
f7dd8980411813238633125c4cd3a644942d6825bb34db2cc010180a01e5e385fe5ce3b8fad4a578968c2178e9f12b1fdec44ee33e0d23af0bbbf5d00be784f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38465.exe

Filesize
468KB

MD5
42af278c70f34cd8a4944d58f0c38958

SHA1
65a3e70b0edbe819b4876410ac80190efe771795

SHA256
6563dd18748968c6e0f3cbf8b342b5c29ce94f63a0a4fe1a0bba756d61795221

SHA512
d041ee6dc351cb903d8b3184525a432a356084436a9354c22a44d87a13ea1f93b207c839bea7467e9dc3f78040989ac44004fcb2e7ead154c6b5ba227270a95a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39554.exe

Filesize
468KB

MD5
a12ae4fe005a7d88dc2b7ad95ce0ef9e

SHA1
aa0792a5480f4effd594a2021109e51ae489e71f

SHA256
d8405975fc2314e8ac2fce70b81ac81069b354bdbe43d8e4f04d84cd66a428d2

SHA512
a01a95aa4e71fb19d8aff65839699308bc63a593fc529e81078ce87b069a2374fa8f0c1ab9714ff3f985ea9f0c10b47ebf776c182ae54ca21b2df648281f011f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45912.exe

Filesize
468KB

MD5
b850ad9066df4413881e337b867e029f

SHA1
fc1cb459a747a8a3797ad365a870435b833594b0

SHA256
81bbb547a94d3343a8528ef818fd4e7b89eebafa3b9243bf476125bf2cf65ce2

SHA512
2b5daaf9b43ba829a8d2e4a32110ea0d6abed227879f80e3d1851e0ce3d657cec8bc662448d93c9f14828d9022431771ea6aa860c835090b0ce009d574b4cbdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47230.exe

Filesize
468KB

MD5
a5056ff0ffadc96a6bce827087aa5c05

SHA1
f09baeb88d06027956e7b9d4ad31ac4590ce6b72

SHA256
e1a7ec43fed8c4201084e0d5c561fdce591d0e46e9c8913b2adf4540e0e74812

SHA512
fca743985ed36df33da5d50932c84237a23e56ee04c90725a706c2a1bda4d12d0d98ba051094af0c275269da6c35475501bfa14184195ae324ead2d6b9360d12

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54568.exe

Filesize
468KB

MD5
15f3552abff255110095f30f69e3ee76

SHA1
356572b79d877c8e174d99cf7ef27b7cff6f6ee9

SHA256
07342239917185cf6d13f8945e211c2fb64b0b0807e5383ab336a2a6556cb71d

SHA512
2d6ea93d29d06d2710dae095158a8d574183c957ee6b984467e22a55fafe277b6b482fdb2a5dba7f95a7b5ebf905abb1361291132fa9efe0880f0b4af0819b98

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56706.exe

Filesize
468KB

MD5
5b6d96b0a2db46431e8f21c1d78fe89b

SHA1
78cbccc953384a26911d2ebc595fb042b218b9fb

SHA256
fae69dfa656faee85f1c014fea4c1cb8e2043a2195075b9dac705faec42fd641

SHA512
7124ebe1909f84d8e71de8c0e4613ba4b87e00400bdbde00d9e5ed5f3fe873e41d2cae2f30344e721da0d823fa993b5b90fc9aa768727a07b560861a7a2d94ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62331.exe

Filesize
468KB

MD5
7cab2cf1504017311a80680b0402173f

SHA1
8d0119b9244bf625f71bbe8de4f2d6ba374da8e4

SHA256
787902218e2ea16567c6dcf1b607db534a5e2eaf15ec1aca67189a845c477da0

SHA512
c0c26c632425a84791e4c51864ef7fc39b910af0b5cce6ecc2026bbef57629c480976c1c52ccdfa95ed50e87e3cb32251bba91740bdc95863e6dad5d68430781

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1475.exe

Filesize
468KB

MD5
ddc1870afaf0ecf7431eccb20035cf65

SHA1
3d082aa0898fcc326caaaf57c07fe38b50d80fe4

SHA256
dadf2d0e823d8dc63b51abf50ec97686ccedcff2054ce4180e135f9c77e09480

SHA512
0b6212382361685c4eb070f249305a25e3725855565aba1b9a187eeeb8569f2aeb3639289f7ba0e7ee3246cbbfc2f60db9a6b0381b17094bcc6e57c532b3d51a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15674.exe

