973e465576184a42ba7359e3b1d4f29d1b562f6a57eede0e781c27ca27483813

Analysis

max time kernel
118s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 20:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

973e465576184a42ba7359e3b1d4f29d1b562f6a57eede0e781c27ca27483813N.exe
Size

468KB
MD5

ac23c324e9efc0044080833afd473780
SHA1

57f8e4b027dafd0087e681c1f8f59a5b1826545b
SHA256

973e465576184a42ba7359e3b1d4f29d1b562f6a57eede0e781c27ca27483813
SHA512

e14471b870c0080630cf7fa7d5526002d883defb7b4319066f35bd1a391aecc13b6777919c520d3de58d454be87221f32ef919f879d4a696f1d1713016fe3a2f
SSDEEP

3072:t1opowLejy8U6bYPfz5Uff57tgjyYr1nmHegVpLop6nCgrNfNlB:t12ojLU6kf1UffDCzOopIbrNf

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2792	Unicorn-15544.exe
2928	Unicorn-19712.exe
2736	Unicorn-30572.exe
2580	Unicorn-5404.exe
2844	Unicorn-36131.exe
2744	Unicorn-16265.exe
776	Unicorn-25916.exe
764	Unicorn-33199.exe
2420	Unicorn-5741.exe
2768	Unicorn-15300.exe
2120	Unicorn-27644.exe
1380	Unicorn-33775.exe
1744	Unicorn-13909.exe
1856	Unicorn-33775.exe
1792	Unicorn-33510.exe
1680	Unicorn-6639.exe
2192	Unicorn-42004.exe
1352	Unicorn-35996.exe
948	Unicorn-7215.exe
448	Unicorn-1085.exe
2280	Unicorn-1548.exe
940	Unicorn-27444.exe
2024	Unicorn-64947.exe
892	Unicorn-19276.exe
1684	Unicorn-19276.exe
2052	Unicorn-54754.exe
2256	Unicorn-60619.exe
1064	Unicorn-60884.exe
1540	Unicorn-60884.exe
2512	Unicorn-23173.exe
2920	Unicorn-12238.exe
2904	Unicorn-6722.exe
2740	Unicorn-7454.exe
2712	Unicorn-39804.exe
1652	Unicorn-46249.exe
1320	Unicorn-17569.exe
1336	Unicorn-3178.exe
3060	Unicorn-48850.exe
2204	Unicorn-57018.exe
2664	Unicorn-35851.exe
2564	Unicorn-31502.exe
3032	Unicorn-44019.exe
2884	Unicorn-23498.exe
3000	Unicorn-50817.exe
2756	Unicorn-26675.exe
2448	Unicorn-3370.exe
2428	Unicorn-23882.exe
2416	Unicorn-29748.exe
1088	Unicorn-62062.exe
1528	Unicorn-28643.exe
1784	Unicorn-8777.exe
828	Unicorn-29826.exe
3044	Unicorn-35849.exe
2964	Unicorn-61315.exe
2516	Unicorn-22975.exe
1800	Unicorn-42841.exe
2728	Unicorn-12669.exe
1688	Unicorn-32535.exe
2592	Unicorn-38657.exe
1256	Unicorn-16775.exe
332	Unicorn-13245.exe
2116	Unicorn-22805.exe
2816	Unicorn-51485.exe
1188	Unicorn-63645.exe

