efa814f9854ed73433eb91833f8b3b4b0b21fa075e5e5bd50b14f2750041a259

Analysis

max time kernel
119s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 00:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

efa814f9854ed73433eb91833f8b3b4b0b21fa075e5e5bd50b14f2750041a259N.exe
Size

468KB
MD5

ed7c3f9fa282565dc359924d66eabd70
SHA1

17fc4d01c5bb103f9fe6109bf0b5e0ee4a69a040
SHA256

efa814f9854ed73433eb91833f8b3b4b0b21fa075e5e5bd50b14f2750041a259
SHA512

932f3a00d59f42b1094737d865a03ff8ecba0e82da9d03c2ab1a9077b9aaab4547959ad487e44d2a23d56d054a26a9909060fbb9e8c1fe5317122903e1179000
SSDEEP

3072:4belogxaIU57tbYjPzcfmbfD/n2DnstH/QmyeQVqEuuKkki3u3ulj:4b4oCc7t8P4fmbfr910uuD73u3

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2128	Unicorn-182.exe
2004	Unicorn-46465.exe
2168	Unicorn-52666.exe
2684	Unicorn-25923.exe
2796	Unicorn-6702.exe
2076	Unicorn-61850.exe
2704	Unicorn-17593.exe
2652	Unicorn-32936.exe
1960	Unicorn-28555.exe
1328	Unicorn-30824.exe
2844	Unicorn-64880.exe
1668	Unicorn-16875.exe
2780	Unicorn-8200.exe
852	Unicorn-27801.exe
1268	Unicorn-28066.exe
2968	Unicorn-27335.exe
672	Unicorn-50625.exe
2356	Unicorn-7712.exe
1140	Unicorn-1216.exe
1276	Unicorn-24720.exe
1684	Unicorn-49286.exe
316	Unicorn-57802.exe
2000	Unicorn-57802.exe
1036	Unicorn-56280.exe
1740	Unicorn-53480.exe
612	Unicorn-62410.exe
2292	Unicorn-41008.exe
1284	Unicorn-2306.exe
1504	Unicorn-2268.exe
2080	Unicorn-1173.exe
3040	Unicorn-42092.exe
880	Unicorn-40291.exe
2496	Unicorn-40556.exe
1588	Unicorn-38287.exe
1052	Unicorn-23535.exe
2508	Unicorn-60566.exe
1944	Unicorn-35704.exe
2740	Unicorn-59828.exe
2728	Unicorn-421.exe
2812	Unicorn-16082.exe
2648	Unicorn-44287.exe
2568	Unicorn-24018.exe
2556	Unicorn-24713.exe
2548	Unicorn-36379.exe
2584	Unicorn-36903.exe
1392	Unicorn-29034.exe
1376	Unicorn-19423.exe
2848	Unicorn-25554.exe
1652	Unicorn-52388.exe
1920	Unicorn-52388.exe
1300	Unicorn-64505.exe
636	Unicorn-55599.exe
1764	Unicorn-43748.exe
1164	Unicorn-23882.exe
2416	Unicorn-13213.exe
2212	Unicorn-11691.exe
2940	Unicorn-22870.exe
1060	Unicorn-33855.exe
2628	Unicorn-1400.exe
540	Unicorn-47072.exe
1728	Unicorn-13251.exe
1700	Unicorn-17576.exe
1916	Unicorn-2588.exe
2032	Unicorn-54763.exe

