697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892

Analysis

max time kernel
116s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 07:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe
Size

468KB
MD5

c0a5ee69db0e1aa5107ef4e103fd9580
SHA1

0889d723de4929fb993b1f3b2d261627c6a0b58f
SHA256

697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892
SHA512

aa1e3a7680ca026367ff6e892d098022cdc6ad08b98ee3a03842f73c0982e2523be7ebbe04c8bf16eafff288c770ff6bfe225539a02faed822b4a045bedacf83
SSDEEP

3072:pq0RogFdjY8U2bxAPz7Wff5kChgWXpXkmHevVpfn98Cd3XKa4yAlL:pqyoq1U2OPvWff/5un98C96a4y

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2228	Unicorn-56384.exe
2776	Unicorn-5953.exe
2740	Unicorn-43456.exe
2764	Unicorn-232.exe
2600	Unicorn-4871.exe
1996	Unicorn-10630.exe
2568	Unicorn-616.exe
2116	Unicorn-11903.exe
584	Unicorn-51519.exe
1728	Unicorn-55240.exe
1496	Unicorn-38831.exe
996	Unicorn-19230.exe
2948	Unicorn-39096.exe
2456	Unicorn-24797.exe
2336	Unicorn-39226.exe
2012	Unicorn-45977.exe
1860	Unicorn-33170.exe
600	Unicorn-38192.exe
1748	Unicorn-19364.exe
1424	Unicorn-58359.exe
2928	Unicorn-48582.exe
2312	Unicorn-27415.exe
1676	Unicorn-27415.exe
2288	Unicorn-7933.exe
1152	Unicorn-27534.exe
2224	Unicorn-43943.exe
380	Unicorn-21668.exe
2388	Unicorn-35204.exe
2800	Unicorn-35604.exe
2872	Unicorn-33335.exe
2716	Unicorn-6038.exe
2988	Unicorn-53201.exe
2704	Unicorn-53585.exe
2576	Unicorn-48712.exe
2436	Unicorn-19377.exe
1792	Unicorn-5270.exe
2100	Unicorn-4685.exe
1820	Unicorn-28925.exe
1916	Unicorn-42847.exe
2124	Unicorn-62713.exe
576	Unicorn-19604.exe
2340	Unicorn-38702.exe
2852	Unicorn-2692.exe
3064	Unicorn-22558.exe
2332	Unicorn-25355.exe
2144	Unicorn-20756.exe
2016	Unicorn-40622.exe
1732	Unicorn-31883.exe
872	Unicorn-40814.exe
2368	Unicorn-40814.exe
828	Unicorn-59572.exe
1576	Unicorn-25666.exe
1852	Unicorn-19800.exe
264	Unicorn-17763.exe
2148	Unicorn-7289.exe
1596	Unicorn-32755.exe
2376	Unicorn-54114.exe
2700	Unicorn-27083.exe
2596	Unicorn-23745.exe
1572	Unicorn-51696.exe
900	Unicorn-13277.exe
1240	Unicorn-43912.exe
2840	Unicorn-62879.exe
2816	Unicorn-9231.exe

