77c8bec69d4175b55d34c411cb4ab1853dcfe150270e0953f191c6fb78f1bec4

Analysis

max time kernel
113s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/10/2024, 08:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77c8bec69d4175b55d34c411cb4ab1853dcfe150270e0953f191c6fb78f1bec4N.exe
Size

468KB
MD5

d26ce3761d7331af2a4718d273611050
SHA1

1c82c43a6a983585817845383b100209cb4bd987
SHA256

77c8bec69d4175b55d34c411cb4ab1853dcfe150270e0953f191c6fb78f1bec4
SHA512

e1978a4710b3c0134cb143067781223f930be5007dc944b47581057428285b313c41a2e467669fdb6cdf86c2dffe45a8c42fe0ac78ef0ef12d20879b3d375485
SSDEEP

3072:Pb03ogpdIW5UtbfjPhzjff8wMYbMPIpCymHexVAW4j5Jo8N6l8lG:PbsohSUt3P5jffe0ln4j3pN6l

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2080	Unicorn-13019.exe
2576	Unicorn-8546.exe
2228	Unicorn-46050.exe
3032	Unicorn-34369.exe
2456	Unicorn-12971.exe
3036	Unicorn-64773.exe
2136	Unicorn-19102.exe
2708	Unicorn-17644.exe
2736	Unicorn-46979.exe
2664	Unicorn-18028.exe
2516	Unicorn-24394.exe
2568	Unicorn-44260.exe
1820	Unicorn-8307.exe
348	Unicorn-8572.exe
1352	Unicorn-2442.exe
2000	Unicorn-54203.exe
1972	Unicorn-8209.exe
1736	Unicorn-53881.exe
2796	Unicorn-792.exe
2876	Unicorn-15282.exe
2196	Unicorn-36833.exe
2816	Unicorn-18961.exe
924	Unicorn-42200.exe
604	Unicorn-25864.exe
380	Unicorn-290.exe
1384	Unicorn-58463.exe
2744	Unicorn-25293.exe
1544	Unicorn-6190.exe
1052	Unicorn-3589.exe
2008	Unicorn-28241.exe
2252	Unicorn-42967.exe
2152	Unicorn-13824.exe
1648	Unicorn-64094.exe
2148	Unicorn-32390.exe
2908	Unicorn-47758.exe
2936	Unicorn-11748.exe
2100	Unicorn-11748.exe
2940	Unicorn-31614.exe
2952	Unicorn-62677.exe
2224	Unicorn-54966.exe
1760	Unicorn-24331.exe
2888	Unicorn-49028.exe
3052	Unicorn-4540.exe
2712	Unicorn-24406.exe
2896	Unicorn-12900.exe
2696	Unicorn-16622.exe
2560	Unicorn-13284.exe
2540	Unicorn-38303.exe
2692	Unicorn-9339.exe
848	Unicorn-15469.exe
384	Unicorn-3716.exe
2004	Unicorn-58318.exe
1748	Unicorn-4478.exe
768	Unicorn-4478.exe
2292	Unicorn-45438.exe
684	Unicorn-20237.exe
1924	Unicorn-56476.exe
1952	Unicorn-27023.exe
2872	Unicorn-55249.exe
2800	Unicorn-110.exe
2672	Unicorn-63801.exe
2256	Unicorn-50760.exe
1300	Unicorn-5088.exe
968	Unicorn-26447.exe