Loads dropped DLL 64 IoCs

pid	Process
1648	efa814f9854ed73433eb91833f8b3b4b0b21fa075e5e5bd50b14f2750041a259N.exe
1648	efa814f9854ed73433eb91833f8b3b4b0b21fa075e5e5bd50b14f2750041a259N.exe
2128	Unicorn-182.exe
2128	Unicorn-182.exe
1648	efa814f9854ed73433eb91833f8b3b4b0b21fa075e5e5bd50b14f2750041a259N.exe
1648	efa814f9854ed73433eb91833f8b3b4b0b21fa075e5e5bd50b14f2750041a259N.exe
2004	Unicorn-46465.exe
2128	Unicorn-182.exe
2128	Unicorn-182.exe
2004	Unicorn-46465.exe
2168	Unicorn-52666.exe
2168	Unicorn-52666.exe
1648	efa814f9854ed73433eb91833f8b3b4b0b21fa075e5e5bd50b14f2750041a259N.exe
1648	efa814f9854ed73433eb91833f8b3b4b0b21fa075e5e5bd50b14f2750041a259N.exe
2796	Unicorn-6702.exe
2796	Unicorn-6702.exe
2004	Unicorn-46465.exe
2684	Unicorn-25923.exe
2004	Unicorn-46465.exe
2684	Unicorn-25923.exe
2128	Unicorn-182.exe
2128	Unicorn-182.exe
2704	Unicorn-17593.exe
2704	Unicorn-17593.exe
2168	Unicorn-52666.exe
1648	efa814f9854ed73433eb91833f8b3b4b0b21fa075e5e5bd50b14f2750041a259N.exe
2168	Unicorn-52666.exe
1648	efa814f9854ed73433eb91833f8b3b4b0b21fa075e5e5bd50b14f2750041a259N.exe
2076	Unicorn-61850.exe
2076	Unicorn-61850.exe
1960	Unicorn-28555.exe
1960	Unicorn-28555.exe
2004	Unicorn-46465.exe
2844	Unicorn-64880.exe
2844	Unicorn-64880.exe
2004	Unicorn-46465.exe
2128	Unicorn-182.exe
2128	Unicorn-182.exe
1268	Unicorn-28066.exe
1268	Unicorn-28066.exe
2076	Unicorn-61850.exe
2076	Unicorn-61850.exe
2780	Unicorn-8200.exe
2780	Unicorn-8200.exe
852	Unicorn-27801.exe
852	Unicorn-27801.exe
1648	efa814f9854ed73433eb91833f8b3b4b0b21fa075e5e5bd50b14f2750041a259N.exe
2168	Unicorn-52666.exe
1648	efa814f9854ed73433eb91833f8b3b4b0b21fa075e5e5bd50b14f2750041a259N.exe
2168	Unicorn-52666.exe
1668	Unicorn-16875.exe
1668	Unicorn-16875.exe
2796	Unicorn-6702.exe
2796	Unicorn-6702.exe
2704	Unicorn-17593.exe
2704	Unicorn-17593.exe
2968	Unicorn-27335.exe
2968	Unicorn-27335.exe
1960	Unicorn-28555.exe
1960	Unicorn-28555.exe
2356	Unicorn-7712.exe
2356	Unicorn-7712.exe
2004	Unicorn-46465.exe
2004	Unicorn-46465.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57802.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5831.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54998.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6483.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31597.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11691.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46686.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33310.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53480.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40556.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18650.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47216.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27562.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65317.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33679.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49704.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46229.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52410.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55210.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42727.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12785.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28797.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35696.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11756.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24018.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15107.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41474.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-915.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46653.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17146.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40772.