Loads dropped DLL 64 IoCs

pid	Process
2188	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe
2188	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe
2188	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe
2228	Unicorn-56384.exe
2188	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe
2228	Unicorn-56384.exe
2776	Unicorn-5953.exe
2776	Unicorn-5953.exe
2228	Unicorn-56384.exe
2228	Unicorn-56384.exe
2188	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe
2188	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe
2740	Unicorn-43456.exe
2740	Unicorn-43456.exe
2764	Unicorn-232.exe
2764	Unicorn-232.exe
2776	Unicorn-5953.exe
2776	Unicorn-5953.exe
1996	Unicorn-10630.exe
1996	Unicorn-10630.exe
2188	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe
2740	Unicorn-43456.exe
2188	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe
2740	Unicorn-43456.exe
2600	Unicorn-4871.exe
2600	Unicorn-4871.exe
2228	Unicorn-56384.exe
2228	Unicorn-56384.exe
2116	Unicorn-11903.exe
2116	Unicorn-11903.exe
2764	Unicorn-232.exe
2764	Unicorn-232.exe
584	Unicorn-51519.exe
584	Unicorn-51519.exe
2568	Unicorn-616.exe
2568	Unicorn-616.exe
2776	Unicorn-5953.exe
2776	Unicorn-5953.exe
2948	Unicorn-39096.exe
2948	Unicorn-39096.exe
2600	Unicorn-4871.exe
2600	Unicorn-4871.exe
996	Unicorn-19230.exe
1728	Unicorn-55240.exe
996	Unicorn-19230.exe
1728	Unicorn-55240.exe
1996	Unicorn-10630.exe
1496	Unicorn-38831.exe
2228	Unicorn-56384.exe
1996	Unicorn-10630.exe
2740	Unicorn-43456.exe
1496	Unicorn-38831.exe
2228	Unicorn-56384.exe
2740	Unicorn-43456.exe
2188	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe
2188	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe
2336	Unicorn-39226.exe
2336	Unicorn-39226.exe
2116	Unicorn-11903.exe
2116	Unicorn-11903.exe
2012	Unicorn-45977.exe
2012	Unicorn-45977.exe
2764	Unicorn-232.exe
2764	Unicorn-232.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35114.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63224.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48712.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35114.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24797.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39226.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3240.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44817.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60326.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53798.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49325.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56690.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5270.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48204.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22932.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36151.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16972.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19800.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32755.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52633.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54823.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27874.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36752.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56224.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30244.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56224.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56224.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8965.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21802.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52960.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24276.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56224.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21692.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35114.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12684.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29993.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31495.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20506.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63611.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44850.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10714.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53585.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49833.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-300.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2188	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe
2228	Unicorn-56384.exe
2776	Unicorn-5953.exe
2740	Unicorn-43456.exe
2764	Unicorn-232.exe
2600	Unicorn-4871.exe
1996	Unicorn-10630.exe
2568	Unicorn-616.exe
2116	Unicorn-11903.exe
584	Unicorn-51519.exe
996	Unicorn-19230.exe
2948	Unicorn-39096.exe
1728	Unicorn-55240.exe
2456	Unicorn-24797.exe
1496	Unicorn-38831.exe
2336	Unicorn-39226.exe
2012	Unicorn-45977.exe
1860	Unicorn-33170.exe
600	Unicorn-38192.exe
1748	Unicorn-19364.exe
1424	Unicorn-58359.exe
1676	Unicorn-27415.exe
2928	Unicorn-48582.exe
2288	Unicorn-7933.exe
1152	Unicorn-27534.exe
2388	Unicorn-35204.exe
380	Unicorn-21668.exe
2312	Unicorn-27415.exe
2224	Unicorn-43943.exe
2800	Unicorn-35604.exe
2872	Unicorn-33335.exe
2716	Unicorn-6038.exe
2988	Unicorn-53201.exe
2704	Unicorn-53585.exe
1792	Unicorn-5270.exe
2436	Unicorn-19377.exe
1820	Unicorn-28925.exe
2100	Unicorn-4685.exe
2576	Unicorn-48712.exe
2124	Unicorn-62713.exe
1916	Unicorn-42847.exe
576	Unicorn-19604.exe
3064	Unicorn-22558.exe
2340	Unicorn-38702.exe
828	Unicorn-59572.exe
2332	Unicorn-25355.exe
2852	Unicorn-2692.exe
2144	Unicorn-20756.exe
872	Unicorn-40814.exe
1732	Unicorn-31883.exe
2016	Unicorn-40622.exe
1576	Unicorn-25666.exe
2368	Unicorn-40814.exe
1852	Unicorn-19800.exe
264	Unicorn-17763.exe
2148	Unicorn-7289.exe
1596	Unicorn-32755.exe
2376	Unicorn-54114.exe
2700	Unicorn-27083.exe
2596	Unicorn-23745.exe
1572	Unicorn-51696.exe
900	Unicorn-13277.exe
1240	Unicorn-43912.exe
2840	Unicorn-62879.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2228	2188	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe	30
PID 2188 wrote to memory of 2228	2188	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe	30
PID 2188 wrote to memory of 2228	2188	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe	30
PID 2188 wrote to memory of 2228	2188	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe	30
PID 2188 wrote to memory of 2740	2188	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe	32
PID 2188 wrote to memory of 2740	2188	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe	32
PID 2188 wrote to memory of 2740	2188	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe	32
PID 2188 wrote to memory of 2740	2188	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe	32
PID 2228 wrote to memory of 2776	2228	Unicorn-56384.exe	31
PID 2228 wrote to memory of 2776	2228	Unicorn-56384.exe	31
PID 2228 wrote to memory of 2776	2228	Unicorn-56384.exe	31
PID 2228 wrote to memory of 2776	2228	Unicorn-56384.exe	31
PID 2776 wrote to memory of 2764	2776	Unicorn-5953.exe	33
PID 2776 wrote to memory of 2764	2776	Unicorn-5953.exe	33
PID 2776 wrote to memory of 2764	2776	Unicorn-5953.exe	33
PID 2776 wrote to memory of 2764	2776	Unicorn-5953.exe	33
PID 2228 wrote to memory of 2600	2228	Unicorn-56384.exe	34
PID 2228 wrote to memory of 2600	2228	Unicorn-56384.exe	34
PID 2228 wrote to memory of 2600	2228	Unicorn-56384.exe	34
PID 2228 wrote to memory of 2600	2228	Unicorn-56384.exe	34
PID 2188 wrote to memory of 1996	2188	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe	35
PID 2188 wrote to memory of 1996	2188	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe	35
PID 2188 wrote to memory of 1996	2188	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe	35
PID 2188 wrote to memory of 1996	2188	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe	35
PID 2740 wrote to memory of 2568	2740	Unicorn-43456.exe	36
PID 2740 wrote to memory of 2568	2740	Unicorn-43456.exe	36
PID 2740 wrote to memory of 2568	2740	Unicorn-43456.exe	36
PID 2740 wrote to memory of 2568	2740	Unicorn-43456.exe	36
PID 2764 wrote to memory of 2116	2764	Unicorn-232.exe	37
PID 2764 wrote to memory of 2116	2764	Unicorn-232.exe	37
PID 2764 wrote to memory of 2116	2764	Unicorn-232.exe	37
PID 2764 wrote to memory of 2116	2764	Unicorn-232.exe	37
PID 2776 wrote to memory of 584	2776	Unicorn-5953.exe	38
PID 2776 wrote to memory of 584	2776	Unicorn-5953.exe	38
PID 2776 wrote to memory of 584	2776	Unicorn-5953.exe	38
PID 2776 wrote to memory of 584	2776	Unicorn-5953.exe	38
PID 1996 wrote to memory of 1728	1996	Unicorn-10630.exe	39
PID 1996 wrote to memory of 1728	1996	Unicorn-10630.exe	39
PID 1996 wrote to memory of 1728	1996	Unicorn-10630.exe	39
PID 1996 wrote to memory of 1728	1996	Unicorn-10630.exe	39
PID 2188 wrote to memory of 1496	2188	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe	40
PID 2188 wrote to memory of 1496	2188	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe	40
PID 2188 wrote to memory of 1496	2188	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe	40
PID 2188 wrote to memory of 1496	2188	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe	40
PID 2740 wrote to memory of 996	2740	Unicorn-43456.exe	41
PID 2740 wrote to memory of 996	2740	Unicorn-43456.exe	41
PID 2740 wrote to memory of 996	2740	Unicorn-43456.exe	41
PID 2740 wrote to memory of 996	2740	Unicorn-43456.exe	41
PID 2600 wrote to memory of 2948	2600	Unicorn-4871.exe	42
PID 2600 wrote to memory of 2948	2600	Unicorn-4871.exe	42
PID 2600 wrote to memory of 2948	2600	Unicorn-4871.exe	42
PID 2600 wrote to memory of 2948	2600	Unicorn-4871.exe	42
PID 2228 wrote to memory of 2456	2228	Unicorn-56384.exe	43
PID 2228 wrote to memory of 2456	2228	Unicorn-56384.exe	43
PID 2228 wrote to memory of 2456	2228	Unicorn-56384.exe	43
PID 2228 wrote to memory of 2456	2228	Unicorn-56384.exe	43
PID 2116 wrote to memory of 2336	2116	Unicorn-11903.exe	44
PID 2116 wrote to memory of 2336	2116	Unicorn-11903.exe	44
PID 2116 wrote to memory of 2336	2116	Unicorn-11903.exe	44
PID 2116 wrote to memory of 2336	2116	Unicorn-11903.exe	44
PID 2764 wrote to memory of 2012	2764	Unicorn-232.exe	45
PID 2764 wrote to memory of 2012	2764	Unicorn-232.exe	45
PID 2764 wrote to memory of 2012	2764	Unicorn-232.exe	45
PID 2764 wrote to memory of 2012	2764	Unicorn-232.exe	45