Loads dropped DLL 64 IoCs

pid	Process
2408	77c8bec69d4175b55d34c411cb4ab1853dcfe150270e0953f191c6fb78f1bec4N.exe
2408	77c8bec69d4175b55d34c411cb4ab1853dcfe150270e0953f191c6fb78f1bec4N.exe
2080	Unicorn-13019.exe
2408	77c8bec69d4175b55d34c411cb4ab1853dcfe150270e0953f191c6fb78f1bec4N.exe
2080	Unicorn-13019.exe
2408	77c8bec69d4175b55d34c411cb4ab1853dcfe150270e0953f191c6fb78f1bec4N.exe
2576	Unicorn-8546.exe
2576	Unicorn-8546.exe
2408	77c8bec69d4175b55d34c411cb4ab1853dcfe150270e0953f191c6fb78f1bec4N.exe
2408	77c8bec69d4175b55d34c411cb4ab1853dcfe150270e0953f191c6fb78f1bec4N.exe
2228	Unicorn-46050.exe
2080	Unicorn-13019.exe
2228	Unicorn-46050.exe
2080	Unicorn-13019.exe
3032	Unicorn-34369.exe
2576	Unicorn-8546.exe
3032	Unicorn-34369.exe
2576	Unicorn-8546.exe
2136	Unicorn-19102.exe
2136	Unicorn-19102.exe
2228	Unicorn-46050.exe
2228	Unicorn-46050.exe
3036	Unicorn-64773.exe
3036	Unicorn-64773.exe
2408	77c8bec69d4175b55d34c411cb4ab1853dcfe150270e0953f191c6fb78f1bec4N.exe
2456	Unicorn-12971.exe
2408	77c8bec69d4175b55d34c411cb4ab1853dcfe150270e0953f191c6fb78f1bec4N.exe
2080	Unicorn-13019.exe
2456	Unicorn-12971.exe
2080	Unicorn-13019.exe
2708	Unicorn-17644.exe
2708	Unicorn-17644.exe
3032	Unicorn-34369.exe
3032	Unicorn-34369.exe
2736	Unicorn-46979.exe
2736	Unicorn-46979.exe
2576	Unicorn-8546.exe
2576	Unicorn-8546.exe
2664	Unicorn-18028.exe
2664	Unicorn-18028.exe
2136	Unicorn-19102.exe
2136	Unicorn-19102.exe
2456	Unicorn-12971.exe
2456	Unicorn-12971.exe
1352	Unicorn-2442.exe
1352	Unicorn-2442.exe
1820	Unicorn-8307.exe
1820	Unicorn-8307.exe
2516	Unicorn-24394.exe
2516	Unicorn-24394.exe
2080	Unicorn-13019.exe
2080	Unicorn-13019.exe
2408	77c8bec69d4175b55d34c411cb4ab1853dcfe150270e0953f191c6fb78f1bec4N.exe
2408	77c8bec69d4175b55d34c411cb4ab1853dcfe150270e0953f191c6fb78f1bec4N.exe
3036	Unicorn-64773.exe
3036	Unicorn-64773.exe
2228	Unicorn-46050.exe
2228	Unicorn-46050.exe
2000	Unicorn-54203.exe
2000	Unicorn-54203.exe
2708	Unicorn-17644.exe
2708	Unicorn-17644.exe
1736	Unicorn-53881.exe
1736	Unicorn-53881.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38902.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8051.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9893.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64045.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5384.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20982.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62700.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21634.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21836.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6504.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53730.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54976.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37466.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47758.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15469.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4478.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64845.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55077.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5298.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44926.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36831.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36333.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11716.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54532.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64845.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9479.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19002.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54407.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23962.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38902.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60879.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7121.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27925.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39134.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62055.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54002.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7247.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27113.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60169.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9479.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17051.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31382.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36831.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11630.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54002.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21721.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25504.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27113.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23214.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17644.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27917.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4289.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8197.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62102.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56476.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2408	77c8bec69d4175b55d34c411cb4ab1853dcfe150270e0953f191c6fb78f1bec4N.exe
2080	Unicorn-13019.exe
2576	Unicorn-8546.exe
2228	Unicorn-46050.exe
3032	Unicorn-34369.exe
2456	Unicorn-12971.exe
2136	Unicorn-19102.exe
3036	Unicorn-64773.exe
2708	Unicorn-17644.exe
2736	Unicorn-46979.exe
2664	Unicorn-18028.exe
2568	Unicorn-44260.exe
1352	Unicorn-2442.exe
348	Unicorn-8572.exe
1820	Unicorn-8307.exe
2516	Unicorn-24394.exe
2000	Unicorn-54203.exe
1972	Unicorn-8209.exe
1736	Unicorn-53881.exe
2796	Unicorn-792.exe
2876	Unicorn-15282.exe
2196	Unicorn-36833.exe
2816	Unicorn-18961.exe
924	Unicorn-42200.exe
604	Unicorn-25864.exe
380	Unicorn-290.exe
1384	Unicorn-58463.exe
1544	Unicorn-6190.exe
2744	Unicorn-25293.exe
1052	Unicorn-3589.exe
2008	Unicorn-28241.exe
2252	Unicorn-42967.exe
2152	Unicorn-13824.exe
1648	Unicorn-64094.exe
2148	Unicorn-32390.exe
2908	Unicorn-47758.exe
2100	Unicorn-11748.exe
2936	Unicorn-11748.exe
2952	Unicorn-62677.exe
2940	Unicorn-31614.exe
2224	Unicorn-54966.exe
1760	Unicorn-24331.exe
2888	Unicorn-49028.exe
3052	Unicorn-4540.exe
2712	Unicorn-24406.exe
2896	Unicorn-12900.exe
2696	Unicorn-16622.exe
2560	Unicorn-13284.exe
2540	Unicorn-38303.exe
848	Unicorn-15469.exe
2692	Unicorn-9339.exe
768	Unicorn-4478.exe
384	Unicorn-3716.exe
1748	Unicorn-4478.exe
2004	Unicorn-58318.exe
2292	Unicorn-45438.exe
684	Unicorn-20237.exe
1952	Unicorn-27023.exe
1924	Unicorn-56476.exe
2872	Unicorn-55249.exe
2800	Unicorn-110.exe
2672	Unicorn-63801.exe
2256	Unicorn-50760.exe
968	Unicorn-26447.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2080	2408	77c8bec69d4175b55d34c411cb4ab1853dcfe150270e0953f191c6fb78f1bec4N.exe	28
PID 2408 wrote to memory of 2080	2408	77c8bec69d4175b55d34c411cb4ab1853dcfe150270e0953f191c6fb78f1bec4N.exe	28
PID 2408 wrote to memory of 2080	2408	77c8bec69d4175b55d34c411cb4ab1853dcfe150270e0953f191c6fb78f1bec4N.exe	28
PID 2408 wrote to memory of 2080	2408	77c8bec69d4175b55d34c411cb4ab1853dcfe150270e0953f191c6fb78f1bec4N.exe	28
PID 2080 wrote to memory of 2576	2080	Unicorn-13019.exe	29
PID 2080 wrote to memory of 2576	2080	Unicorn-13019.exe	29
PID 2080 wrote to memory of 2576	2080	Unicorn-13019.exe	29
PID 2080 wrote to memory of 2576	2080	Unicorn-13019.exe	29
PID 2408 wrote to memory of 2228	2408	77c8bec69d4175b55d34c411cb4ab1853dcfe150270e0953f191c6fb78f1bec4N.exe	30
PID 2408 wrote to memory of 2228	2408	77c8bec69d4175b55d34c411cb4ab1853dcfe150270e0953f191c6fb78f1bec4N.exe	30
PID 2408 wrote to memory of 2228	2408	77c8bec69d4175b55d34c411cb4ab1853dcfe150270e0953f191c6fb78f1bec4N.exe	30
PID 2408 wrote to memory of 2228	2408	77c8bec69d4175b55d34c411cb4ab1853dcfe150270e0953f191c6fb78f1bec4N.exe	30
PID 2576 wrote to memory of 3032	2576	Unicorn-8546.exe	31
PID 2576 wrote to memory of 3032	2576	Unicorn-8546.exe	31
PID 2576 wrote to memory of 3032	2576	Unicorn-8546.exe	31
PID 2576 wrote to memory of 3032	2576	Unicorn-8546.exe	31
PID 2408 wrote to memory of 2456	2408	77c8bec69d4175b55d34c411cb4ab1853dcfe150270e0953f191c6fb78f1bec4N.exe	32
PID 2408 wrote to memory of 2456	2408	77c8bec69d4175b55d34c411cb4ab1853dcfe150270e0953f191c6fb78f1bec4N.exe	32
PID 2408 wrote to memory of 2456	2408	77c8bec69d4175b55d34c411cb4ab1853dcfe150270e0953f191c6fb78f1bec4N.exe	32
PID 2408 wrote to memory of 2456	2408	77c8bec69d4175b55d34c411cb4ab1853dcfe150270e0953f191c6fb78f1bec4N.exe	32
PID 2228 wrote to memory of 2136	2228	Unicorn-46050.exe	33
PID 2228 wrote to memory of 2136	2228	Unicorn-46050.exe	33
PID 2228 wrote to memory of 2136	2228	Unicorn-46050.exe	33
PID 2228 wrote to memory of 2136	2228	Unicorn-46050.exe	33
PID 2080 wrote to memory of 3036	2080	Unicorn-13019.exe	34
PID 2080 wrote to memory of 3036	2080	Unicorn-13019.exe	34
PID 2080 wrote to memory of 3036	2080	Unicorn-13019.exe	34
PID 2080 wrote to memory of 3036	2080	Unicorn-13019.exe	34
PID 3032 wrote to memory of 2708	3032	Unicorn-34369.exe	35
PID 3032 wrote to memory of 2708	3032	Unicorn-34369.exe	35
PID 3032 wrote to memory of 2708	3032	Unicorn-34369.exe	35
PID 3032 wrote to memory of 2708	3032	Unicorn-34369.exe	35
PID 2576 wrote to memory of 2736	2576	Unicorn-8546.exe	36
PID 2576 wrote to memory of 2736	2576	Unicorn-8546.exe	36
PID 2576 wrote to memory of 2736	2576	Unicorn-8546.exe	36
PID 2576 wrote to memory of 2736	2576	Unicorn-8546.exe	36
PID 2136 wrote to memory of 2664	2136	Unicorn-19102.exe	37
PID 2136 wrote to memory of 2664	2136	Unicorn-19102.exe	37
PID 2136 wrote to memory of 2664	2136	Unicorn-19102.exe	37
PID 2136 wrote to memory of 2664	2136	Unicorn-19102.exe	37
PID 2228 wrote to memory of 2516	2228	Unicorn-46050.exe	38
PID 2228 wrote to memory of 2516	2228	Unicorn-46050.exe	38
PID 2228 wrote to memory of 2516	2228	Unicorn-46050.exe	38
PID 2228 wrote to memory of 2516	2228	Unicorn-46050.exe	38
PID 3036 wrote to memory of 2568	3036	Unicorn-64773.exe	39
PID 3036 wrote to memory of 2568	3036	Unicorn-64773.exe	39
PID 3036 wrote to memory of 2568	3036	Unicorn-64773.exe	39
PID 3036 wrote to memory of 2568	3036	Unicorn-64773.exe	39
PID 2408 wrote to memory of 1820	2408	77c8bec69d4175b55d34c411cb4ab1853dcfe150270e0953f191c6fb78f1bec4N.exe	40
PID 2408 wrote to memory of 1820	2408	77c8bec69d4175b55d34c411cb4ab1853dcfe150270e0953f191c6fb78f1bec4N.exe	40
PID 2408 wrote to memory of 1820	2408	77c8bec69d4175b55d34c411cb4ab1853dcfe150270e0953f191c6fb78f1bec4N.exe	40
PID 2408 wrote to memory of 1820	2408	77c8bec69d4175b55d34c411cb4ab1853dcfe150270e0953f191c6fb78f1bec4N.exe	40
PID 2456 wrote to memory of 348	2456	Unicorn-12971.exe	41
PID 2456 wrote to memory of 348	2456	Unicorn-12971.exe	41
PID 2456 wrote to memory of 348	2456	Unicorn-12971.exe	41
PID 2456 wrote to memory of 348	2456	Unicorn-12971.exe	41
PID 2080 wrote to memory of 1352	2080	Unicorn-13019.exe	42
PID 2080 wrote to memory of 1352	2080	Unicorn-13019.exe	42
PID 2080 wrote to memory of 1352	2080	Unicorn-13019.exe	42
PID 2080 wrote to memory of 1352	2080	Unicorn-13019.exe	42
PID 2708 wrote to memory of 2000	2708	Unicorn-17644.exe	43
PID 2708 wrote to memory of 2000	2708	Unicorn-17644.exe	43
PID 2708 wrote to memory of 2000	2708	Unicorn-17644.exe	43
PID 2708 wrote to memory of 2000	2708	Unicorn-17644.exe	43