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30150.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49486.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7099.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32958.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40772.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7101.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44947.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25013.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14291.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14821.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47072.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13696.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22957.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47183.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3837.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28872.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46465.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8080.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12643.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28797.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14954.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6355.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34592.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49453.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18072.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31696.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1648	efa814f9854ed73433eb91833f8b3b4b0b21fa075e5e5bd50b14f2750041a259N.exe
2128	Unicorn-182.exe
2004	Unicorn-46465.exe
2168	Unicorn-52666.exe
2796	Unicorn-6702.exe
2684	Unicorn-25923.exe
2076	Unicorn-61850.exe
2704	Unicorn-17593.exe
1960	Unicorn-28555.exe
2652	Unicorn-32936.exe
1328	Unicorn-30824.exe
2844	Unicorn-64880.exe
852	Unicorn-27801.exe
1668	Unicorn-16875.exe
1268	Unicorn-28066.exe
2780	Unicorn-8200.exe
2968	Unicorn-27335.exe
2356	Unicorn-7712.exe
672	Unicorn-50625.exe
1140	Unicorn-1216.exe
1276	Unicorn-24720.exe
1684	Unicorn-49286.exe
2000	Unicorn-57802.exe
316	Unicorn-57802.exe
1036	Unicorn-56280.exe
612	Unicorn-62410.exe
1740	Unicorn-53480.exe
2292	Unicorn-41008.exe
1284	Unicorn-2306.exe
1504	Unicorn-2268.exe
2080	Unicorn-1173.exe
3040	Unicorn-42092.exe
880	Unicorn-40291.exe
2496	Unicorn-40556.exe
1588	Unicorn-38287.exe
1052	Unicorn-23535.exe
2508	Unicorn-60566.exe
1944	Unicorn-35704.exe
2728	Unicorn-421.exe
2740	Unicorn-59828.exe
2812	Unicorn-16082.exe
2648	Unicorn-44287.exe
2568	Unicorn-24018.exe
2556	Unicorn-24713.exe
2548	Unicorn-36379.exe
2584	Unicorn-36903.exe
1392	Unicorn-29034.exe
1376	Unicorn-19423.exe
2848	Unicorn-25554.exe
1652	Unicorn-52388.exe
1920	Unicorn-52388.exe
1300	Unicorn-64505.exe
1164	Unicorn-23882.exe
636	Unicorn-55599.exe
1764	Unicorn-43748.exe
2416	Unicorn-13213.exe
2212	Unicorn-11691.exe
2940	Unicorn-22870.exe
2628	Unicorn-1400.exe
1060	Unicorn-33855.exe
540	Unicorn-47072.exe
1728	Unicorn-13251.exe
1700	Unicorn-17576.exe
1916	Unicorn-2588.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2128	1648	efa814f9854ed73433eb91833f8b3b4b0b21fa075e5e5bd50b14f2750041a259N.exe	31
PID 1648 wrote to memory of 2128	1648	efa814f9854ed73433eb91833f8b3b4b0b21fa075e5e5bd50b14f2750041a259N.exe	31
PID 1648 wrote to memory of 2128	1648	efa814f9854ed73433eb91833f8b3b4b0b21fa075e5e5bd50b14f2750041a259N.exe	31
PID 1648 wrote to memory of 2128	1648	efa814f9854ed73433eb91833f8b3b4b0b21fa075e5e5bd50b14f2750041a259N.exe	31
PID 2128 wrote to memory of 2004	2128	Unicorn-182.exe	32
PID 2128 wrote to memory of 2004	2128	Unicorn-182.exe	32
PID 2128 wrote to memory of 2004	2128	Unicorn-182.exe	32
PID 2128 wrote to memory of 2004	2128	Unicorn-182.exe	32
PID 1648 wrote to memory of 2168	1648	efa814f9854ed73433eb91833f8b3b4b0b21fa075e5e5bd50b14f2750041a259N.exe	33