C:\Users\Admin\AppData\Local\Temp\697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe
"C:\Users\Admin\AppData\Local\Temp\697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56384.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56384.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5953.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5953.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-232.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11903.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39226.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35604.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22984.exe
        9⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        9⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29472.exe
        9⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48882.exe
        9⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63076.exe
        9⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36174.exe
        8⤵
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31755.exe
        8⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8965.exe
        8⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19208.exe
        8⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31023.exe
        8⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23745.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2729.exe
        8⤵
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        8⤵
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52960.exe
        8⤵
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36893.exe
        8⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        8⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3252.exe
        7⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59458.exe
        7⤵
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36151.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55336.exe
        7⤵
        
        PID:5700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33335.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51696.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62874.exe
        8⤵
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54063.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38897.exe
        9⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38952.exe
        9⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56224.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42557.exe
        8⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3240.exe
        8⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44817.exe
        8⤵
        
        PID:844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63703.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19573.exe
        7⤵
        
        PID:484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25567.exe
        8⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36752.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11416.exe
        8⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37621.exe
        7⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-300.exe
        7⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34482.exe
        7⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39119.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13277.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34333.exe
        7⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29856.exe
        7⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24569.exe
        7⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47123.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9117.exe
        6⤵
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50793.exe
        6⤵
        
        PID:3992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
        6⤵
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64233.exe
        6⤵
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45977.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53201.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50373.exe
        7⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48204.exe
        8⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59697.exe
        9⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17401.exe
        9⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50359.exe
        9⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12026.exe
        8⤵
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41031.exe
        8⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33951.exe
        8⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31495.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12684.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28338.exe
        7⤵
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12026.exe
        8⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59618.exe
        8⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31495.exe
        8⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12684.exe
        8⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25761.exe
        7⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40979.exe
        7⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42836.exe
        7⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31023.exe
        7⤵
        
        PID:6364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38867.exe
        6⤵
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5687.exe
        7⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        7⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3100.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59477.exe
        7⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        7⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        6⤵
        
        PID:1796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37621.exe
        6⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41333.exe
        6⤵
        
        PID:4656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42636.exe
        6⤵
        
        PID:5500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48089.exe
        6⤵
        
        PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6038.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9231.exe
        6⤵
        Executes dropped EXE
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5142.exe
        7⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54241.exe
        8⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21802.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-922.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31755.exe
        7⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8965.exe
        7⤵
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48561.exe
        7⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56690.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3066.exe
        6⤵
        
        PID:1204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16461.exe
        7⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        7⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52960.exe
        7⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59669.exe
        7⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        7⤵
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10714.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37621.exe
        6⤵
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-300.exe
        6⤵
        
        PID:4996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42636.exe
        6⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48089.exe
        6⤵
        
        PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17518.exe
        5⤵
        
        PID:1528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43461.exe
        6⤵
        
        PID:1784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        6⤵
        
        PID:3116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3100.exe
        6⤵
        
        PID:4956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2300.exe
        6⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        6⤵
        
        PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59419.exe
        5⤵
        
        PID:2492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12420.exe
        5⤵
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41863.exe
        5⤵
        
        PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38171.exe
        5⤵
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21223.exe
        5⤵
        
        PID:6080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51519.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33170.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53585.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43912.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22932.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31674.exe
        9⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21378.exe
        9⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61972.exe
        9⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56224.exe
        9⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11808.exe
        8⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35114.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2300.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        8⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21514.exe
        7⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38412.exe
        8⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6225.exe
        8⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38952.exe
        8⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56224.exe
        8⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37621.exe
        7⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-300.exe
        7⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2673.exe
        7⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48089.exe
        7⤵
        
        PID:6184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62879.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9382.exe
        7⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39857.exe
        7⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47120.exe
        7⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56224.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28140.exe
        6⤵
        
        PID:1888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50330.exe
        6⤵
        
        PID:4156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36151.exe
        6⤵
        
        PID:4772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31023.exe
        6⤵
        
        PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48712.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19621.exe
        6⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9382.exe
        7⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39857.exe
        7⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38952.exe
        7⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6831.exe
        7⤵
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37621.exe
        6⤵
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38287.exe
        6⤵
        
        PID:4620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16355.exe
        6⤵
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58610.exe
        6⤵
        
        PID:6544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63267.exe
        5⤵
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16461.exe
        6⤵
        
        PID:2120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        6⤵
        
        PID:3832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36048.exe
        6⤵
        
        PID:4456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42617.exe
        6⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34425.exe
        6⤵
        
        PID:6592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16579.exe
        5⤵
        
        PID:2320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28955.exe
        5⤵
        
        PID:3312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49301.exe
        5⤵
        
        PID:4988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12951.exe
        5⤵
        
        PID:6108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41952.exe
        5⤵
        