Loads dropped DLL 64 IoCs

pid	Process
2160	973e465576184a42ba7359e3b1d4f29d1b562f6a57eede0e781c27ca27483813N.exe
2160	973e465576184a42ba7359e3b1d4f29d1b562f6a57eede0e781c27ca27483813N.exe
2792	Unicorn-15544.exe
2160	973e465576184a42ba7359e3b1d4f29d1b562f6a57eede0e781c27ca27483813N.exe
2792	Unicorn-15544.exe
2160	973e465576184a42ba7359e3b1d4f29d1b562f6a57eede0e781c27ca27483813N.exe
2928	Unicorn-19712.exe
2928	Unicorn-19712.exe
2792	Unicorn-15544.exe
2736	Unicorn-30572.exe
2792	Unicorn-15544.exe
2736	Unicorn-30572.exe
2160	973e465576184a42ba7359e3b1d4f29d1b562f6a57eede0e781c27ca27483813N.exe
2160	973e465576184a42ba7359e3b1d4f29d1b562f6a57eede0e781c27ca27483813N.exe
2580	Unicorn-5404.exe
2580	Unicorn-5404.exe
2928	Unicorn-19712.exe
2928	Unicorn-19712.exe
2744	Unicorn-16265.exe
2744	Unicorn-16265.exe
2736	Unicorn-30572.exe
2792	Unicorn-15544.exe
2736	Unicorn-30572.exe
2792	Unicorn-15544.exe
2844	Unicorn-36131.exe
776	Unicorn-25916.exe
2844	Unicorn-36131.exe
776	Unicorn-25916.exe
2160	973e465576184a42ba7359e3b1d4f29d1b562f6a57eede0e781c27ca27483813N.exe
2160	973e465576184a42ba7359e3b1d4f29d1b562f6a57eede0e781c27ca27483813N.exe
764	Unicorn-33199.exe
764	Unicorn-33199.exe
2580	Unicorn-5404.exe
2580	Unicorn-5404.exe
2420	Unicorn-5741.exe
2420	Unicorn-5741.exe
2768	Unicorn-15300.exe
2768	Unicorn-15300.exe
2928	Unicorn-19712.exe
2928	Unicorn-19712.exe
2744	Unicorn-16265.exe
2744	Unicorn-16265.exe
1380	Unicorn-33775.exe
1380	Unicorn-33775.exe
776	Unicorn-25916.exe
776	Unicorn-25916.exe
1744	Unicorn-13909.exe
1744	Unicorn-13909.exe
2120	Unicorn-27644.exe
2120	Unicorn-27644.exe
2736	Unicorn-30572.exe
2736	Unicorn-30572.exe
2792	Unicorn-15544.exe
1792	Unicorn-33510.exe
1856	Unicorn-33775.exe
2792	Unicorn-15544.exe
1792	Unicorn-33510.exe
1856	Unicorn-33775.exe
2844	Unicorn-36131.exe
2160	973e465576184a42ba7359e3b1d4f29d1b562f6a57eede0e781c27ca27483813N.exe
2844	Unicorn-36131.exe
2160	973e465576184a42ba7359e3b1d4f29d1b562f6a57eede0e781c27ca27483813N.exe
1680	Unicorn-6639.exe
1680	Unicorn-6639.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8341.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31502.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6346.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24764.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12511.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32434.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32436.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19276.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46249.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30353.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8144.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11359.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32434.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44927.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21168.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6346.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1557.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40571.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41916.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38657.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40571.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40571.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37941.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34705.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40571.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8144.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8144.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21168.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37228.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60884.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57018.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35851.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58234.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5494.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64527.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12153.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22888.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11815.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15370.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32434.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34705.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32436.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26923.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22406.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46872.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6580.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42689.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34705.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51485.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28290.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-481.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40881.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23088.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2160	973e465576184a42ba7359e3b1d4f29d1b562f6a57eede0e781c27ca27483813N.exe
2792	Unicorn-15544.exe
2928	Unicorn-19712.exe
2736	Unicorn-30572.exe
2580	Unicorn-5404.exe
2744	Unicorn-16265.exe
2844	Unicorn-36131.exe
776	Unicorn-25916.exe
764	Unicorn-33199.exe
2420	Unicorn-5741.exe
2768	Unicorn-15300.exe
1744	Unicorn-13909.exe
2120	Unicorn-27644.exe
1380	Unicorn-33775.exe
1856	Unicorn-33775.exe
1792	Unicorn-33510.exe
1680	Unicorn-6639.exe
2192	Unicorn-42004.exe
1352	Unicorn-35996.exe
948	Unicorn-7215.exe
448	Unicorn-1085.exe
2280	Unicorn-1548.exe
940	Unicorn-27444.exe
2024	Unicorn-64947.exe
892	Unicorn-19276.exe
1684	Unicorn-19276.exe
1064	Unicorn-60884.exe
2256	Unicorn-60619.exe
2512	Unicorn-23173.exe
1540	Unicorn-60884.exe
2920	Unicorn-12238.exe
2052	Unicorn-54754.exe
2904	Unicorn-6722.exe
2712	Unicorn-39804.exe
2740	Unicorn-7454.exe
1652	Unicorn-46249.exe
1320	Unicorn-17569.exe
1336	Unicorn-3178.exe
2204	Unicorn-57018.exe
2664	Unicorn-35851.exe
3060	Unicorn-48850.exe
2564	Unicorn-31502.exe
3032	Unicorn-44019.exe
2884	Unicorn-23498.exe
3000	Unicorn-50817.exe
2448	Unicorn-3370.exe
2428	Unicorn-23882.exe
2416	Unicorn-29748.exe
2756	Unicorn-26675.exe
1088	Unicorn-62062.exe
1528	Unicorn-28643.exe
1784	Unicorn-8777.exe
828	Unicorn-29826.exe
3044	Unicorn-35849.exe
2964	Unicorn-61315.exe
1800	Unicorn-42841.exe
2516	Unicorn-22975.exe
2728	Unicorn-12669.exe
1688	Unicorn-32535.exe
2592	Unicorn-38657.exe
1256	Unicorn-16775.exe
332	Unicorn-13245.exe
2116	Unicorn-22805.exe
2816	Unicorn-51485.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2792	2160	973e465576184a42ba7359e3b1d4f29d1b562f6a57eede0e781c27ca27483813N.exe	30
PID 2160 wrote to memory of 2792	2160	973e465576184a42ba7359e3b1d4f29d1b562f6a57eede0e781c27ca27483813N.exe	30
PID 2160 wrote to memory of 2792	2160	973e465576184a42ba7359e3b1d4f29d1b562f6a57eede0e781c27ca27483813N.exe	30
PID 2160 wrote to memory of 2792	2160	973e465576184a42ba7359e3b1d4f29d1b562f6a57eede0e781c27ca27483813N.exe	30
PID 2792 wrote to memory of 2928	2792	Unicorn-15544.exe	31
PID 2792 wrote to memory of 2928	2792	Unicorn-15544.exe	31
PID 2792 wrote to memory of 2928	2792	Unicorn-15544.exe	31
PID 2792 wrote to memory of 2928	2792	Unicorn-15544.exe	31
PID 2160 wrote to memory of 2736	2160	973e465576184a42ba7359e3b1d4f29d1b562f6a57eede0e781c27ca27483813N.exe	32
PID 2160 wrote to memory of 2736	2160	973e465576184a42ba7359e3b1d4f29d1b562f6a57eede0e781c27ca27483813N.exe	32
PID 2160 wrote to memory of 2736	2160	973e465576184a42ba7359e3b1d4f29d1b562f6a57eede0e781c27ca27483813N.exe	32
PID 2160 wrote to memory of 2736	2160	973e465576184a42ba7359e3b1d4f29d1b562f6a57eede0e781c27ca27483813N.exe	32
PID 2928 wrote to memory of 2580	2928	Unicorn-19712.exe	33
PID 2928 wrote to memory of 2580	2928	Unicorn-19712.exe	33
PID 2928 wrote to memory of 2580	2928	Unicorn-19712.exe	33
PID 2928 wrote to memory of 2580	2928	Unicorn-19712.exe	33
PID 2792 wrote to memory of 2744	2792	Unicorn-15544.exe	34
PID 2792 wrote to memory of 2744	2792	Unicorn-15544.exe	34
PID 2792 wrote to memory of 2744	2792	Unicorn-15544.exe	34
PID 2792 wrote to memory of 2744	2792	Unicorn-15544.exe	34
PID 2736 wrote to memory of 2844	2736	Unicorn-30572.exe	35
PID 2736 wrote to memory of 2844	2736	Unicorn-30572.exe	35
PID 2736 wrote to memory of 2844	2736	Unicorn-30572.exe	35
PID 2736 wrote to memory of 2844	2736	Unicorn-30572.exe	35
PID 2160 wrote to memory of 776	2160	973e465576184a42ba7359e3b1d4f29d1b562f6a57eede0e781c27ca27483813N.exe	36
PID 2160 wrote to memory of 776	2160	973e465576184a42ba7359e3b1d4f29d1b562f6a57eede0e781c27ca27483813N.exe	36
PID 2160 wrote to memory of 776	2160	973e465576184a42ba7359e3b1d4f29d1b562f6a57eede0e781c27ca27483813N.exe	36
PID 2160 wrote to memory of 776	2160	973e465576184a42ba7359e3b1d4f29d1b562f6a57eede0e781c27ca27483813N.exe	36
PID 2580 wrote to memory of 764	2580	Unicorn-5404.exe	37
PID 2580 wrote to memory of 764	2580	Unicorn-5404.exe	37
PID 2580 wrote to memory of 764	2580	Unicorn-5404.exe	37
PID 2580 wrote to memory of 764	2580	Unicorn-5404.exe	37
PID 2928 wrote to memory of 2420	2928	Unicorn-19712.exe	38
PID 2928 wrote to memory of 2420	2928	Unicorn-19712.exe	38
PID 2928 wrote to memory of 2420	2928	Unicorn-19712.exe	38
PID 2928 wrote to memory of 2420	2928	Unicorn-19712.exe	38
PID 2744 wrote to memory of 2768	2744	Unicorn-16265.exe	39
PID 2744 wrote to memory of 2768	2744	Unicorn-16265.exe	39
PID 2744 wrote to memory of 2768	2744	Unicorn-16265.exe	39
PID 2744 wrote to memory of 2768	2744	Unicorn-16265.exe	39
PID 2736 wrote to memory of 1744	2736	Unicorn-30572.exe	40
PID 2736 wrote to memory of 1744	2736	Unicorn-30572.exe	40
PID 2736 wrote to memory of 1744	2736	Unicorn-30572.exe	40
PID 2736 wrote to memory of 1744	2736	Unicorn-30572.exe	40
PID 2792 wrote to memory of 2120	2792	Unicorn-15544.exe	41
PID 2792 wrote to memory of 2120	2792	Unicorn-15544.exe	41
PID 2792 wrote to memory of 2120	2792	Unicorn-15544.exe	41
PID 2792 wrote to memory of 2120	2792	Unicorn-15544.exe	41
PID 2844 wrote to memory of 1856	2844	Unicorn-36131.exe	42
PID 2844 wrote to memory of 1856	2844	Unicorn-36131.exe	42
PID 2844 wrote to memory of 1856	2844	Unicorn-36131.exe	42
PID 2844 wrote to memory of 1856	2844	Unicorn-36131.exe	42
PID 776 wrote to memory of 1380	776	Unicorn-25916.exe	43
PID 776 wrote to memory of 1380	776	Unicorn-25916.exe	43
PID 776 wrote to memory of 1380	776	Unicorn-25916.exe	43
PID 776 wrote to memory of 1380	776	Unicorn-25916.exe	43
PID 2160 wrote to memory of 1792	2160	973e465576184a42ba7359e3b1d4f29d1b562f6a57eede0e781c27ca27483813N.exe	44
PID 2160 wrote to memory of 1792	2160	973e465576184a42ba7359e3b1d4f29d1b562f6a57eede0e781c27ca27483813N.exe	44
PID 2160 wrote to memory of 1792	2160	973e465576184a42ba7359e3b1d4f29d1b562f6a57eede0e781c27ca27483813N.exe	44
PID 2160 wrote to memory of 1792	2160	973e465576184a42ba7359e3b1d4f29d1b562f6a57eede0e781c27ca27483813N.exe	44
PID 764 wrote to memory of 1680	764	Unicorn-33199.exe	45
PID 764 wrote to memory of 1680	764	Unicorn-33199.exe	45
PID 764 wrote to memory of 1680	764	Unicorn-33199.exe	45
PID 764 wrote to memory of 1680	764	Unicorn-33199.exe	45