PID 1648 wrote to memory of 2168	1648	efa814f9854ed73433eb91833f8b3b4b0b21fa075e5e5bd50b14f2750041a259N.exe	33
PID 1648 wrote to memory of 2168	1648	efa814f9854ed73433eb91833f8b3b4b0b21fa075e5e5bd50b14f2750041a259N.exe	33
PID 1648 wrote to memory of 2168	1648	efa814f9854ed73433eb91833f8b3b4b0b21fa075e5e5bd50b14f2750041a259N.exe	33
PID 2128 wrote to memory of 2684	2128	Unicorn-182.exe	35
PID 2128 wrote to memory of 2684	2128	Unicorn-182.exe	35
PID 2128 wrote to memory of 2684	2128	Unicorn-182.exe	35
PID 2128 wrote to memory of 2684	2128	Unicorn-182.exe	35
PID 2004 wrote to memory of 2796	2004	Unicorn-46465.exe	34
PID 2004 wrote to memory of 2796	2004	Unicorn-46465.exe	34
PID 2004 wrote to memory of 2796	2004	Unicorn-46465.exe	34
PID 2004 wrote to memory of 2796	2004	Unicorn-46465.exe	34
PID 2168 wrote to memory of 2076	2168	Unicorn-52666.exe	36
PID 2168 wrote to memory of 2076	2168	Unicorn-52666.exe	36
PID 2168 wrote to memory of 2076	2168	Unicorn-52666.exe	36
PID 2168 wrote to memory of 2076	2168	Unicorn-52666.exe	36
PID 1648 wrote to memory of 2704	1648	efa814f9854ed73433eb91833f8b3b4b0b21fa075e5e5bd50b14f2750041a259N.exe	37
PID 1648 wrote to memory of 2704	1648	efa814f9854ed73433eb91833f8b3b4b0b21fa075e5e5bd50b14f2750041a259N.exe	37
PID 1648 wrote to memory of 2704	1648	efa814f9854ed73433eb91833f8b3b4b0b21fa075e5e5bd50b14f2750041a259N.exe	37
PID 1648 wrote to memory of 2704	1648	efa814f9854ed73433eb91833f8b3b4b0b21fa075e5e5bd50b14f2750041a259N.exe	37
PID 2796 wrote to memory of 2652	2796	Unicorn-6702.exe	38
PID 2796 wrote to memory of 2652	2796	Unicorn-6702.exe	38
PID 2796 wrote to memory of 2652	2796	Unicorn-6702.exe	38
PID 2796 wrote to memory of 2652	2796	Unicorn-6702.exe	38
PID 2004 wrote to memory of 1960	2004	Unicorn-46465.exe	39
PID 2004 wrote to memory of 1960	2004	Unicorn-46465.exe	39
PID 2004 wrote to memory of 1960	2004	Unicorn-46465.exe	39
PID 2004 wrote to memory of 1960	2004	Unicorn-46465.exe	39
PID 2684 wrote to memory of 1328	2684	Unicorn-25923.exe	40
PID 2684 wrote to memory of 1328	2684	Unicorn-25923.exe	40
PID 2684 wrote to memory of 1328	2684	Unicorn-25923.exe	40
PID 2684 wrote to memory of 1328	2684	Unicorn-25923.exe	40
PID 2128 wrote to memory of 2844	2128	Unicorn-182.exe	41
PID 2128 wrote to memory of 2844	2128	Unicorn-182.exe	41
PID 2128 wrote to memory of 2844	2128	Unicorn-182.exe	41
PID 2128 wrote to memory of 2844	2128	Unicorn-182.exe	41
PID 2704 wrote to memory of 1668	2704	Unicorn-17593.exe	42
PID 2704 wrote to memory of 1668	2704	Unicorn-17593.exe	42
PID 2704 wrote to memory of 1668	2704	Unicorn-17593.exe	42
PID 2704 wrote to memory of 1668	2704	Unicorn-17593.exe	42
PID 2168 wrote to memory of 2780	2168	Unicorn-52666.exe	43
PID 2168 wrote to memory of 2780	2168	Unicorn-52666.exe	43
PID 2168 wrote to memory of 2780	2168	Unicorn-52666.exe	43
PID 2168 wrote to memory of 2780	2168	Unicorn-52666.exe	43
PID 1648 wrote to memory of 852	1648	efa814f9854ed73433eb91833f8b3b4b0b21fa075e5e5bd50b14f2750041a259N.exe	44
PID 1648 wrote to memory of 852	1648	efa814f9854ed73433eb91833f8b3b4b0b21fa075e5e5bd50b14f2750041a259N.exe	44
PID 1648 wrote to memory of 852	1648	efa814f9854ed73433eb91833f8b3b4b0b21fa075e5e5bd50b14f2750041a259N.exe	44
PID 1648 wrote to memory of 852	1648	efa814f9854ed73433eb91833f8b3b4b0b21fa075e5e5bd50b14f2750041a259N.exe	44
PID 2076 wrote to memory of 1268	2076	Unicorn-61850.exe	45
PID 2076 wrote to memory of 1268	2076	Unicorn-61850.exe	45
PID 2076 wrote to memory of 1268	2076	Unicorn-61850.exe	45
PID 2076 wrote to memory of 1268	2076	Unicorn-61850.exe	45
PID 1960 wrote to memory of 2968	1960	Unicorn-28555.exe	46
PID 1960 wrote to memory of 2968	1960	Unicorn-28555.exe	46
PID 1960 wrote to memory of 2968	1960	Unicorn-28555.exe	46
PID 1960 wrote to memory of 2968	1960	Unicorn-28555.exe	46