        PID:7052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19364.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4685.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63450.exe
        6⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49133.exe
        7⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55320.exe
        7⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15825.exe
        7⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36006.exe
        7⤵
        
        PID:6952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54156.exe
        6⤵
        
        PID:1876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31755.exe
        6⤵
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8965.exe
        6⤵
        
        PID:4888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19208.exe
        6⤵
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31023.exe
        6⤵
        
        PID:6168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19272.exe
        5⤵
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54063.exe
        6⤵
        
        PID:1292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35114.exe
        6⤵
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2300.exe
        6⤵
        
        PID:5596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        6⤵
        
        PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47933.exe
        5⤵
        
        PID:664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9105.exe
        5⤵
        
        PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36151.exe
        5⤵
        
        PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47167.exe
        5⤵
        
        PID:5412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28925.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20005.exe
        5⤵
        
        PID:1492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34333.exe
        6⤵
        
        PID:3060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53593.exe
        6⤵
        
        PID:3080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44817.exe
        6⤵
        
        PID:4828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        6⤵
        
        PID:5156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55054.exe
        5⤵
        
        PID:1520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53593.exe
        5⤵
        
        PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44817.exe
        5⤵
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        5⤵
        
        PID:5908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35002.exe
      4⤵
      PID:2392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37462.exe
        5⤵
        
        PID:948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3100.exe
        5⤵
        
        PID:4176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38429.exe
        5⤵
        
        PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        5⤵
        
        PID:6072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28908.exe
      4⤵
      PID:1544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe
      4⤵
      PID:4076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20332.exe
      4⤵
      PID:4692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32836.exe
      4⤵
      PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25423.exe
      4⤵
      PID:2164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4871.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4871.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39096.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58359.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62713.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50373.exe
        7⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34197.exe
        8⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3240.exe
        8⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44817.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        8⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64628.exe
        7⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31755.exe
        7⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49998.exe
        7⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59172.exe
        7⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31023.exe
        7⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42074.exe
        6⤵
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54063.exe
        7⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38897.exe
        7⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38952.exe
        7⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56224.exe
        7⤵
        
        PID:6032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63611.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-440.exe
        6⤵
        
        PID:4124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20506.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26558.exe
        6⤵
        
        PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19604.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9532.exe
        6⤵
        
        PID:976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35293.exe
        7⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52960.exe
        7⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33951.exe
        7⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51491.exe
        7⤵
        
        PID:6604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48484.exe
        6⤵
        
        PID:988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31755.exe
        6⤵
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8965.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19208.exe
        6⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31023.exe
        6⤵
        
        PID:6340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38187.exe
        5⤵
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39512.exe
        6⤵
        
        PID:540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        6⤵
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3100.exe
        6⤵
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27874.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        6⤵
        
        PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13782.exe
        5⤵
        
        PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28955.exe
        5⤵
        
        PID:3360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49301.exe
        5⤵
        
        PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19738.exe
        5⤵
        
        PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26558.exe
        5⤵
        
        PID:6192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48582.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40814.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39138.exe
        6⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54063.exe
        7⤵
        
        PID:568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55042.exe
        7⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38952.exe
        7⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56224.exe
        7⤵
        
        PID:5204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51219.exe
        6⤵
        
        PID:3120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60801.exe
        6⤵
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52985.exe
        6⤵
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        6⤵
        
        PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43008.exe
        5⤵
        
        PID:292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54063.exe
        6⤵
        
        PID:1844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55042.exe
        6⤵
        
        PID:4056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38952.exe
        6⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6831.exe
        6⤵
        
        PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47933.exe
        5⤵
        
        PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1129.exe
        5⤵
        
        PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44320.exe
        5⤵
        
        PID:4572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31023.exe
        5⤵
        
        PID:5548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19800.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52859.exe
        5⤵
        
        PID:2888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52960.exe
        5⤵
        
        PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59669.exe
        5⤵
        
        PID:5836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        5⤵
        
        PID:6260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22719.exe
      4⤵
      PID:2256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28955.exe
      4⤵
      PID:3356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21336.exe
      4⤵
      PID:4844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3377.exe
      4⤵
      PID:5400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53275.exe
      4⤵
      PID:6564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24797.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24797.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42847.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44125.exe
        5⤵
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30244.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39748.exe
        6⤵
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38952.exe
        6⤵
        
        PID:1092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56224.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31755.exe
        5⤵
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8965.exe
        5⤵
        
        PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19208.exe
        5⤵
        
        PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31023.exe
        5⤵
        
        PID:5756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39723.exe
      4⤵
      PID:2604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54063.exe
        5⤵
        
        PID:2372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35114.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2300.exe
        5⤵
        
        PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        5⤵
        
        PID:6020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53798.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49833.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19616.exe
      4⤵
      PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64233.exe
      4⤵
      PID:5524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27534.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27534.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25355.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20187.exe
        5⤵
        
        PID:796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        5⤵
        
        PID:3880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52960.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36893.exe
        5⤵
        
        PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        5⤵
        
        PID:6224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41737.exe
      4⤵
      PID:1628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31755.exe
      4⤵
      PID:3108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49998.exe
      4⤵
      PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43905.exe
      4⤵
      PID:5324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31023.exe
      4⤵
      PID:5924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31883.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31883.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48204.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38289.exe
        5⤵
        
        PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54475.exe
        5⤵
        
        PID:5992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-922.exe
        5⤵
        
        PID:6672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31755.exe
      4⤵
      PID:3304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54823.exe
      4⤵
      PID:4584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64827.exe
      4⤵
      PID:5248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14604.exe
      4⤵
      PID:6532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22738.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22738.exe
    3⤵
    PID:1016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46196.exe
      4⤵
      PID:2096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16972.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19129.exe
      4⤵
      PID:5124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
      4⤵
      PID:6348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23491.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23491.exe
    3⤵
    PID:3812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11313.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11313.exe
    3⤵
    PID:4248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58409.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58409.exe
    3⤵
    PID:5916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25423.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25423.exe
    3⤵
    PID:6152
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43456.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43456.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-616.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-616.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38192.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19377.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16440.exe
        6⤵
        