C:\Users\Admin\AppData\Local\Temp\77c8bec69d4175b55d34c411cb4ab1853dcfe150270e0953f191c6fb78f1bec4N.exe
"C:\Users\Admin\AppData\Local\Temp\77c8bec69d4175b55d34c411cb4ab1853dcfe150270e0953f191c6fb78f1bec4N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13019.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13019.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8546.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8546.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34369.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17644.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54203.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28241.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56476.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55830.exe
        9⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40288.exe
        10⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27436.exe
        10⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28675.exe
        9⤵
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45742.exe
        9⤵
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9046.exe
        9⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38902.exe
        9⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32747.exe
        8⤵
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64845.exe
        9⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34806.exe
        9⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12045.exe
        9⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47037.exe
        9⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20982.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38097.exe
        8⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5180.exe
        8⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62700.exe
        8⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27023.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46173.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64845.exe
        9⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34806.exe
        9⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35590.exe
        9⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57910.exe
        9⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38959.exe
        8⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46763.exe
        8⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13547.exe
        8⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37466.exe
        8⤵
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36234.exe
        7⤵
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64845.exe
        8⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34806.exe
        8⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54395.exe
        8⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5974.exe
        8⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20009.exe
        7⤵
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29206.exe
        7⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22712.exe
        7⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17371.exe
        7⤵
        