C:\Users\Admin\AppData\Local\Temp\973e465576184a42ba7359e3b1d4f29d1b562f6a57eede0e781c27ca27483813N.exe
"C:\Users\Admin\AppData\Local\Temp\973e465576184a42ba7359e3b1d4f29d1b562f6a57eede0e781c27ca27483813N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15544.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15544.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19712.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19712.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5404.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33199.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6639.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6722.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16775.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14200.exe
        9⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12153.exe
        9⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55537.exe
        9⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31905.exe
        9⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-448.exe
        8⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25888.exe
        8⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46872.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54265.exe
        8⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13245.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32211.exe
        8⤵
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7732.exe
        8⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12147.exe
        8⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58662.exe
        7⤵
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8070.exe
        7⤵
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11815.exe
        7⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32436.exe
        7⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39804.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22805.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32208.exe
        8⤵
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43130.exe
        9⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21168.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29751.exe
        8⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32801.exe
        8⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27609.exe
        7⤵
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8723.exe
        8⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21499.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        8⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57072.exe
        7⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28881.exe
        7⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10905.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51485.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30724.exe
        7⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49158.exe
        7⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64468.exe
        7⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20385.exe
        7⤵
        
        PID:6680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64527.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63218.exe
        6⤵
        
        PID:3460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15899.exe
        6⤵
        
        PID:5196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32436.exe
        6⤵
        
        PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42004.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7454.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63645.exe
        7⤵
        Executes dropped EXE
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59208.exe
        8⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63108.exe
        8⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18898.exe
        8⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        8⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44927.exe
        7⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-481.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30343.exe
        7⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
        7⤵
        
        PID:6468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29389.exe
        6⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59787.exe
        7⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21499.exe
        7⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        7⤵
        
        PID:6412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58662.exe
        6⤵
        
        PID:3152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48794.exe
        6⤵
        
        PID:4796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4376.exe
        6⤵
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49799.exe
        6⤵
        
        PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46249.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35441.exe
        6⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39992.exe
        7⤵
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39274.exe
        8⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6580.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8144.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60477.exe
        7⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59887.exe
        7⤵
        
        PID:6092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20126.exe
        6⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59787.exe
        7⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52226.exe
        7⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        7⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21879.exe
        6⤵
        
        PID:3856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51354.exe
        6⤵
        
        PID:4180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48618.exe
        6⤵
        
        PID:5500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32436.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28954.exe
        5⤵
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63126.exe
        6⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8723.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58448.exe
        7⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8063.exe
        7⤵
        
        PID:6004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6346.exe
        6⤵
        
        PID:3704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21976.exe
        6⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32436.exe
        6⤵
        
        PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-719.exe
        5⤵
        
        PID:2360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42351.exe
        6⤵
        
        PID:4440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20970.exe
        6⤵
        
        PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2544.exe
        5⤵
        
        PID:3644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-85.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-85.exe
        5⤵
        