        PID:344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49325.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        7⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3100.exe
        7⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2300.exe
        7⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        7⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29843.exe
        6⤵
        
        PID:1588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31755.exe
        6⤵
        
        PID:3336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8965.exe
        6⤵
        
        PID:4864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19208.exe
        6⤵
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31023.exe
        6⤵
        
        PID:6252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30507.exe
        5⤵
        
        PID:3016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22932.exe
        6⤵
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54063.exe
        7⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35114.exe
        7⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27874.exe
        7⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        7⤵
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34197.exe
        6⤵
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32365.exe
        6⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48561.exe
        6⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56690.exe
        6⤵
        
        PID:6460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51778.exe
        5⤵
        
        PID:2784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3373.exe
        6⤵
        
        PID:6912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50793.exe
        5⤵
        
        PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43859.exe
        5⤵
        
        PID:1904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26558.exe
        5⤵
        
        PID:5496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5270.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58240.exe
        5⤵
        
        PID:2844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9382.exe
        6⤵
        
        PID:628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39857.exe
        6⤵
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38952.exe
        6⤵
        
        PID:1460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56224.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37621.exe
        5⤵
        
        PID:3144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41333.exe
        5⤵
        
        PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27369.exe
        5⤵
        
        PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48089.exe
        5⤵
        
        PID:5384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16174.exe
      4⤵
      PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12026.exe
        5⤵
        
        PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35114.exe
        5⤵
        
        PID:4192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27874.exe
        5⤵
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        5⤵
        
        PID:5144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45133.exe
      4⤵
      PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49441.exe
      4⤵
      PID:4112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44850.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26558.exe
      4⤵
      PID:6160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19230.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19230.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27415.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22558.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47472.exe
        6⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61854.exe
        7⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49678.exe
        7⤵
        
        PID:6552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31755.exe
        6⤵
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48702.exe
        6⤵
        
        PID:620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17416.exe
        6⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60650.exe
        6⤵
        
        PID:6988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43008.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42510.exe
        6⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17048.exe
        6⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50359.exe
        6⤵
        
        PID:6288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37621.exe
        5⤵
        
        PID:3168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-300.exe
        5⤵
        
        PID:4904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2673.exe
        5⤵
        
        PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48089.exe
        5⤵
        
        PID:5760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20756.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31292.exe
        5⤵
        
        PID:1336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35660.exe
        6⤵
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33820.exe
        6⤵
        
        PID:4516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50359.exe
        6⤵
        
        PID:6268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52960.exe
        5⤵
        
        PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20556.exe
        5⤵
        
        PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        5⤵
        
        PID:6324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1809.exe
      4⤵
      PID:1980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37621.exe
      4⤵
      PID:3172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-300.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34276.exe
      4⤵
      PID:5276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48089.exe
      4⤵
      PID:5188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21668.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21668.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40814.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24276.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53593.exe
        5⤵
        
        PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43329.exe
        5⤵
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31023.exe
        5⤵
        
        PID:6052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7591.exe
      4⤵
      PID:2476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31755.exe
      4⤵
      PID:3384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8965.exe
      4⤵
      PID:4916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19208.exe
      4⤵
      PID:5692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31023.exe
      4⤵
      PID:5236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25666.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25666.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23762.exe
      4⤵
      PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60273.exe
        5⤵
        
        PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17048.exe
        5⤵
        
        PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50359.exe
        5⤵
        
        PID:6296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31755.exe
      4⤵
      PID:3280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54823.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64827.exe
      4⤵
      PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14475.exe
      4⤵
      PID:6968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39274.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39274.exe
    3⤵
    PID:1148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62532.exe
      4⤵
      PID:2324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22561.exe
      4⤵
      PID:4328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38952.exe
      4⤵
      PID:5024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56224.exe
      4⤵
      PID:5336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6426.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6426.exe
    3⤵
    PID:3824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32844.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32844.exe
    3⤵
    PID:4304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63745.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63745.exe
    3⤵
    PID:5880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21223.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21223.exe
    3⤵
    PID:6176
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10630.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10630.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55240.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55240.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27415.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32755.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45630.exe
        6⤵
        
        PID:324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3100.exe
        6⤵
        
        PID:4952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45253.exe
        6⤵
        
        PID:6096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        6⤵
        
        PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8489.exe
        5⤵
        
        PID:1436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31755.exe
        5⤵
        
        PID:3252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54823.exe
        5⤵
        
        PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40322.exe
        5⤵
        
        PID:5296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6883.exe
        5⤵
        
        PID:7148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54114.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35755.exe
        5⤵
        
        PID:2380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        5⤵
        
        PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52960.exe
        5⤵
        
        PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59669.exe
        5⤵
        
        PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        5⤵
        
        PID:6240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30008.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37621.exe
      4⤵
      PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41333.exe
      4⤵
      PID:4680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42636.exe
      4⤵
      PID:5480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48089.exe
      4⤵
      PID:5180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7933.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7933.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40622.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48204.exe
        5⤵
        
        PID:1188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54063.exe
        6⤵
        
        PID:1392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38897.exe
        6⤵
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51994.exe
        6⤵
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        6⤵
        
        PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34197.exe
        5⤵
        
        PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3240.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44817.exe
        5⤵
        
        PID:4776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        5⤵
        
        PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60326.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24188.exe
        5⤵
        
        PID:3324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22561.exe
        5⤵
        
        PID:4316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38952.exe
        5⤵
        
        PID:5036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61494.exe
        5⤵
        