        PID:6488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42967.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55249.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23205.exe
        8⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27113.exe
        9⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58553.exe
        9⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23962.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41374.exe
        9⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7247.exe
        8⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6751.exe
        8⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21143.exe
        8⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12969.exe
        8⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62487.exe
        7⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20414.exe
        7⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28577.exe
        7⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25539.exe
        7⤵
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-110.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-807.exe
        7⤵
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9074.exe
        7⤵
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36831.exe
        7⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55711.exe
        6⤵
        
        PID:2360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20414.exe
        6⤵
        
        PID:4044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11630.exe
        6⤵
        
        PID:4500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54532.exe
        6⤵
        
        PID:4972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53881.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13824.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63801.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29697.exe
        8⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44980.exe
        8⤵
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48542.exe
        8⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41455.exe
        8⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38372.exe
        8⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8871.exe
        7⤵
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29080.exe
        7⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36333.exe
        7⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37466.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50760.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62753.exe
        7⤵
        
        PID:772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52463.exe
        8⤵
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40898.exe
        8⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62368.exe
        8⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29243.exe
        8⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31751.exe
        7⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6751.exe
        7⤵
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15296.exe
        7⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21836.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27925.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20414.exe
        6⤵
        
        PID:3452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19798.exe
        6⤵
        
        PID:5096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62700.exe
        6⤵
        
        PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32390.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51824.exe
        6⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46547.exe
        7⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9479.exe
        7⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39134.exe
        7⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47583.exe
        7⤵
        
        PID:7156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26681.exe
        6⤵
        
        PID:940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23214.exe
        6⤵
        
        PID:3864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28046.exe
        6⤵
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30004.exe
        6⤵
        
        PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35415.exe
        5⤵
        
        PID:3000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46547.exe
        6⤵
        
        PID:1192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9479.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39134.exe
        6⤵
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62667.exe
        6⤵
        
        PID:6028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47370.exe
        5⤵
        
        PID:408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54193.exe
        5⤵
        
        PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7165.exe
        5⤵
        
        PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27666.exe
        5⤵
        
        PID:6140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46979.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8209.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47758.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27403.exe
        7⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46547.exe
        8⤵
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9479.exe
        8⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39134.exe
        8⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62667.exe
        8⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4289.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23214.exe
        7⤵
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44999.exe
        7⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62170.exe
        7⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16089.exe
        6⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65369.exe
        7⤵
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14754.exe
        7⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49404.exe
        7⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7448.exe
        7⤵
        
        PID:6568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56530.exe
        6⤵
        
        PID:2192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4256.exe
        6⤵
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62556.exe
        6⤵
        
        PID:628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37466.exe
        6⤵
        
        PID:5296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11748.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10490.exe
        6⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27113.exe
        7⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40898.exe
        7⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62368.exe
        7⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29243.exe
        7⤵
        
        PID:6216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51155.exe
        6⤵
        
        PID:1668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46763.exe
        6⤵
        
        PID:4940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33680.exe
        6⤵
        
        PID:6048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38902.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31168.exe
        5⤵
        
        PID:1452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27113.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58553.exe
        6⤵
        
        PID:4336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40852.exe
        6⤵
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62667.exe
        6⤵
        
        PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52390.exe
        5⤵
        
        PID:564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3951.exe
        5⤵
        
        PID:4320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61480.exe
        5⤵
        
        PID:5168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44444.exe
        5⤵
        
        PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-792.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31614.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11258.exe
        6⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19002.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9479.exe
        7⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30965.exe
        7⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62667.exe
        7⤵
        
        PID:6104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4481.exe
        6⤵
        
        PID:2720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23214.exe
        6⤵
        
        PID:3648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36831.exe
        6⤵
        
        PID:4444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31273.exe
        5⤵
        
        PID:1744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35229.exe
        6⤵
        
        PID:1812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9479.exe
        6⤵
        
        PID:3872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39134.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5298.exe
        6⤵
        
        PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39187.exe
        5⤵
        
        PID:1560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29080.exe
        5⤵
        
        PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36333.exe
        5⤵
        
        PID:4104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45634.exe
        5⤵
        
        PID:5436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62677.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-511.exe
        5⤵
        
        PID:340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1575.exe
        6⤵
        
        PID:3060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8197.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48542.exe
        6⤵
        
        PID:4780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41455.exe
        6⤵
        
        PID:4548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38372.exe
        6⤵
        
        PID:6616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46479.exe
        5⤵
        
        PID:2556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22809.exe
        5⤵
        
        PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54407.exe
        5⤵
        
        PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29194.exe
        5⤵
        
        PID:5864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6504.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6630.exe
      4⤵
      PID:1156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21721.exe
        5⤵
        
        PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44980.exe
        5⤵
        
        PID:3580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48542.exe
        5⤵
        
        PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45730.exe
        5⤵
        
        PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51554.exe
        5⤵
        
        PID:6416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55679.exe
      4⤵
      PID:2032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56445.exe
      4⤵
      PID:3524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24741.exe
      4⤵
      PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48446.exe
      4⤵
      PID:5932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16236.exe
      4⤵
      PID:6640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64773.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44260.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4540.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9639.exe
        6⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7247.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64312.exe
        7⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21143.exe
        7⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62170.exe
        7⤵
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40059.exe
        6⤵
        
        PID:1800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23214.exe
        6⤵
        
        PID:3916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36831.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        6⤵
        
        PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44926.exe
        5⤵
        
        PID:2604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60169.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50577.exe
        6⤵
        
        PID:4504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
        6⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5298.exe
        6⤵
        
        PID:1272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64211.exe
        5⤵
        
        PID:2772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20414.exe
        5⤵
        
        PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11630.exe
        5⤵
        
        PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54532.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6190.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38303.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52390.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64845.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34806.exe
        7⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35590.exe
        7⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34488.exe
        7⤵
        
        PID:6404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22809.exe
        6⤵
        
        PID:3788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36333.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37466.exe
        6⤵
        
        PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64045.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19799.exe
        5⤵
        
        PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21765.exe
        5⤵
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53703.exe
        5⤵
        
        PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7978.exe
        5⤵
        
        PID:6540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9339.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59691.exe
        5⤵
        