        PID:4464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2825.exe
        5⤵
        
        PID:5992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33060.exe
        5⤵
        
        PID:6600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5741.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35996.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17569.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51969.exe
        7⤵
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
        8⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16735.exe
        8⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28350.exe
        8⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
        8⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58502.exe
        7⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11306.exe
        7⤵
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exe
        7⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31905.exe
        7⤵
        
        PID:6532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44356.exe
        6⤵
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26923.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21499.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        7⤵
        
        PID:6372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64007.exe
        6⤵
        
        PID:3272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6346.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21976.exe
        6⤵
        
        PID:5244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32436.exe
        6⤵
        
        PID:6176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48850.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61590.exe
        6⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44927.exe
        7⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-481.exe
        7⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43238.exe
        7⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31905.exe
        7⤵
        
        PID:6324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10863.exe
        6⤵
        
        PID:2072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25888.exe
        6⤵
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42086.exe
        6⤵
        
        PID:1044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5263.exe
        6⤵
        
        PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37.exe
        5⤵
        
        PID:1560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28290.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63108.exe
        6⤵
        
        PID:3944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49625.exe
        6⤵
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64527.exe
        5⤵
        
        PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63218.exe
        5⤵
        
        PID:3480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-147.exe
        5⤵
        
        PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10905.exe
        5⤵
        
        PID:6436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1085.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35851.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-630.exe
        6⤵
        
        PID:684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44927.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-481.exe
        7⤵
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10513.exe
        7⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32434.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
        7⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39342.exe
        6⤵
        
        PID:2252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11306.exe
        6⤵
        
        PID:3976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5839.exe
        6⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
        6⤵
        
        PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37941.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21277.exe
        6⤵
        
        PID:4624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13331.exe
        6⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        6⤵
        
        PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33280.exe
        5⤵
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8070.exe
        5⤵
        
        PID:2412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15899.exe
        5⤵
        
        PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32436.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31502.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38949.exe
        5⤵
        
        PID:1972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13432.exe
        6⤵
        
        PID:1764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7433.exe
        6⤵
        
        PID:3248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54612.exe
        6⤵
        
        PID:4456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37826.exe
        6⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55196.exe
        6⤵
        
        PID:6984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55596.exe
        5⤵
        
        PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25888.exe
        5⤵
        
        PID:3420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11359.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5263.exe
        5⤵
        
        PID:6036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12312.exe
      4⤵
      PID:1820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63126.exe
        5⤵
        
        PID:1708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29637.exe
        6⤵
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41312.exe
        6⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        6⤵
        
        PID:1396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8144.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55023.exe
        5⤵
        
        PID:4732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59887.exe
        5⤵
        
        PID:5860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35522.exe
      4⤵
      PID:2960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19609.exe
      4⤵
      PID:3696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60286.exe
      4⤵
      PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7025.exe
      4⤵
      PID:5984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5324.exe
      4⤵
      PID:7160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16265.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16265.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15300.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7215.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3178.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45747.exe
        7⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49011.exe
        8⤵
        
        PID:1368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24789.exe
        8⤵
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49625.exe
        8⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        8⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27745.exe
        7⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3678.exe
        7⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28881.exe
        7⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10905.exe
        7⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56608.exe
        6⤵
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62166.exe
        7⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8723.exe
        8⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33638.exe
        8⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31905.exe
        8⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8144.exe
        7⤵
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45489.exe
        7⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2205.exe
        7⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31905.exe
        7⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37562.exe
        6⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33903.exe
        7⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22916.exe
        7⤵
        
        PID:6716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27745.exe
        6⤵
        
        PID:3804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28881.exe
        6⤵
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10905.exe
        6⤵
        
        PID:6420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57018.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37963.exe
        6⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15591.exe
        7⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52283.exe
        7⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37373.exe
        7⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        7⤵
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44927.exe
        6⤵
        
        PID:3112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-481.exe
        6⤵
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43238.exe
        6⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31905.exe
        6⤵
        
        PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10151.exe
        5⤵
        
        PID:2292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59208.exe
        6⤵
        
        PID:304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63108.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49625.exe
        6⤵
        
        PID:4944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        6⤵
        
        PID:6316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40469.exe
        5⤵
        
        PID:696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46682.exe
        5⤵
        
        PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4376.exe
        5⤵
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10905.exe
        5⤵
        
        PID:6184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1548.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44019.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42300.exe
        6⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53664.exe
        7⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10664.exe
        7⤵
        
        PID:6700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27034.exe
        6⤵
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11815.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32436.exe
        6⤵
        
        PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28704.exe
        5⤵
        
        PID:2168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59208.exe
        6⤵
        
        PID:1644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63108.exe
        6⤵
        
        PID:3900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49625.exe
        6⤵
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        6⤵
        
        PID:6268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58662.exe
        5⤵
        
        PID:3144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8070.exe
        5⤵
        
        PID:804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7731.exe
        5⤵
        
        PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32436.exe
        5⤵
        
        PID:920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23498.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61590.exe
        5⤵
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31824.exe
        6⤵
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8723.exe
        7⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21499.exe
        7⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        7⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6346.exe
        6⤵
        
        PID:3668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28350.exe
        6⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
        6⤵
        
        PID:5964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16618.exe
        5⤵
        
        PID:1648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1756.exe
        6⤵
        
        PID:2548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12153.exe
        6⤵
        
        PID:1700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5494.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        6⤵
        
        PID:6572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16046.exe
        5⤵
        
        PID:2940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-323.exe
        5⤵
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34734.exe
        5⤵
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9770.exe
        5⤵
        
        PID:6364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16016.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28207.exe
        5⤵
        
        PID:792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27785.exe
        6⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13342.exe
        6⤵
        
        PID:6696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32381.exe
        5⤵
        
        PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22406.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        5⤵
        
        PID:6100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36188.exe
      4⤵
      PID:944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6553.exe
      4⤵
      PID:3484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3224.exe
      4⤵
      PID:2376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10905.exe
      4⤵
      PID:5852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27644.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27644.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19276.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42841.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11870.exe
        6⤵
        
        PID:2612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12153.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5494.exe
        6⤵
        
        PID:4968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13928.exe
        6⤵
        
        PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8341.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31918.exe
        5⤵
        
        PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11359.exe
        5⤵
        
        PID:1816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31905.exe
        5⤵
        