        PID:6580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37621.exe
      4⤵
      PID:3296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30119.exe
      4⤵
      PID:4688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57388.exe
      4⤵
      PID:5256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9140.exe
      4⤵
      PID:6960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4426.exe
      4⤵
      PID:2068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
      4⤵
      PID:3872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52960.exe
      4⤵
      PID:4340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33951.exe
      4⤵
      PID:5944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51753.exe
      4⤵
      PID:7068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27322.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27322.exe
    3⤵
    PID:2780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28955.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28955.exe
    3⤵
    PID:4092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24797.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24797.exe
    3⤵
    PID:4664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59702.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59702.exe
    3⤵
    PID:5508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26558.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26558.exe
    3⤵
    PID:5300
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38831.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38831.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43943.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43943.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38702.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22226.exe
        5⤵
        
        PID:2892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54063.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47066.exe
        6⤵
        
        PID:4356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47120.exe
        6⤵
        
        PID:4792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56224.exe
        6⤵
        
        PID:6024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34197.exe
        5⤵
        
        PID:2672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52633.exe
        5⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44817.exe
        5⤵
        
        PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        5⤵
        
        PID:5352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19080.exe
      4⤵
      PID:1228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21692.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22753.exe
        5⤵
        
        PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51994.exe
        5⤵
        
        PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        5⤵
        
        PID:6356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37621.exe
      4⤵
      PID:3272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-300.exe
      4⤵
      PID:4832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2673.exe
      4⤵
      PID:5644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48089.exe
      4⤵
      PID:5736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2692.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2692.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17177.exe
      4⤵
      PID:2688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61349.exe
        5⤵
        
        PID:6320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29856.exe
      4⤵
      PID:1404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32737.exe
      4⤵
      PID:5776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47123.exe
      4⤵
      PID:6640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21326.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21326.exe
    3⤵
    PID:2052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30182.exe
      4⤵
      PID:7088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37621.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37621.exe
    3⤵
    PID:3220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-300.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-300.exe
    3⤵
    PID:4896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42636.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42636.exe
    3⤵
    PID:5540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48089.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48089.exe
    3⤵
    PID:6276
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35204.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35204.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39439.exe
      4⤵
      PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54063.exe
        5⤵
        
        PID:2748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35114.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2300.exe
        5⤵
        
        PID:5604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        5⤵
        
        PID:5820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59195.exe
      4⤵
      PID:2252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52633.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44817.exe
      4⤵
      PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
      4⤵
      PID:5260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28338.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28338.exe
    3⤵
    PID:1012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29993.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17048.exe
      4⤵
      PID:2936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9134.exe
      4⤵
      PID:5704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37621.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37621.exe
    3⤵
    PID:3244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32358.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32358.exe
    3⤵
    PID:4560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24715.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24715.exe
    3⤵
    PID:5164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11083.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11083.exe
    3⤵
    PID:7144
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7289.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7289.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5687.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5687.exe
    3⤵
    PID:1200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
    3⤵
    PID:3468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36048.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36048.exe
    3⤵
    PID:4468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42617.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42617.exe
    3⤵
    PID:5968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2751.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2751.exe
    3⤵
    PID:7060
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5839.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5839.exe
  2⤵
  PID:1244
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7955.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7955.exe
  2⤵
  PID:4084
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14997.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14997.exe
  2⤵
  PID:4736
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62610.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62610.exe
  2⤵
  PID:5464
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63224.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63224.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11903.exe

Filesize
468KB

MD5
53e323141edcb63c4d9cd62f37d7d733

SHA1
c3b21a88e8b136fcbc14b8232d3e4ea63b94ee9c

SHA256
5557783858d1e71cda69d5e759b8ee46e93a7737230d5a287f401eb0c0948be3

SHA512
f100af82c5cb4eef91dde4aa0257a528d2e9e5bb0937bd7f3ee4f4b0e1b8d77415b4e34661c6ee0370fa68947f81caecddaae1101e53cb6d533f4f849708a462

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-232.exe

Filesize
468KB

MD5
9a7a6b35ea1e3999ba8b2756f7f4a070

SHA1
95a3788519d9a685074e5b9fa9adf908bd2caa3f

SHA256
e7893c617d8b4576abb8ffd851377cae3264b47ea5b728bf535c5ea7d04f04aa

SHA512
ebcb03264331bd1f6b0842898a84c1705f4465b4c5970a34b40f9506aabc7c23db418342bfb4c8da752103848fd3956d8f1a5d9c52af72b3c3fa27511e21e9cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38192.exe

Filesize
468KB

MD5
ee84b6ebc3433931a10d9bf18d7888e6

SHA1
b3c287a01fdc28b7941147ecc31575de4a783017

SHA256
224d90bd4f5702e0ac5339da94f76128ab8f6bd7b27b789fd665ad4440f93305

SHA512
ce882964fcdc7922d9493a2b11bf3b032cff2a3cc6371d5e4916d065164c635929340babd188c8d02df236d4f258329e8c0a9867699ba05b53a0e496814d613a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39096.exe

Filesize
468KB

MD5
a7113e1606ca1896f22fe5bacde3f9c2

SHA1
07036f67c885e266a20f2a693443edbcaf774ad3

SHA256
9f230cda1ab46fe3c79c6e1f7e494261fedd0a0cb43ea80c7e09a61d11369c09

SHA512
61b67b0343b9770ee13bacbb8dbbca7e4b7e78194c7f91734e2ea93f94dce832acc9c528e735100c267db9c0c91304721f4e39e7fdef620b1632e710b383d022

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45977.exe

Filesize
468KB

MD5
c6d9e49e39494500e6054276b94cef2b

SHA1
2e88d82dab26799f2dbd475c44e3082632804972

SHA256
e877a791aeb95a6ebc3802988d542f46e4eab49d02becc8e42b414030eb35890

SHA512
6ac63655ce83cf38ce1148693fafd4fd4663b25e614bc2d7f2c3cff23f9aae1c3de1798194e43077f8278ebbe9ee032e01f54b7b4e79f3df6ea81b7170171921