        PID:1772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28322.exe
        6⤵
        
        PID:2584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9479.exe
        6⤵
        
        PID:3632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39134.exe
        6⤵
        
        PID:4148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62667.exe
        6⤵
        
        PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40635.exe
        5⤵
        
        PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23214.exe
        5⤵
        
        PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36831.exe
        5⤵
        
        PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62170.exe
        5⤵
        
        PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37034.exe
      4⤵
      PID:2352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28322.exe
        5⤵
        
        PID:2392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9479.exe
        5⤵
        
        PID:3824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39134.exe
        5⤵
        
        PID:4204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5298.exe
        5⤵
        
        PID:5676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10538.exe
      4⤵
      PID:2164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3879.exe
      4⤵
      PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28696.exe
      4⤵
      PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57505.exe
      4⤵
      PID:5244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2442.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2442.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42200.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24406.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21155.exe
        6⤵
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27113.exe
        7⤵
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40898.exe
        7⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55077.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        7⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1845.exe
        6⤵
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54438.exe
        6⤵
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46604.exe
        6⤵
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12708.exe
        6⤵
        
        PID:6288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8051.exe
        5⤵
        
        PID:2928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64845.exe
        6⤵
        
        PID:3676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30965.exe
        6⤵
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62667.exe
        6⤵
        
        PID:6084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20982.exe
        5⤵
        
        PID:3236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12616.exe
        5⤵
        
        PID:4272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46220.exe
        5⤵
        
        PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42365.exe
        5⤵
        
        PID:6008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12900.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1471.exe
        5⤵
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7247.exe
        6⤵
        
        PID:3136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45742.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46260.exe
        6⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50510.exe
        6⤵
        
        PID:6172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58508.exe
        5⤵
        
        PID:3028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23214.exe
        5⤵
        
        PID:4004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36831.exe
        5⤵
        
        PID:4140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62170.exe
        5⤵
        
        PID:2300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44926.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25504.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31382.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36831.exe
        5⤵
        
        PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        5⤵
        
        PID:5748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46282.exe
      4⤵
      PID:920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20414.exe
      4⤵
      PID:3480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11630.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62700.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15469.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16516.exe
        5⤵
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56815.exe
        6⤵
        
        PID:4168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60879.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41172.exe
        6⤵
        
        PID:6664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63656.exe
        5⤵
        
        PID:3540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6751.exe
        5⤵
        
        PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23464.exe
        5⤵
        
        PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21836.exe
        5⤵
        
        PID:6392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22498.exe
      4⤵
      PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64845.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30965.exe
        5⤵
        
        PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62667.exe
        5⤵
        
        PID:6100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28675.exe
      4⤵
      PID:3816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45742.exe
      4⤵
      PID:4656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5647.exe
      4⤵
      PID:5824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38902.exe
      4⤵
      PID:6332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3716.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3716.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
      4⤵
      PID:2468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64845.exe
        5⤵
        
        PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34806.exe
        5⤵
        
        PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35590.exe
        5⤵
        
        PID:4220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57910.exe
        5⤵
        
        PID:6880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51155.exe
      4⤵
      PID:1780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63928.exe
      4⤵
      PID:3608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29194.exe
      4⤵
      PID:5912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30023.exe
      4⤵
      PID:6464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3473.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3473.exe
    3⤵
    PID:2724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64845.exe
      4⤵
      PID:3716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34806.exe
      4⤵
      PID:4856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12045.exe
      4⤵
      PID:5988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44063.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44063.exe
    3⤵
    PID:2524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48487.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48487.exe
    3⤵
    PID:4360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11716.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11716.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31866.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31866.exe
    3⤵
    PID:5996
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46050.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46050.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19102.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19102.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18028.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15282.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64094.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5088.exe
        7⤵
        Executes dropped EXE
        
        PID:1300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21721.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4393.exe
        9⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9479.exe
        9⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39134.exe
        9⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5298.exe
        9⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15363.exe
        8⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23214.exe
        8⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36831.exe
        8⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62170.exe
        8⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9255.exe
        7⤵
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29080.exe
        7⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36333.exe
        7⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61971.exe
        7⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26447.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24295.exe
        7⤵
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28812.exe
        8⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31920.exe
        8⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6064.exe
        7⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15900.exe
        7⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62368.exe
        7⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29243.exe
        7⤵
        
        PID:6152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29731.exe
        6⤵
        
        PID:620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25665.exe
        6⤵
        
        PID:3944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13100.exe
        6⤵
        
        PID:5084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45335.exe
        6⤵
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29774.exe
        6⤵
        
        PID:6044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11748.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42971.exe
        6⤵
        
        PID:640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12976.exe
        7⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23214.exe
        7⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29194.exe
        7⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26167.exe
        6⤵
        
        PID:2340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58715.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28165.exe
        6⤵
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37466.exe
        6⤵
        
        PID:5348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4360.exe
        5⤵
        
        PID:1792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25930.exe
        6⤵
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2165.exe
        6⤵
        
        PID:3564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49404.exe
        6⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37909.exe
        6⤵
        
        PID:6312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5218.exe
        5⤵
        
        PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61128.exe
        5⤵
        
        PID:3560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15826.exe
        5⤵
        
        PID:5868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17371.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36833.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54966.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64761.exe
        6⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25504.exe
        7⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50107.exe
        7⤵
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48542.exe
        7⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45730.exe
        7⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54976.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26681.exe
        6⤵
        
        PID:2384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23214.exe
        6⤵
        
        PID:3908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36831.exe
        6⤵
        
        PID:4416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        6⤵
        
        PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64631.exe
        5⤵
        
        PID:2144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29121.exe
        6⤵
        
        PID:1692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23214.exe
        6⤵
        
        PID:3896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36831.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        6⤵
        
        PID:5784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51662.exe
        5⤵
        
        PID:716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44819.exe
        5⤵
        
        PID:3736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45742.exe
        5⤵
        
        PID:4668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9046.exe
        5⤵
        
        PID:5964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38902.exe
        5⤵
        