        PID:6540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12669.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41362.exe
        5⤵
        
        PID:1932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59787.exe
        6⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41312.exe
        6⤵
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8144.exe
        5⤵
        
        PID:3772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45489.exe
        5⤵
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8437.exe
        5⤵
        
        PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32436.exe
        5⤵
        
        PID:6396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41262.exe
      4⤵
      PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52003.exe
        5⤵
        
        PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17415.exe
        5⤵
        
        PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47306.exe
        5⤵
        
        PID:6860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27745.exe
      4⤵
      PID:3716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42689.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15899.exe
      4⤵
      PID:5212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32436.exe
      4⤵
      PID:6160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60619.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60619.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28643.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20314.exe
        5⤵
        
        PID:2156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63108.exe
        5⤵
        
        PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49625.exe
        5⤵
        
        PID:5040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        5⤵
        
        PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44927.exe
      4⤵
      PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-481.exe
      4⤵
      PID:4032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32932.exe
      4⤵
      PID:5652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31905.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29826.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29826.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22888.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62249.exe
        5⤵
        
        PID:896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21168.exe
        5⤵
        
        PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32434.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
        5⤵
        
        PID:6524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1735.exe
      4⤵
      PID:112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21168.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19331.exe
        5⤵
        
        PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21499.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37348.exe
      4⤵
      PID:4704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32434.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
      4⤵
      PID:6056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36700.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36700.exe
    3⤵
    PID:1444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52003.exe
      4⤵
      PID:4632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6501.exe
      4⤵
      PID:5284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
      4⤵
      PID:6580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19609.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19609.exe
    3⤵
    PID:3708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21688.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21688.exe
    3⤵
    PID:4124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32741.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32741.exe
    3⤵
    PID:5612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9770.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9770.exe
    3⤵
    PID:6428
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30572.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30572.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36131.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36131.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33775.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60884.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54200.exe
        6⤵
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18368.exe
        6⤵
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35276.exe
        6⤵
        
        PID:4664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60417.exe
        6⤵
        
        PID:6132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34195.exe
        6⤵
        
        PID:6476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62062.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62166.exe
        6⤵
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29637.exe
        7⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21499.exe
        7⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        7⤵
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8144.exe
        6⤵
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45489.exe
        6⤵
        
        PID:3364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43238.exe
        6⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31905.exe
        6⤵
        
        PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33861.exe
        5⤵
        
        PID:2600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20198.exe
        6⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33222.exe
        6⤵
        
        PID:6672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27745.exe
        5⤵
        
        PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42689.exe
        5⤵
        
        PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42541.exe
        5⤵
        
        PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32436.exe
        5⤵
        
        PID:6356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12238.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3370.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61590.exe
        6⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64299.exe
        7⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31753.exe
        7⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39009.exe
        7⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31905.exe
        7⤵
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57070.exe
        6⤵
        
        PID:3400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16735.exe
        6⤵
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32434.exe
        6⤵
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
        6⤵
        
        PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61953.exe
        5⤵
        
        PID:1060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37413.exe
        6⤵
        
        PID:3368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30653.exe
        6⤵
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        6⤵
        
        PID:6556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21879.exe
        5⤵
        
        PID:3840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51812.exe
        5⤵
        
        PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43351.exe
        5⤵
        
        PID:6084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55726.exe
        5⤵
        
        PID:7096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23882.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62166.exe
        5⤵
        
        PID:2524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43534.exe
        6⤵
        
        PID:4852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21499.exe
        6⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        6⤵
        
        PID:5660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21168.exe
        5⤵
        
        PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60477.exe
        5⤵
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29160.exe
        5⤵
        
        PID:5976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38660.exe
        5⤵
        
        PID:6516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61901.exe
      4⤵
      PID:356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64094.exe
        5⤵
        
        PID:4524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        5⤵
        
        PID:5784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19079.exe
      4⤵
      PID:3688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26153.exe
      4⤵
      PID:4132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63691.exe
      4⤵
      PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10905.exe
      4⤵
      PID:6252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13909.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13909.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19276.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61315.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8450.exe
        6⤵
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8723.exe
        7⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58448.exe
        7⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8063.exe
        7⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21879.exe
        6⤵
        
        PID:3680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11815.exe
        6⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32436.exe
        6⤵
        
        PID:5280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37832.exe
        5⤵
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58225.exe
        6⤵
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21499.exe
        6⤵
        
        PID:4216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21879.exe
        5⤵
        
        PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46358.exe
        5⤵
        
        PID:4680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49573.exe
        5⤵
        
        PID:5864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55726.exe
        5⤵
        
        PID:6972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22975.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61455.exe
        5⤵
        
        PID:2868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43534.exe
        6⤵
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21499.exe
        6⤵
        
        PID:5028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12153.exe
        5⤵
        
        PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41457.exe
        5⤵
        
        PID:4432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        5⤵
        
        PID:6380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6124.exe
      4⤵
      PID:860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17171.exe
      4⤵
      PID:3984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38657.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
      4⤵
      PID:6452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54754.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54754.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33861.exe
      4⤵
      PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43534.exe
        5⤵
        
        PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21499.exe
        5⤵
        
        PID:5128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        5⤵
        
        PID:6228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27745.exe
      4⤵
      PID:3820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32965.exe
      4⤵
      PID:5232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10905.exe
      4⤵
      PID:5788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29748.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29748.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45446.exe
      4⤵
      PID:1692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43534.exe
        5⤵
        
        PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48142.exe
        5⤵
        
        PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        5⤵
        
        PID:6460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8144.exe
      4⤵
      PID:3740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45489.exe
      4⤵
      PID:3516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43238.exe
      4⤵
      PID:4500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31905.exe
      4⤵
      PID:5740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53236.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53236.exe
    3⤵
    PID:1868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8723.exe
      4⤵
      PID:4896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2417.exe
      4⤵
      PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
      4⤵
      PID:6308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2544.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2544.exe
    3⤵
    PID:3652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43219.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43219.exe
    3⤵
    PID:4116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38076.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38076.exe
    3⤵
    PID:5604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5570.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5570.exe
    3⤵
    PID:6608
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25916.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25916.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33775.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33775.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27444.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50817.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35441.exe
        6⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20314.exe
        7⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63108.exe
        7⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45541.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41288.exe
        6⤵
        