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4871.exe

Filesize
468KB

MD5
43c54050eb04a13d62b7197c9002b51a

SHA1
02c967aea622b435ccd2dda2db404ed95c7df988

SHA256
1d9e17fd7dbd2ac98e05f0889ae9b502efca1bb6f94491a40f4f4e010084cd1a

SHA512
3aab7ab42bcdb0d1d6f9e4f6f0ab8d0cde422ad3547d4b2998fb7238857df1d849f93271f8912b041998057e398970195f1d71df023af7a1f0302eedebe17d29

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56384.exe

Filesize
468KB

MD5
d8af09e69a2bddc5c04244bf02c01574

SHA1
a4f2d3133b86c034806ad8e6886bfda08aba286f

SHA256
bbaf3e06c969d453adf5dac6f521e83e4f03f2c2ad5af549e5ff73c854e6d5bf

SHA512
261f7de5d3f3933a52b62eb9cdb400c236a1ce0921aa91bc2d1834fb2a5ec9480c7d9ae1e92b80acf005f6ab5a0145ca78ca264817a2bd8fa0f5f8e2f68dc876

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5953.exe

Filesize
468KB

MD5
c35df142c58a9a22cbafcde4f748bea8

SHA1
107e85a2288be77a328d0aadd8e6081a7972dfcb

SHA256
7ae3cd31b3e15a7af3e95d4e1ff62b57ec6fc19986e6bfef1a04f86485e637ad

SHA512
1f808dd154ad8e4635d0dafc385ab55b23039d87854b6770dd8a2bda97c5732b804c214f971297324e7ec260a72b736b98be4126a7d8925ac2fe3005ade4707a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-10630.exe

Filesize
468KB

MD5
c40f86a2d5079508fb94dd0387d21835

SHA1
40718220bb8e351700d409c5988755e64926008d

SHA256
5c25a52052f14b7eedc0fc5dc2e642808f9c2d7bfb4072ba6f75cb58d8382b81

SHA512
fe0d2ca51658b3247c82cffd19b16c7dc9a0a04c2e133601909b9e1f7647e2ec84a394369762ff69bbe8bb07516d6ae59722cd66dc35e5470be18f4d1f3fa749

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19230.exe

Filesize
468KB

MD5
cd457d6453ef670a7589cb02d93659fc

SHA1
87c010bf2b25baabd35749cf7bac7d040f514af0

SHA256
413e18e9e649ddb45f92ea799bd9477b6e7356a98297faf4fd3fa6e83fe39cc5

SHA512
fb665db11d981e406260cfa76270ce232437f99c47ed356f9fc4ac46f5bf73f61dec5e41cbef5f477efa48fd917fbaab023619be088cfb5d272f107e330f3cc7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24797.exe

Filesize
468KB

MD5
a67e441ad38c218c8108e34c38d3d70b

SHA1
8a26026b87034c80c42c21443bb54bada1db15e1

SHA256
a4b2a5316dd504eb5c963465b667b1a06351af56263684a1eff35218669d61b6

SHA512
087ac316bfd4107c0b8eff5c2949fdafe1ffef5274f089bad26c716d372ff2189f7bcad7b79edc93493303fe292c7f611647ec42b4ec42b14fe25da5ed2846a0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33170.exe

Filesize
468KB

MD5
b7e3520200d174430c03fdd8e7d4f2b5

SHA1
c1d5e2f9959e63ddec86509893e4f48fa9add7be

SHA256
0e12957b719ff52ab556e5339926b246d0743b7f694052a7298eaadd295ee030

SHA512
5957d16dffcf4e838c3bf6ad5e73ba4eadd0eccae8026e89d80d98250d3b91d6d6e6a811ff324a76a578be2829f4645cf1581e681dd32af08f4b014bef5431c0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38831.exe

Filesize
468KB

MD5
1611841e1dd80624ef730726f3100f36

SHA1
4f2268fc94ee9bb520f27ea8200462bdf05d36a5

SHA256
049421060e40637f3d72d6bf95df3be818427f488e95df2b96bfc37a1be669b4

SHA512
b10f1c0afa735656e245d3f5d3aad41b59ef452634b5b3b2723b6b75aa1e934843110c69d9ed7bf4c07cd3d0b7666f2d2d9053194b1318faae7c8d0fce30ffda

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-39226.exe

Filesize
468KB

MD5
8530c50d6ac9eaead55633fdf3fb3e2e

SHA1
aada08d0f2387d044fbdf559a5d5350c78d17d27

SHA256
5b41f0ee4b987ef172e589207ff6b18c43f9d944b7681731aaa80640a130c77d

SHA512
5a5f488d90e05d8927d23f84107c06f63516e0db1b66bf76485971fb97ddbbfeeb29a97e999f04302db0196e57f78f931dbdcd72891e54f99b249e6b615c2f5d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43456.exe

Filesize
468KB

MD5
3f513d7e5e505a87145377e5872d7c87

SHA1
1484607ae930cb3a94ef7a0a0f6c744b1d52f6ec

SHA256
368ac47620596a823b6c0e49675034730c63e5cc9c12f386f9abb8af35195c1d

SHA512
e499fbfce0624460e12b14d06e958c13c56f968578f7b985e1a30250c1aaebad23f88bd257ef45b7a99c5ecb439cac4861aaa7432df7584ec12b0c5b9cc617c9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51519.exe

Filesize
468KB

MD5
8ea48f68fa94a4f303c6fbcf56271bc2

SHA1
f6e6eb658cbd906b184917080e1d77ec07b73e29

SHA256
30ecd483f5176357bd492ed0373ff1d2c3dab082723a6bb3cb11d013828dc921

SHA512
70b5eb3e41ca082601daae0f61003bae9c191a58c54bb4286f37403c412add6cc5318d18e1fe33825bc50ee38bdce35a4aaad437f227a355f711396f42ffccee

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55240.exe

Filesize
468KB

MD5
25c79981529dcdfecd091e8297e05a62

SHA1
ea73d66440a8bf843c196e26d1ed61d3a292a19b

SHA256
9c7abf4eb2dbcaf42a54bf319962603845dd17bb82f9999fe0e0ba2a5ac41264

SHA512
c1b6eedf7f1d55ec4b7684238e9f20685d544852396de9d834bfb5b8b5ef1eddf9e4eb5d2cb3ffb2bfbd9b4c342ac89a47776274b9f18b24f80624b321b35645