C:\Users\Admin\AppData\Local\Temp\efa814f9854ed73433eb91833f8b3b4b0b21fa075e5e5bd50b14f2750041a259N.exe
"C:\Users\Admin\AppData\Local\Temp\efa814f9854ed73433eb91833f8b3b4b0b21fa075e5e5bd50b14f2750041a259N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Users\Admin\AppData\Local\Temp\Unicorn-182.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-182.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46465.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46465.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6702.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32936.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16082.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14298.exe
        7⤵
        
        PID:1352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8080.exe
        8⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59804.exe
        8⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31597.exe
        8⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41474.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25637.exe
        7⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
        7⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1467.exe
        7⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16809.exe
        7⤵
        
        PID:7096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32382.exe
        6⤵
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16039.exe
        7⤵
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50548.exe
        7⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31696.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36684.exe
        6⤵
        
        PID:4088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55487.exe
        6⤵
        
        PID:4852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        6⤵
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
        6⤵
        
        PID:6176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41008.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36903.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46614.exe
        7⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49557.exe
        8⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10405.exe
        8⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45276.exe
        8⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41474.exe
        7⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43951.exe
        7⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7605.exe
        7⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20075.exe
        7⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14422.exe
        7⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26748.exe
        6⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30138.exe
        7⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57572.exe
        7⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34289.exe
        7⤵
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55210.exe
        6⤵
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64687.exe
        6⤵
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43096.exe
        6⤵
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28872.exe
        6⤵
        
        PID:5784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19423.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2831.exe
        6⤵
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
        7⤵
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3837.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31599.exe
        7⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12262.exe
        7⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41474.exe
        6⤵
        
        PID:708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7815.exe
        6⤵
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59632.exe
        6⤵
        
        PID:4864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11806.exe
        6⤵
        
        PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30600.exe
        5⤵
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7451.exe
        6⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
        6⤵
        
        PID:6260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52410.exe
        5⤵
        
        PID:1768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6302.exe
        5⤵
        
        PID:3560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62013.exe
        5⤵
        
        PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60687.exe
        5⤵
        
        PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48884.exe
        5⤵
        
        PID:6504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28555.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27335.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2268.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33855.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54998.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17499.exe
        9⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59342.exe
        9⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64587.exe
        8⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29134.exe
        8⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37562.exe
        8⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31489.exe
        8⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60898.exe
        7⤵
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12785.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7101.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46686.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42727.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47072.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40772.exe
        7⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28312.exe
        7⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19228.exe
        7⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28797.exe
        7⤵
        
        PID:6168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9096.exe
        6⤵
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8080.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16581.exe
        7⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31597.exe
        7⤵
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18650.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65317.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12361.exe
        6⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14821.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1173.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1400.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5498.exe
        7⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40566.exe
        8⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17862.exe
        8⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41474.exe
        7⤵
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61726.exe
        7⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30150.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50976.exe
        7⤵
        
        PID:6404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13936.exe
        6⤵
        
        PID:1344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24141.exe
        7⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19296.exe
        7⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15443.exe
        7⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22957.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55210.exe
        6⤵
        
        PID:3108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64687.exe
        6⤵
        
        PID:4456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56994.exe
        6⤵
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28872.exe
        6⤵
        
        PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13251.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27064.exe
        6⤵
        
        PID:2824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34104.exe
        6⤵
        
        PID:2596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2580.exe
        6⤵
        
        PID:5084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55351.exe
        6⤵
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14291.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13617.exe
        5⤵
        
        PID:2644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
        6⤵
        
        PID:3308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53752.exe
        6⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27813.exe
        6⤵
        
        PID:5132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37007.exe
        6⤵
        
        PID:6052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52410.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24615.exe
        5⤵
        
        PID:3412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62013.exe
        5⤵
        
        PID:840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25685.exe
        5⤵
        
        PID:5296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62886.exe
        5⤵
        
        PID:6816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7712.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42092.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17576.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
        7⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11902.exe
        7⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16270.exe
        7⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6569.exe
        7⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65281.exe
        7⤵
        
        PID:7108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12785.exe
        6⤵
        
        PID:2468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49453.exe
        6⤵
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7101.exe
        6⤵
        
        PID:3476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63932.exe
        6⤵
        