        PID:1668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11306.exe
        6⤵
        
        PID:3908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24764.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31905.exe
        6⤵
        
        PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23743.exe
        5⤵
        
        PID:288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38041.exe
        6⤵
        
        PID:3452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52283.exe
        6⤵
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27066.exe
        6⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        6⤵
        
        PID:6152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5268.exe
        5⤵
        
        PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6346.exe
        5⤵
        
        PID:3636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28350.exe
        5⤵
        
        PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26675.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28207.exe
        5⤵
        
        PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12153.exe
        5⤵
        
        PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40881.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1226.exe
        5⤵
        
        PID:6504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38989.exe
      4⤵
      PID:1384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31754.exe
      4⤵
      PID:3520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2694.exe
      4⤵
      PID:4980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
      4⤵
      PID:5252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64947.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64947.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32535.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31248.exe
        5⤵
        
        PID:1768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15591.exe
        6⤵
        
        PID:3204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52283.exe
        6⤵
        
        PID:3576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61877.exe
        6⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        6⤵
        
        PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56686.exe
        5⤵
        
        PID:3220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-481.exe
        5⤵
        
        PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41100.exe
        5⤵
        
        PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31905.exe
        5⤵
        
        PID:4728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41916.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43534.exe
        5⤵
        
        PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37228.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        5⤵
        
        PID:5536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21879.exe
      4⤵
      PID:3832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51354.exe
      4⤵
      PID:4156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3846.exe
      4⤵
      PID:4568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12656.exe
      4⤵
      PID:6060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38657.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38657.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25301.exe
      4⤵
      PID:568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8144.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45489.exe
      4⤵
      PID:3380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12511.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25683.exe
      4⤵
      PID:6816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13167.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13167.exe
    3⤵
    PID:1160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18368.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18368.exe
    3⤵
    PID:3232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29822.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29822.exe
    3⤵
    PID:4688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56333.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56333.exe
    3⤵
    PID:5516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64922.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64922.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6652
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33510.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33510.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60884.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60884.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46110.exe
      4⤵
      PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45973.exe
        5⤵
        
        PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21499.exe
        5⤵
        
        PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        5⤵
        
        PID:6444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22974.exe
      4⤵
      PID:3312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6346.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24266.exe
      4⤵
      PID:5744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
      4⤵
      PID:6404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8777.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8777.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57122.exe
      4⤵
      PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43534.exe
        5⤵
        
        PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17415.exe
        5⤵
        
        PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        5⤵
        
        PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6346.exe
      4⤵
      PID:3624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63161.exe
      4⤵
      PID:5336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
      4⤵
      PID:5956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25117.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25117.exe
    3⤵
    PID:1464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20314.exe
      4⤵
      PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63108.exe
      4⤵
      PID:3864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18898.exe
      4⤵
      PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
      4⤵
      PID:6548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20048.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20048.exe
    3⤵
    PID:2588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23088.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23088.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11239.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11239.exe
    3⤵
    PID:4576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32436.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32436.exe
    3⤵
    PID:6340
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23173.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23173.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40655.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40655.exe
    3⤵
    PID:1076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31824.exe
      4⤵
      PID:1164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45119.exe
        5⤵
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49481.exe
        6⤵
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21499.exe
        6⤵
        
        PID:4940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        6⤵
        
        PID:6284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63108.exe
        5⤵
        
        PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49625.exe
        5⤵
        
        PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25253.exe
      4⤵
      PID:668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11306.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11306.exe
      4⤵
      PID:3916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5839.exe
      4⤵
      PID:6116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
      4⤵
      PID:4660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30353.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30353.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43534.exe
      4⤵
      PID:4836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48142.exe
      4⤵
      PID:5680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
      4⤵
      PID:6200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27745.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27745.exe
    3⤵
    PID:3812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35103.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35103.exe
    3⤵
    PID:5032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10905.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10905.exe
    3⤵
    PID:6348
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35849.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35849.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39992.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39992.exe
    3⤵
    PID:2772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57649.exe
      4⤵
      PID:4296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17415.exe
      4⤵
      PID:5456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
      4⤵
      PID:6276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8144.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8144.exe
    3⤵
    PID:3756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55023.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55023.exe
    3⤵
    PID:4608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25076.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25076.exe
    3⤵
    PID:5328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3850.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3850.exe
    3⤵
    PID:6636
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58234.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58234.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1557.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1557.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5900
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63616.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63616.exe
  2⤵
  PID:3672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8723.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8723.exe
    3⤵
    PID:4888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21499.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21499.exe
    3⤵
    PID:5144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
    3⤵
    PID:5760
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16353.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16353.exe
  2⤵
  PID:4108
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41025.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41025.exe
  2⤵
  PID:5400
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47571.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47571.exe
  2⤵
  PID:6616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-27644.exe

Filesize
468KB

MD5
d8892267d2d4dc5ca4beea33ee8f5b69

SHA1
b20335e9ec3f7c26f36946ca1137c6845d523d2a

SHA256
0b112265d066678c85025edaedf1f28ae713c3feaffba83cdbb33d702213dd82

SHA512
5c769b7e4c0ad4f890bfd6691725914129e1a38f48f6dfc4fac10b07ef33ff733392b6eea7629eff5b35e1b3977e63c88ec63130917bb270068546d6b92cffea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30572.exe

Filesize
468KB

MD5
4e128ca28f6b703e16fde1f2eda67812

SHA1
4d99e21ea6db87d1a4a2fd12a7b9c04baf044da3

SHA256
1cd3f14821d253e12d2841c8a2205138791a2903ea3ee1dd1b1d93c1fcb2bb45

SHA512
802d68beee6d81fd4bfe3b3b3cc7dd9d7a6606b02f7efb4ddbf24c5dc68aaee091461bf977089154b264b128da3c0dd1bfaf88db4a66c51bf77d7676ab3a5f54

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36131.exe

Filesize
468KB

MD5
80912e921380df755ec7df91d6945707

SHA1
83c21986a0066c9d74155c4c27d62e008aff673a

SHA256
7584b16ef815441551f1f15027c87d51b0ddf44d73281060c2a4d4cc4d314346

SHA512
f9fd689d41929c6e825a356334337a6bec2b8690aaf190870ab59663ae071667830c8e17cdf3199e3c99c72686d6e790adbf3be98a8571be5bb43f6696d20aa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56686.exe