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-616.exe

Filesize
468KB

MD5
5c68ecb9b68bc9f4239f630e2e1ea99d

SHA1
d43c1edb2348c65a40d7a6723bd3fa39ffaefa67

SHA256
81e352b5f2f082b468e724df07e3b051491b0fd4ba15fff37ff7e6f2b4669322

SHA512
33b39bcc0389ec980a6abdf9e9e50d9fe5274167719b75212a3769b2cebeeb2d9baf65e144057f5988d4f4ff541aa99bdcceb3dd2c885eceae14207898d93a13

Download Submit
memory/380-300-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/584-213-0x0000000002470000-0x00000000024E5000-memory.dmp

Filesize
468KB

Download
memory/584-212-0x0000000002470000-0x00000000024E5000-memory.dmp

Filesize
468KB

Download
memory/584-110-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/584-378-0x0000000002470000-0x00000000024E5000-memory.dmp

Filesize
468KB

Download
memory/584-377-0x00000000037B0000-0x0000000003825000-memory.dmp

Filesize
468KB

Download
memory/600-228-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/600-387-0x0000000002D10000-0x0000000002D85000-memory.dmp

Filesize
468KB

Download
memory/600-388-0x0000000002D10000-0x0000000002D85000-memory.dmp

Filesize
468KB

Download
memory/996-263-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/996-261-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/996-152-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1152-297-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1424-257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1496-146-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1496-280-0x0000000002CA0000-0x0000000002D15000-memory.dmp

Filesize
468KB

Download
memory/1496-298-0x0000000002CA0000-0x0000000002D15000-memory.dmp

Filesize
468KB

Download
memory/1676-266-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1728-262-0x00000000024B0000-0x0000000002525000-memory.dmp

Filesize
468KB

Download
memory/1728-265-0x00000000024B0000-0x0000000002525000-memory.dmp

Filesize
468KB

Download
memory/1728-122-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1748-238-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1792-396-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1860-368-0x0000000002D10000-0x0000000002D85000-memory.dmp

Filesize
468KB

Download
memory/1860-367-0x0000000002D10000-0x0000000002D85000-memory.dmp

Filesize
468KB

Download
memory/1860-215-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1996-291-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1996-71-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1996-279-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2012-201-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2012-354-0x0000000002CA0000-0x0000000002D15000-memory.dmp

Filesize
468KB

Download
memory/2012-355-0x0000000002CA0000-0x0000000002D15000-memory.dmp

Filesize
468KB

Download
memory/2116-340-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2116-187-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2116-186-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2116-341-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2188-138-0x00000000024E0000-0x0000000002555000-memory.dmp

Filesize
468KB

Download
memory/2188-302-0x00000000024E0000-0x0000000002555000-memory.dmp

Filesize
468KB

Download
memory/2188-391-0x00000000024E0000-0x0000000002555000-memory.dmp

Filesize
468KB

Download
memory/2188-10-0x00000000024E0000-0x0000000002555000-memory.dmp

Filesize
468KB

Download
memory/2188-12-0x00000000024E0000-0x0000000002555000-memory.dmp

Filesize
468KB

Download
memory/2188-145-0x00000000024E0000-0x0000000002555000-memory.dmp

Filesize
468KB

Download
memory/2188-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2188-306-0x00000000024E0000-0x0000000002555000-memory.dmp

Filesize
468KB

Download
memory/2188-32-0x00000000024E0000-0x0000000002555000-memory.dmp

Filesize
468KB

Download
memory/2188-379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2224-299-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2228-295-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/2228-159-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/2228-165-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/2228-290-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/2228-33-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/2288-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2312-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2336-329-0x00000000026F0000-0x0000000002765000-memory.dmp

Filesize
468KB

Download
memory/2336-328-0x00000000026F0000-0x0000000002765000-memory.dmp

Filesize
468KB

Download
memory/2336-188-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2388-309-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2436-389-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2456-166-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2568-226-0x0000000002C90000-0x0000000002D05000-memory.dmp

Filesize
468KB

Download
memory/2568-227-0x0000000002C90000-0x0000000002D05000-memory.dmp

Filesize
468KB

Download
memory/2568-395-0x0000000002C90000-0x0000000002D05000-memory.dmp

Filesize
468KB

Download
memory/2568-84-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2576-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2600-62-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2600-258-0x0000000002CC0000-0x0000000002D35000-memory.dmp

Filesize
468KB

Download
memory/2600-153-0x0000000002CC0000-0x0000000002D35000-memory.dmp

Filesize
468KB

Download
memory/2600-154-0x0000000002CC0000-0x0000000002D35000-memory.dmp

Filesize
468KB

Download
memory/2600-260-0x0000000002CC0000-0x0000000002D35000-memory.dmp

Filesize
468KB

Download
memory/2704-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2716-353-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2740-292-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/2740-82-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/2740-147-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/2740-35-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2740-296-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/2740-139-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/2764-199-0x0000000000530000-0x00000000005A5000-memory.dmp

Filesize
468KB

Download
memory/2764-200-0x0000000000530000-0x00000000005A5000-memory.dmp

Filesize
468KB

Download
memory/2764-52-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2764-352-0x0000000000530000-0x00000000005A5000-memory.dmp

Filesize
468KB

Download
memory/2764-98-0x0000000000530000-0x00000000005A5000-memory.dmp

Filesize
468KB

Download
memory/2776-237-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/2776-50-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/2776-51-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/2776-236-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/2776-108-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/2776-34-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2800-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2872-350-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2928-259-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2948-249-0x00000000026E0000-0x0000000002755000-memory.dmp

Filesize
468KB

Download
memory/2948-156-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2948-246-0x00000000026E0000-0x0000000002755000-memory.dmp

Filesize
468KB

Download
memory/2988-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download