Filesize
468KB

MD5
46ec3b48aee245e259618afd5e1de33f

SHA1
780a46dd5b3a674284dbe8932310a9ab15257a8d

SHA256
ef06740b8d13a97dbd21a22950d69ce0d80c2828cfb0c71690c1971f3549b101

SHA512
602b28b5e41328f86eb48e286ac506bb4fda009a5ea0ab0787cb1f11a071cb47cfe733d7671c22848911db6f12045c5980613adb05e4efa4b07e3b33054bffa5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-157.exe

Filesize
468KB

MD5
7692f4cba65e159d11dec4364eb1e95f

SHA1
88b2e3651ccaf27cd6acc34841e7c7116af566f4

SHA256
63f18b241fa232e065b67c86cb706d9cf7e16a503cc1b5460ccfa8162408cb15

SHA512
767927380e6e28f7cf317e1959d6f54022fb2e284a10ca704da8dff3aecf63cfd65152cb76f17c988b98e9a0e552ee522f5d32ae50cbca33206b3cf7f8883b98

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17711.exe

Filesize
468KB

MD5
8fb10422a0cbb2e75876290c66faab1e

SHA1
b84e9e12c3733d9bcb5ce1f18aa2f3af4bf12081

SHA256
f70185f29eccec89040278a04d2a0361478c6c4911548033d096609c7de72ce8

SHA512
9c51f99910c3ae21ee25600197d6d92ea4a485be40767a427fca79b2f1544d187a0445a64e5d73956ad620cd69a86cadda1663ef224272ff5bfb229b5e3d04dd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22882.exe

Filesize
468KB

MD5
ee0fce862ceec569b932c2fdfff87895

SHA1
32cbe044ad31882b3a8a02a33219091357da830d

SHA256
84abe0bbc69f34c24212d365fdc983eb954c3f21e5f53b7d422585809b85aecd

SHA512
f8a38a5987a8edb9145a2952b579cbcc46732fb4dca6de4d201d2e59d2ebe455a5dc525a20923c7ef435349afeed36e6f0529115e132ddaa61a4c10492a69cf6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-30147.exe

Filesize
468KB

MD5
86d36c59db68fc5c31e7c04eceed798f

SHA1
a9557331409926996222e45b49cd543c07fcd1a8

SHA256
555615f6eae85f8d1c9fa2f1f8662fdcc14797e3a8cf8e29edb42386443b6ddf

SHA512
e60210511104afa3a09ac5d5bb02cb2cbcfd7df7b7d1ce6568912dfbe0727bfc4b84e43bb67857037ac3fa13c3ab98e0623ca881b063db7fb0641a3534008b28

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-30967.exe

Filesize
468KB

MD5
9e1d542420e0569f8922fa15134139a6

SHA1
7985a738dd03ff32579745fc7399cafc0264603c

SHA256
78138c23dc0c8a4b4e1aa7e36d048bbffd3babeaad3cafce9836a7741d6ee629

SHA512
2aa28a2388cc67d5bec07f22fa34934a6c207cedcec7d0184a79e975ad3266b75d7252d775734246bcb55e82f65ab998dc2e2accd9006dcce9bcd483e9944e42

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61345.exe

Filesize
468KB

MD5
b941ec5c0c2fb1138afe907ae63f70e5

SHA1
8cc102bd3d66ac6883ceae5944142187a8d9edac

SHA256
cf8f0e191e5120f9008fc74d6d3a0337f531f57bcc9ec1d97af204f8571ce7be

SHA512
908d35402de6bc6d52f53437956ce5a8bdd2aa967c0f4e62f490795a7757dfa6a81e7aeff590a8478fec4a083c6e8207d8c8f80a5b6ebe70d605bd2e7c48986f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63011.exe

Filesize
468KB

MD5
88d36ce6c9adbfc3febdf69d4c85e322

SHA1
11c61d1e6405d740690ac391ab64a96c2c0eaad0

SHA256
50a3152140bb03c85974473228d0d660be187afc1c83a74fc28a0929e32b463a

SHA512
dc145e6967d6668477ab2a962746cbcaa3d6b4cea605a2b672facdefd1985c26d3cfb7e78f1ac607f3e0fb28dac7f7b13e918ba34db737b43ffa6e20d687c423

Download Submit
memory/376-292-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/448-356-0x0000000002710000-0x0000000002785000-memory.dmp

Filesize
468KB

Download
memory/448-214-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/448-357-0x0000000002710000-0x0000000002785000-memory.dmp

Filesize
468KB

Download
memory/600-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/984-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1260-248-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1456-230-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1456-391-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1456-387-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1564-310-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1632-253-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1652-54-0x0000000001CB0000-0x0000000001D25000-memory.dmp

Filesize
468KB

Download
memory/1652-144-0x0000000001CB0000-0x0000000001D25000-memory.dmp

Filesize
468KB

Download
memory/1652-35-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1652-141-0x0000000001CB0000-0x0000000001D25000-memory.dmp