        PID:6584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24331.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2239.exe
        5⤵
        
        PID:320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19941.exe
        6⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24721.exe
        7⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14754.exe
        7⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64671.exe
        7⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7448.exe
        7⤵
        
        PID:6536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7247.exe
        6⤵
        
        PID:3128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46763.exe
        6⤵
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53703.exe
        6⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7978.exe
        6⤵
        
        PID:6564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10163.exe
        5⤵
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11160.exe
        6⤵
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58553.exe
        6⤵
        
        PID:4328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62667.exe
        6⤵
        
        PID:1324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20982.exe
        5⤵
        
        PID:3212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12616.exe
        5⤵
        
        PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22182.exe
        5⤵
        
        PID:5856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21836.exe
        5⤵
        
        PID:6356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18694.exe
      4⤵
      PID:592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57491.exe
        5⤵
        
        PID:2732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9479.exe
        5⤵
        
        PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30965.exe
        5⤵
        
        PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5298.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37616.exe
      4⤵
      PID:1148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10537.exe
      4⤵
      PID:2076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17051.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27666.exe
      4⤵
      PID:4224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-290.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30998.exe
        5⤵
        
        PID:2624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27113.exe
        6⤵
        
        PID:3384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54407.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25581.exe
        6⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21836.exe
        6⤵
        
        PID:6576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42010.exe
        5⤵
        
        PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32186.exe
        5⤵
        
        PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53511.exe
        5⤵
        
        PID:5380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4602.exe
        5⤵
        
        PID:5236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58318.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13360.exe
        5⤵
        
        PID:2804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23214.exe
        5⤵
        
        PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36831.exe
        5⤵
        
        PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62170.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25813.exe
      4⤵
      PID:1920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64580.exe
      4⤵
      PID:3508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45742.exe
      4⤵
      PID:4676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9046.exe
      4⤵
      PID:5940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38902.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3589.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3589.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4478.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63085.exe
        5⤵
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41444.exe
        6⤵
        
        PID:4748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
        6⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49340.exe
        6⤵
        
        PID:6176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7247.exe
        5⤵
        
        PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6751.exe
        5⤵
        
        PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46717.exe
        5⤵
        
        PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        5⤵
        
        PID:5704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26307.exe
      4⤵
      PID:1928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51802.exe
        5⤵
        
        PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
        5⤵
        
        PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-654.exe
        5⤵
        
        PID:6476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52695.exe
      4⤵
      PID:3472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12616.exe
      4⤵
      PID:4264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7121.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38902.exe
      4⤵
      PID:6600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45438.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45438.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13500.exe
      4⤵
      PID:1128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16499.exe
        5⤵
        
        PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26431.exe
        5⤵
        
        PID:5560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32043.exe
        5⤵
        
        PID:6280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7247.exe
      4⤵
      PID:3160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6751.exe
      4⤵
      PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15296.exe
      4⤵
      PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21836.exe
      4⤵
      PID:6524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11970.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11970.exe
    3⤵
    PID:2464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64845.exe
      4⤵
      PID:3668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30965.exe
      4⤵
      PID:4768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62667.exe
      4⤵
      PID:6088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1647.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1647.exe
    3⤵
    PID:3144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4481.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4481.exe
    3⤵
    PID:4252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57014.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57014.exe
    3⤵
    PID:956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35834.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35834.exe
    3⤵
    PID:5356
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12971.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12971.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8572.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8572.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18961.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18961.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21786.exe
      4⤵
      PID:1152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27113.exe
        5⤵
        
        PID:3312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40898.exe
        5⤵
        
        PID:4884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46909.exe
        5⤵
        
        PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29243.exe
        5⤵
        
        PID:6224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26848.exe
      4⤵
      PID:3180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3951.exe
      4⤵
      PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21516.exe
      4⤵
      PID:4196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54532.exe
      4⤵
      PID:1396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49028.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49028.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27403.exe
      4⤵
      PID:2520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19002.exe
        5⤵
        
        PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9479.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30965.exe
        5⤵
        
        PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21634.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4481.exe
      4⤵
      PID:2620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27113.exe
        5⤵
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48573.exe
        5⤵
        
        PID:5028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55269.exe
        5⤵
        
        PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29243.exe
        5⤵
        
        PID:6208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20982.exe
      4⤵
      PID:3168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12616.exe
      4⤵
      PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38051.exe
      4⤵
      PID:2028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37466.exe
      4⤵
      PID:1096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11377.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11377.exe
    3⤵
    PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27113.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58553.exe
      4⤵
      PID:4304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23962.exe
      4⤵
      PID:5876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38372.exe
      4⤵
      PID:6624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53730.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53730.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44592.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44592.exe
    3⤵
    PID:3612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13008.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13008.exe
    3⤵
    PID:5136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57505.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57505.exe
    3⤵
    PID:5252
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8307.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8307.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25864.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25864.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16622.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27917.exe
        5⤵
        
        PID:2336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51223.exe
        6⤵
        
        PID:4032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34806.exe
        6⤵
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35590.exe
        6⤵
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47037.exe
        6⤵
        
        PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7247.exe
        5⤵
        
        PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6751.exe
        5⤵
        
        PID:4296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29194.exe
        5⤵
        
        PID:5976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4028.exe
      4⤵
      PID:2564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62055.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28177.exe
      4⤵
      PID:3768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29206.exe
      4⤵
      PID:4572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22712.exe
      4⤵
      PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17371.exe
      4⤵
      PID:6380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13284.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13284.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27917.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34290.exe
        5⤵
        
        PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34806.exe
        5⤵
        
        PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35590.exe
        5⤵
        
        PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47037.exe
        5⤵
        
        PID:6656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7247.exe
      4⤵
      PID:3228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6751.exe
      4⤵
      PID:4420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23464.exe
      4⤵
      PID:5812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21836.exe
      4⤵
      PID:6608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9893.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9893.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15995.exe
      4⤵
      PID:7108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16999.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16999.exe
    3⤵
    PID:3924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62102.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62102.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47134.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47134.exe
    3⤵
    PID:5612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8243.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8243.exe
    3⤵
    PID:6296
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25293.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25293.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4478.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4478.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45851.exe
      4⤵
      PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15607.exe
        5⤵
        
        PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23214.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36831.exe
        5⤵
        
        PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        5⤵
        
        PID:5388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6406.exe
      4⤵
      PID:2184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4252.exe
      4⤵
      PID:3548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36831.exe
      4⤵
      PID:4376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
      4⤵
      PID:5216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8051.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8051.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64845.exe
      4⤵
      PID:3692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34806.exe
      4⤵
      PID:4816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35590.exe
      4⤵
      PID:5176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47037.exe
      4⤵
      PID:6684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20982.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20982.exe
    3⤵
    PID:3252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4640.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4640.exe
    3⤵
    PID:4480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21715.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21715.exe
    3⤵
    PID:5312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37466.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37466.exe
    3⤵
    PID:5232
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20237.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20237.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5384.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5384.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23214.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23214.exe
    3⤵
    PID:3992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44999.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44999.exe
    3⤵
    PID:4132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
    3⤵
    PID:5352
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64768.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64768.exe
  2⤵
  PID:1712
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34914.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34914.exe
  2⤵
  PID:3516
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19406.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19406.exe
  2⤵
  PID:4684
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47.exe
  2⤵
  PID:5816
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54037.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54037.exe
  2⤵
  PID:6364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-18028.exe

Filesize
468KB

MD5
558ff9d378ba838887fd86815b44d7ee

SHA1
7e9835e3a1d111aacb1f7ef3dcd3dd84dc20029f

SHA256
d0e1f9bb975b5488a26d2c11615ae97d15ffd6d3693fd48c70bd12abbf4d909a

SHA512
606bb8ee70f81b294ee89d7673d968fee0702a0a472a95336850c7fd3aefce1ffa0f9a92b551907d0f97b9c0425135beda4cbb0eec898612cd4fe12b733478c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2442.exe

Filesize
468KB

MD5
0290fd3d832f0f4a03b30779e7a1008e

SHA1
ad45168ebf4e3ec6c1005a2ef4fe02ab6ddea7f9

SHA256
57df524594d1c671f97fc30aceac76f414cf7ee795c90b3679c4251e8f9916eb

SHA512
3a27e38fccd54be932c79df011beecaf3f929a4724096248b69066829b89ec23bf77cad04ed0d9bfeaf11ba0ec627b3283e5052f5ab502e0213523f1db80fb97

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34369.exe

Filesize
468KB

MD5
59fb97a9a124fe4227e585b66098adb5

SHA1
9cef423e9beee33249b7e78ba028ca5c5e8a9230

SHA256
e69dfdbaceab9cd835a9a5f26a40f814c464e16affed4bb2d5ef3e7834e07179

SHA512
2cf096ef829f2895e0fbe2504496d9ea0f961234a3e5ca55401c833a6be7330bc9877f3f1ee0831e22edfc9bfb9fb4656046822074a0a8357eb56e69444e101e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46050.exe

Filesize
468KB

MD5
cbd0ad8d3234157a0b2e0dabb3881ebc

SHA1
3cdf21968e28768f6feb17d7b40cd7bf929b47b3

SHA256
ce1a4c75b35a1d2dd21eca75349b19f8fb696e11679e9599d80fc6057dbc14d7

SHA512
ab7d5d0063ef6ebd1157bba85baa76c6a231582003571b88842febcdff7f4234a7852d0164d69f5b437df51da2aa00d2fafd4e88b723d660d1a46ba5fc5f3c09

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50577.exe

Filesize
468KB

MD5
7d555cf6dbf0fe02500b22a31bf4b65c

SHA1
8d49651f22141b2bbaf853560caf9d05ea32c8d9

SHA256
fc43f800e60dce40ff5a8080b17a79c0cb173617014b2262cf211370bd15ce76

SHA512
0e30d969a793c65d5a93d3e80dc8206c762e1fc43aeef8b4bde957b048100b8151078824034f410b5db9635be99ea51ebe6604f24f0bc0da22374103a9bb596a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53881.exe

Filesize
468KB

MD5
24195b0ab73f435b9e917a90eb4d4692

SHA1
d8917856664c0d49acd7845ba4268186e2eb0cee

SHA256
a813b21874d523ea0df76a9a314337d4051d34d47ba9714bf42afc532ab88202

SHA512
f6bc1fb40785a2e88f954385e89767e26141bcc982bfb2410f709f3f3b714787c55bc40089de630013b981fb0ca4ce4304a052b857a667568af0d25e790f6232

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54203.exe

Filesize
468KB

MD5
3beeaa420fd83c7ca524d4f0f1bb400f

SHA1
367a97073b6f0f5097e0c61405f51d9c48ce2ff6

SHA256
0813e2c36dd13229324d18f9709751681653f856cf1b97fee34b29d9ec8ae517

SHA512
7654e88b5f47ff73adc9b1a3f2a613b7fa230965101d6b9e0dd60aa0e1ee5495c6bc8def44035515ae07a9ea27289abd809bcecd3a0fb3832bdc21c7f27250d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64773.exe

Filesize
468KB

MD5
2c792232c8ca14cd0b8a2ca24f277a0a

SHA1
b1cf99c4b86877739fed9ee5855268804f0e068e

SHA256
0bcb5945c28e3efb8aba67169c54faa00d7140cfe3d2d3c70399a24246c67735

SHA512
faba3b979b2e4d38107f61bb26c52b97e60a5302f219db6a9b8c155076e203b4717344c5a6505a44e74737c87d15680d21ca8420b8086a16b565a81f72d36386

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8307.exe

Filesize
468KB

MD5
04bafc74708a06a870ee2c451f76d06d

SHA1
faf4d95a4f23aaaa234fc68fa9f3998ca8fe21c9

SHA256
fbb9a4c9ef751e2e925b59ffa590a9afce18c90b265901b1d33f181e63b42764

SHA512
315b9f29c4d062c045bce7dfa919f8401f332229c3699add580f4e516bc82aca3e6ef5a31d2a1e028664fadaa9c0bdb43bc7ec8ebd008a14ff227be5b5cba3da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8546.exe