        PID:5876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2588.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6355.exe
        6⤵
        
        PID:2172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41474.exe
        6⤵
        
        PID:968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37859.exe
        6⤵
        
        PID:3824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
        6⤵
        
        PID:1544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46686.exe
        6⤵
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49704.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61075.exe
        5⤵
        
        PID:888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22837.exe
        5⤵
        
        PID:3804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44947.exe
        5⤵
        
        PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62539.exe
        5⤵
        
        PID:5704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53093.exe
        5⤵
        
        PID:6848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40291.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51170.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32906.exe
        6⤵
        
        PID:3836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35300.exe
        6⤵
        
        PID:4800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49486.exe
        6⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49843.exe
        6⤵
        
        PID:6680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55210.exe
        5⤵
        
        PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31503.exe
        5⤵
        
        PID:4160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40161.exe
        5⤵
        
        PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62106.exe
        5⤵
        
        PID:6080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6030.exe
      4⤵
      PID:2204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40772.exe
        5⤵
        
        PID:3984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63315.exe
        5⤵
        
        PID:4708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10238.exe
        5⤵
        
        PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28797.exe
        5⤵
        
        PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7185.exe
      4⤵
      PID:2952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47183.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59801.exe
      4⤵
      PID:4060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37563.exe
      4⤵
      PID:5504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9354.exe
      4⤵
      PID:6388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25923.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25923.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30824.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60566.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26917.exe
        6⤵
        
        PID:544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16909.exe
        7⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11902.exe
        7⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64283.exe
        7⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18002.exe
        7⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65281.exe
        7⤵
        
        PID:7040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12785.exe
        6⤵
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8080.exe
        7⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34370.exe
        7⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31597.exe
        7⤵
        
        PID:6280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49453.exe
        6⤵
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7101.exe
        6⤵
        
        PID:1040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63899.exe
        6⤵
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14954.exe
        6⤵
        
        PID:6412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7294.exe
        5⤵
        
        PID:3020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
        6⤵
        
        PID:3292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53752.exe
        6⤵
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27052.exe
        6⤵
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37463.exe
        6⤵
        
        PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32386.exe
        5⤵
        
        PID:964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46653.exe
        5⤵
        
        PID:1404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-583.exe
        5⤵
        
        PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29427.exe
        5⤵
        
        PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37686.exe
        5⤵
        
        PID:6832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59828.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27727.exe
        5⤵
        
        PID:2544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8080.exe
        6⤵
        
        PID:4556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34370.exe
        6⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10196.exe
        6⤵
        
        PID:6648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12785.exe
        5⤵
        
        PID:1856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19686.exe
        5⤵
        
        PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23931.exe
        5⤵
        
        PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31027.exe
        5⤵
        
        PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65281.exe
        5⤵
        
        PID:7056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8380.exe
      4⤵
      PID:1516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33944.exe
        5⤵
        
        PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30919.exe
        5⤵
        
        PID:5828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10892.exe
      4⤵
      PID:2156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40772.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4854.exe
        5⤵
        
        PID:4960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46686.exe
        5⤵
        
        PID:5060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8109.exe
        5⤵
        
        PID:7068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35874.exe
      4⤵
      PID:1484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23367.exe
      4⤵
      PID:4120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46806.exe
      4⤵
      PID:5016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14475.exe
      4⤵
      PID:5224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29558.exe
      4⤵
      PID:6920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64880.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64880.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50625.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40556.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16497.exe
        6⤵
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49453.exe
        7⤵
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38897.exe
        7⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60022.exe
        7⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29722.exe
        7⤵
        
        PID:6376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55210.exe
        6⤵
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64687.exe
        6⤵
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8478.exe
        6⤵
        
        PID:4736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28872.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15017.exe
        5⤵
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40772.exe
        6⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28312.exe
        6⤵
        
        PID:4652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6483.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28797.exe
        6⤵
        
        PID:6184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26520.exe
        5⤵
        
        PID:1032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25552.exe
        5⤵
        
        PID:3228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15265.exe
        5⤵
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65153.exe
        5⤵
        
        PID:6132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38287.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17146.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6355.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37740.exe
        7⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53752.exe
        7⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27052.exe
        7⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32449.exe
        7⤵
        