Filesize
468KB

Download
memory/1652-338-0x0000000001CB0000-0x0000000001D25000-memory.dmp

Filesize
468KB

Download
memory/1652-337-0x0000000001CB0000-0x0000000001D25000-memory.dmp

Filesize
468KB

Download
memory/1884-297-0x0000000003240000-0x00000000032B5000-memory.dmp

Filesize
468KB

Download
memory/1884-170-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1884-296-0x0000000003240000-0x00000000032B5000-memory.dmp

Filesize
468KB

Download
memory/1980-120-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1980-317-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/1988-271-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/1988-162-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2040-273-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2056-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2084-289-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2084-143-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2084-276-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2396-332-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2416-261-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2416-256-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2416-179-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2416-173-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2416-65-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2424-315-0x0000000001D90000-0x0000000001E05000-memory.dmp

Filesize
468KB

Download
memory/2424-12-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2424-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2424-20-0x0000000001F90000-0x0000000002005000-memory.dmp

Filesize
468KB

Download
memory/2424-319-0x0000000001D90000-0x0000000001E05000-memory.dmp

Filesize
468KB

Download
memory/2424-169-0x0000000001D90000-0x0000000001E05000-memory.dmp

Filesize
468KB

Download
memory/2424-154-0x0000000001D90000-0x0000000001E05000-memory.dmp

Filesize
468KB

Download
memory/2436-316-0x0000000001E20000-0x0000000001E95000-memory.dmp

Filesize
468KB

Download
memory/2436-146-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2596-180-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2596-251-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2596-252-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2616-155-0x0000000002510000-0x0000000002585000-memory.dmp

Filesize
468KB

Download
memory/2616-288-0x0000000002510000-0x0000000002585000-memory.dmp

Filesize
468KB

Download
memory/2616-161-0x0000000002510000-0x0000000002585000-memory.dmp

Filesize
468KB

Download
memory/2616-293-0x0000000002510000-0x0000000002585000-memory.dmp

Filesize
468KB

Download
memory/2616-70-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2636-309-0x00000000026E0000-0x0000000002755000-memory.dmp

Filesize
468KB

Download
memory/2636-142-0x00000000026E0000-0x0000000002755000-memory.dmp

Filesize
468KB

Download
memory/2636-308-0x00000000026E0000-0x0000000002755000-memory.dmp

Filesize
468KB

Download
memory/2636-81-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2636-128-0x00000000026E0000-0x0000000002755000-memory.dmp

Filesize
468KB

Download
memory/2660-96-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2660-382-0x0000000002850000-0x00000000028C5000-memory.dmp

Filesize
468KB

Download
memory/2660-381-0x0000000002850000-0x00000000028C5000-memory.dmp

Filesize
468KB

Download
memory/2660-200-0x0000000003380000-0x00000000033F5000-memory.dmp

Filesize
468KB

Download
memory/2660-201-0x0000000002850000-0x00000000028C5000-memory.dmp

Filesize
468KB

Download
memory/2672-392-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2704-204-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2704-376-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2704-372-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2716-339-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2792-377-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2816-368-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2856-213-0x0000000002820000-0x0000000002895000-memory.dmp

Filesize
468KB

Download
memory/2856-366-0x0000000002820000-0x0000000002895000-memory.dmp

Filesize
468KB

Download
memory/2856-212-0x0000000002820000-0x0000000002895000-memory.dmp

Filesize
468KB

Download
memory/2856-69-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2856-94-0x0000000002820000-0x0000000002895000-memory.dmp

Filesize
468KB

Download
memory/2856-367-0x0000000002820000-0x0000000002895000-memory.dmp

Filesize
468KB

Download
memory/2860-58-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2860-331-0x00000000033F0000-0x0000000003465000-memory.dmp

Filesize
468KB

Download
memory/2860-330-0x00000000033F0000-0x0000000003465000-memory.dmp

Filesize
468KB

Download
memory/2860-122-0x00000000033F0000-0x0000000003465000-memory.dmp

Filesize
468KB

Download
memory/2860-119-0x00000000033F0000-0x0000000003465000-memory.dmp

Filesize
468KB

Download
memory/2864-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2884-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2916-307-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2924-320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2940-241-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/2940-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2940-386-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/2940-121-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/2940-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2940-10-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/2940-240-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/3016-118-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3016-384-0x0000000001D10000-0x0000000001D85000-memory.dmp

Filesize
468KB

Download
memory/3016-223-0x0000000001D10000-0x0000000001D85000-memory.dmp

Filesize
468KB

Download
memory/3016-229-0x0000000001D10000-0x0000000001D85000-memory.dmp

Filesize
468KB

Download