Filesize
468KB

MD5
30b3ba7224b6c7881203a76baabb77d0

SHA1
e0644dbf072ac9707bc60f86dbdb49c78305a58d

SHA256
513422302a427dd8c254692479a8d29e3aed62bd69e12895a9fca6996e6e3820

SHA512
d017e4c579012cded765072f3a228b1e60aed68c47835924c039ef3e2c20a84bb5ae1700043336d7123ef20d879a33bb6bc76723ba078b510e49ac6c6009fd43

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12971.exe

Filesize
468KB

MD5
3a18be70b15fb076909db888a3cc1dfc

SHA1
638294cf86e597ce214eaa696ba2dd273a95ba14

SHA256
a4a43d1eb9a346e9619a9c60a036b9899a63a45de46785f15591752be7f51c0e

SHA512
ce3738852a63e04186150c7ffa16fe4d0937e8b4ec85456484b0461cc15cabee330a75889d8ee6090ea9077dbd094742583458184316d34c3f28243afa481f30

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13019.exe

Filesize
468KB

MD5
3bd881e004e9d7c5ff85cfbe1463846b

SHA1
18efaec74c75d6bd6a61b70bcce85a2b62d61073

SHA256
c2c8ba1090ab1a9fbc109599777c145705c50b2da698ffb3353ce7fc1e335147

SHA512
0c966708c339f8070e7f4518ba487b4d492c83b16ac696ae4358fd677a2fda408b4c535d62f7096aa4f2ac986eacd88a299cc101641085b58ead4e79c37072d4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17644.exe

Filesize
468KB

MD5
6150687bdca27cbadd36be0fd24b8695

SHA1
fc4b03937cceea988af5a53a5a94e480ecea5d0f

SHA256
612ac3ce28eb3be361bf86bd4b0b1f919a48da32477e31f6c0bc3fc455991537

SHA512
adb94c9b14ed72e0889bc055f5dff6cf6bcca95f1804cae8cd187c4a2d8038afa20c8cb4317504a4cb0fbd38fc006354b3468a18c1af75ca197d1c07f401f6bf

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19102.exe

Filesize
468KB

MD5
dacb266fa481e7a5ed441fa8ed56e94b

SHA1
8bd69e220af9a3a22c313bd938ab13b95ad363c9

SHA256
7b009f8798db84a08ed6c8a0241170b90b5aa5c3f7895edd907efd81997e8ed1

SHA512
8987b7a3ccc46a2da3dc87f6132c0b2fa45a4f2490be1b952aeb98f7c3e868a7f67acad19e46cb03517d1e8cff9e1ec8a4c0e3172041db08a0466beb5855e1b3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe

Filesize
468KB

MD5
e1d82cdbf2ba03e4ba56d3cff8186403

SHA1
91970bf7b24bc5ea639b409a0f6b8dd2c02bd377

SHA256
9da6c8f8beed338c892980e43c93af9a00b2a54628e386199b0816a0b1d19b07

SHA512
ee83c03a1c70dbbb80c58068cb674efebbf65ac8a6bbe37e5cae29a452e0afe7169b9f1852f25aeff53ef7cdfc1042a1c095cdb8e7475d45f707b51e78e24e2c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-44260.exe

Filesize
468KB

MD5
76abed395e41fd53f8f0466c9f064e35

SHA1
da17eeb3c9d84874f361a72ae8ee7ac23d5ff7d5

SHA256
c7cb85f3762f19ffcb82f90f92c4443fb5d5d3a3346624e58f3ab6aec9c1ab0c

SHA512
22db2566a28bde2d4a8a9969141e8fe756cc0b6fbe43340a892c51d76286f382bac2431fff3b25626c04aeaeaefe38b6966e7cf939591189dd149f3f07e9e246

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46979.exe

Filesize
468KB

MD5
f65fa76e7d70f39fc7e69996d8592078

SHA1
ac956947e362b1be767f2d198ca17cb9f8010faf

SHA256
739e13458996e72883d3adc605a5d42ac5b7be1bd9ca1dec13469740c722ed52

SHA512
0d715445bdd71c736618647bd765bcd811bad1b461ac447af55738eb34889e8e2e429f647e47904a1371c5a93929e1fe6f7093970fc4cfbfe7d20de43d81f7c1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-792.exe

Filesize
468KB

MD5
879a93429741c87ab23895c70b668e5f

SHA1
a2c3bb0e03369d3464606d27af53add804478807

SHA256
66e4c8e08205dddc9f71c79ded5f8ab832c623133f2e994b2106e4e5f5bf0fbf

SHA512
aaa90d1499fb0e3d28564094bab73d2ecd8a27112daa304c42d7853e53162e9a060ca2fd37a759e74a6df4cfe38fce6c54fa7c4795cc676f96a86b963d61f899

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8209.exe

Filesize
468KB

MD5
36313ffb3782a2e41922ab7c0652318c

SHA1
a792bce11dade218859145c602254a9b699841da

SHA256
915f4a1ab997078635579f5cd23b18bea49fd0c87a2ff5bf73020fb17a0f24e4

SHA512
a8ac702c69c8d22fb0f217782427b9c5b00a2f26544426d6153d04536074365339040c25036f87b9b74eb007db79713bf6fb0434b3b7681596ce8828d0c32053

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8572.exe

Filesize
468KB

MD5
9d004bb67159d3cc73feee891c18d767

SHA1
d9442b970efb13438da23a3a86fc57de3f98f039

SHA256
781aec82d0ea39445c065edb7afdd66f182f0f8996cab10a827af4d583390612

SHA512
240d7cf5f771e308fef1819da0676f169f1ed7bdc85044e1dc200cc164a979d2deab10838fc57177ad2aa2714ff7cf186778e5d8de593b9f1741ff3eb2ea2bea

Download Submit