Filesize
468KB

MD5
35c97fb7ca2660c1bcf415d424b71a7f

SHA1
dddc9e11629e522e4b1a2f4c6b4bb3f30382b69a

SHA256
1ee64589f7c3de8551ef2b41b95917dd3b37c67b45dcfc5f5d2d8e2790c30bfd

SHA512
8f50213bcf3bdffe4ef0bc04e0fade549e96c0d13feb547b502af5a0bdfcc4ba033d74f6ad1eee6da9c44e2cad07e627a00a7df77637c3d6473db747ce630e66

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6639.exe

Filesize
468KB

MD5
f56bb1c8028164f1c73d0fc9ec1a8f93

SHA1
a2f22b10061603ffb7767effe673f6e27652ee20

SHA256
1c697ebb74b0250711d229ed8fc16f8c1cc8dd70a320fd196d6d858a0dda4a60

SHA512
9f8946bf31127a622d20dd5cd42922f76de773abef634f2a695f3d8bc858206e280a68cc7c243bbd61ce01025f2c1cb5a1e17c32248bcbe17cc495482ceea5c7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13909.exe

Filesize
468KB

MD5
0e212fba1e1aa55caf475b79280ad159

SHA1
10fa7f1ea2614a763d2d8e4578f8842929153fa4

SHA256
5ad4798d21dc6c33f739d07d929dad6abc90c1f93364fa9731d140931953e1a6

SHA512
93ff486ae47865d513687cef3ab1a5a1ae7d8b6963e0e211a086bccc0b93aab518921ea33e85051176640b1a12e54546441de0a326d858089ab8d8c780dd8827

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15300.exe

Filesize
468KB

MD5
3d7aed2de9b92c7f2650ebac3241679c

SHA1
c5b8f7b648e16f79b2620088e0200d635f20110c

SHA256
add75ebbe3afbd9403f9e4111bf8898dca2896c0343ef301e5d8a773d2eb4255

SHA512
1e6b46aaf94173f977ad60262387c739c32ce7f22b727e4c8bb37ee8470f959f12e49769561a028c90c0382a77d1a3625f93bfcaa85506b91f4b7701978ef366

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15544.exe

Filesize
468KB

MD5
1a09a5660914f3c18da5839bb67e5363

SHA1
d27d6e73cc97ccaf9189b1e3672c63aa500d2f56

SHA256
b55b3bb0a0c2c192e0d78b90113165f700457943aac859b55fa8b7a59ffdea46

SHA512
9285c0cd51662a5d82c8fa2d28843fd6dc3f95f26c2356b27426dfee366fd19dec9cfe3058825763814d22ad7738f8714b633512249222ec5b6805ad791ccce5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16265.exe

Filesize
468KB

MD5
9c96a07253aabfefddaebe82c5d8208f

SHA1
61b6a3d3564d8b76e1323a7104be3407f2509c9a

SHA256
098cd265b4c6f73b49da3f9d8499bb142639abefce888253a3cf355fbe6a39b2

SHA512
76159017f89146e5386565e5905004f8d060de2e43eab298246b9db64a987d3d44498383ab31802f8f8752d5304fbe1e94a27328353e162364a666001e37f015

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19712.exe

Filesize
468KB

MD5
b442bd075a87c096434e4e627572e106

SHA1
781da0c7bcbffea017b4972e4f848b2473933a02

SHA256
8bb262f435a2f6291bb94ac8ec21b79bceecc51365ee82ab1fa22581b16d13c8

SHA512
e224d114ff8902fa739b273185844c5b412366682619e4d22881657d00befe6e8deda255c7a09b7dcbda3c80f783a188d25a0d3fafecbc5041eb79834d901a89

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25916.exe

Filesize
468KB

MD5
fe1c2f3e1900b568e5024f66a25665ab

SHA1
ee12688944070a55257d363247517df8f80606ed

SHA256
665eed3d4eef77c7b03218e05fa980e40ba3190f18158c7a7813e99b14929595

SHA512
31dd61ebf0c98b836e04b1b2d8d46533104b47712796a436aeda6a08de59ebecb847bec972f8b7cb59b72b47d64e5a1afc7fc339224266ca22b9c0eed1092725

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33199.exe

Filesize
468KB

MD5
79afed41df3774b5d0a40ee1ea164f5d

SHA1
b58f6608639e6cf8259f9169b0309691e81a47b2

SHA256
117f9f3a0ad3eb228cf3c0bef831c470872e4dcd99290e29c4d8e522fa3eab8e

SHA512
76f5a626da68443e45b7443c23f0dd7c964022390ab03ca8751ba386f487a425f8fad0c92c80f8cdfa43234027bcbb545cba3c50a5b8b065d21344a29b8fdb41

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33510.exe

Filesize
468KB

MD5
584112b1a35e994c25aba4747b93dced

SHA1
562a5e4895f496fbc25f92875ce49ec55b62ddb7

SHA256
4d3f8f6049649fefd23a6b5b428139b801deceb00c265ca2e9b0dc0ab0881290

SHA512
2c9c2cecc44d9fe28b7f0b04c45fc493697b02ab144d9552890e0c0237494240a3fbcdc68cdeeb1867082310de97a033b3ec3c3f0abe1f13f3f38bee5b96e2ce

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33775.exe

Filesize
468KB

MD5
7e822bb3bc9c790de5602df774a30f98

SHA1
35dd325d8acab764ab41afc40f515f751cbe4d28

SHA256
dd0beeccb5283b175b07e61e96fe70407cdacd23513b7164ac405ea45c7db17e

SHA512
f53cc004a9a175da9b60423082ae453c057afbea0ac237823ad190e86397ace2c1c7477d44733699ab9e9db0783a48ad477ba39c39a2592505624e6c1dd417b1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-35996.exe

Filesize
468KB

MD5
0bbd881ef9fec479be6e5746e9e0177d

SHA1
f44476956f030affd4b503623565c93011d43a89

SHA256
66ba777f38f79b5fc6ee5bebd641f60a803d743042ab223f1fd31d453eb3a9d7

SHA512
97a688b7eab73c55aef12498ebf9f0aa78c0ff1b85e3d403d53fc3629ea480b7a87fec9f261007bab6de09804478a0758aa4bd7ab6d5f39ae3871bdcff7d8493

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42004.exe

Filesize
468KB

MD5
9ba7a048383669a825114701caba0bf7

SHA1
082085061819501f99f3312fe22c98203a0470d6

SHA256
eb9968eb2b86ff2942294039f4ff5257c37bfefc9b3b77cb009efd702ca3ecc2

SHA512
8b2663850414c840ca546282e2e966581ba655ab45d45e92064491479e0abe27c7e525dec0b36c1d91400ffcbb609dcbd09c22c23949d8e0a636f6c00faa43ef

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-5404.exe

Filesize
468KB

MD5
bd02ef586f936628677fcad33145edb3

SHA1
a40abe0563c18f61fb6203f18e67a38d251d8ead

SHA256
9cb25c5ab8cba3df8cec1bbc6c20c8338b7e196fdcf82bd8d0418d7e2122f135

SHA512
5f8f3fda2fcb27f8d274831181c30ad3b3c3ed4cce7a51363183cd56c07bd9fb49c45b9d92775e9eddf5b895fb7d48795912da22b71edcf3fdd09141b30872ff

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-5741.exe

Filesize
468KB

MD5
e743f2e34bed2080e2b0dcf6db328f2c

SHA1
96e6a0d0b2a3f4808eb4906dcfcd3a6e88c58411

SHA256
aec2a9f7a90ad7ae114ae54403a97c39620340a5b531e27307b5ffc828f4ff87

SHA512
9ab8a4d51ac3a54b516bca7445731a9f7c129ea871017b373cc35bf83a811fe910f5665512dbb958ee7a676c9555827a52f056e385a950d11ccb43ac3e28aecb

Download Submit
memory/448-236-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/764-191-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/764-187-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/764-351-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/764-354-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/776-156-0x0000000001E90000-0x0000000001F05000-memory.dmp

Filesize
468KB

Download
memory/776-267-0x0000000001E90000-0x0000000001F05000-memory.dmp

Filesize
468KB

Download
memory/776-79-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/776-155-0x0000000001E90000-0x0000000001F05000-memory.dmp

Filesize
468KB

Download
memory/776-266-0x0000000001E90000-0x0000000001F05000-memory.dmp

Filesize
468KB

Download
memory/892-273-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/940-257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/948-229-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/948-388-0x0000000002820000-0x0000000002895000-memory.dmp

Filesize
468KB

Download
memory/948-387-0x0000000002820000-0x0000000002895000-memory.dmp

Filesize
468KB

Download
memory/1064-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1320-377-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1336-391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1352-216-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1380-157-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1380-254-0x0000000001CD0000-0x0000000001D45000-memory.dmp

Filesize
468KB

Download
memory/1380-256-0x0000000001CD0000-0x0000000001D45000-memory.dmp

Filesize
468KB

Download
memory/1652-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1680-338-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1680-188-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1680-336-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1744-270-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/1744-158-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1744-269-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/1792-287-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/1792-168-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1792-293-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/1856-288-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1856-298-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2024-268-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2052-285-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2120-153-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2120-271-0x0000000002660000-0x00000000026D5000-memory.dmp

Filesize
468KB

Download
memory/2120-272-0x0000000002660000-0x00000000026D5000-memory.dmp

Filesize
468KB

Download
memory/2160-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2160-371-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2160-310-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2160-160-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2160-356-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2160-308-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2160-10-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2160-165-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2160-11-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2192-202-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2192-353-0x0000000002380000-0x00000000023F5000-memory.dmp

Filesize
468KB

Download
memory/2192-352-0x0000000002380000-0x00000000023F5000-memory.dmp

Filesize
468KB

Download
memory/2256-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2280-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2420-389-0x00000000028A0000-0x0000000002915000-memory.dmp

Filesize
468KB

Download
memory/2420-215-0x00000000028A0000-0x0000000002915000-memory.dmp

Filesize
468KB

Download
memory/2420-209-0x00000000028A0000-0x0000000002915000-memory.dmp

Filesize
468KB

Download
memory/2420-106-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2512-312-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2580-90-0x0000000002900000-0x0000000002975000-memory.dmp

Filesize
468KB

Download
memory/2580-368-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/2580-367-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/2580-200-0x0000000002900000-0x0000000002975000-memory.dmp

Filesize
468KB

Download
memory/2580-199-0x0000000002900000-0x0000000002975000-memory.dmp

Filesize
468KB

Download
memory/2580-54-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2712-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2736-283-0x0000000001CE0000-0x0000000001D55000-memory.dmp

Filesize
468KB

Download
memory/2736-139-0x0000000001CE0000-0x0000000001D55000-memory.dmp

Filesize
468KB

Download
memory/2736-35-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2736-284-0x0000000001CE0000-0x0000000001D55000-memory.dmp

Filesize
468KB

Download
memory/2740-355-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2744-245-0x0000000001E70000-0x0000000001EE5000-memory.dmp

Filesize
468KB

Download
memory/2744-244-0x0000000001E70000-0x0000000001EE5000-memory.dmp

Filesize
468KB

Download
memory/2744-71-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2744-119-0x0000000001E70000-0x0000000001EE5000-memory.dmp

Filesize
468KB

Download
memory/2744-118-0x0000000001E70000-0x0000000001EE5000-memory.dmp

Filesize
468KB

Download
memory/2768-225-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/2768-227-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/2792-135-0x0000000001D80000-0x0000000001DF5000-memory.dmp

Filesize
468KB

Download
memory/2792-292-0x0000000001D80000-0x0000000001DF5000-memory.dmp

Filesize
468KB

Download
memory/2792-404-0x0000000001D80000-0x0000000001DF5000-memory.dmp

Filesize
468KB

Download
memory/2792-140-0x0000000001D80000-0x0000000001DF5000-memory.dmp

Filesize
468KB

Download
memory/2792-286-0x0000000001D80000-0x0000000001DF5000-memory.dmp

Filesize
468KB

Download
memory/2792-32-0x0000000001D80000-0x0000000001DF5000-memory.dmp

Filesize
468KB

Download
memory/2792-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2792-386-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2844-309-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2844-154-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2844-69-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2844-307-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2904-339-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2920-313-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2928-234-0x0000000002440000-0x00000000024B5000-memory.dmp

Filesize
468KB

Download
memory/2928-34-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2928-403-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2928-235-0x0000000002440000-0x00000000024B5000-memory.dmp

Filesize
468KB

Download
memory/3060-396-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download