        PID:6688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41474.exe
        6⤵
        
        PID:2016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7815.exe
        6⤵
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25013.exe
        6⤵
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11806.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15107.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55210.exe
        5⤵
        
        PID:3140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31503.exe
        5⤵
        
        PID:4240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40161.exe
        5⤵
        
        PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7099.exe
        5⤵
        
        PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60815.exe
        5⤵
        
        PID:7012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52375.exe
      4⤵
      PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
        5⤵
        
        PID:3356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11902.exe
        5⤵
        
        PID:4176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65362.exe
        5⤵
        
        PID:3052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6569.exe
        5⤵
        
        PID:5684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32386.exe
      4⤵
      PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46653.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13696.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47216.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38262.exe
      4⤵
      PID:6908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1216.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1216.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23535.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54763.exe
        5⤵
        Executes dropped EXE
        
        PID:2032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
        6⤵
        
        PID:3284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11902.exe
        6⤵
        
        PID:4184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50889.exe
        6⤵
        
        PID:4956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6569.exe
        6⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65281.exe
        6⤵
        
        PID:7064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12785.exe
        5⤵
        
        PID:1928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49453.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7101.exe
        5⤵
        
        PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46686.exe
        5⤵
        
        PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40615.exe
        5⤵
        
        PID:7160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9547.exe
      4⤵
      PID:1500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28972.exe
        5⤵
        
        PID:1160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8080.exe
        6⤵
        
        PID:4580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16581.exe
        6⤵
        
        PID:5508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31597.exe
        6⤵
        
        PID:6296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35717.exe
        5⤵
        
        PID:4080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1236.exe
        5⤵
        
        PID:1824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55351.exe
        5⤵
        
        PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59263.exe
        5⤵
        
        PID:6924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26520.exe
      4⤵
      PID:2192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55318.exe
      4⤵
      PID:3216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63973.exe
      4⤵
      PID:3464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14857.exe
      4⤵
      PID:5956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21541.exe
      4⤵
      PID:6420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35704.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35704.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13424.exe
      4⤵
      PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40772.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63315.exe
        5⤵
        
        PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10238.exe
        5⤵
        
        PID:5604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28797.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12785.exe
      4⤵
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8080.exe
        5⤵
        
        PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11864.exe
        5⤵
        
        PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31597.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49453.exe
      4⤵
      PID:3868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38897.exe
      4⤵
      PID:948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-474.exe
      4⤵
      PID:6028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42239.exe
      4⤵
      PID:6592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8244.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8244.exe
    3⤵
    PID:1792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34592.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43989.exe
        5⤵
        
        PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50548.exe
        5⤵
        
        PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3274.exe
        5⤵
        
        PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33310.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27562.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53365.exe
      4⤵
      PID:5024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28896.exe
      4⤵
      PID:5612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24250.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24250.exe
    3⤵
    PID:2100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25652.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25652.exe
    3⤵
    PID:3280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe
    3⤵
    PID:2928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24550.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24550.exe
    3⤵
    PID:5280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65136.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65136.exe
    3⤵
    PID:6352
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52666.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52666.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61850.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61850.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28066.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24720.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-421.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8645.exe
        7⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18072.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35784.exe
        8⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2058.exe
        8⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65494.exe
        7⤵
        
        PID:568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49453.exe
        7⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7101.exe
        7⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46686.exe
        7⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40615.exe
        7⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26748.exe
        6⤵
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48545.exe
        7⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50548.exe
        7⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49486.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18348.exe
        7⤵
        
        PID:6468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55210.exe
        6⤵
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64687.exe
        6⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8478.exe
        6⤵
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28872.exe
        6⤵
        
        PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44287.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15609.exe
        6⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40772.exe
        7⤵
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28312.exe
        7⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9662.exe
        7⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28797.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55210.exe
        6⤵
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31503.exe
        6⤵
        
        PID:4152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40161.exe
        6⤵
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
        6⤵
        
        PID:5228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58428.exe
        6⤵
        
        PID:6876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21596.exe
        5⤵
        
        PID:2804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19512.exe
        6⤵
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53038.exe
        6⤵
        
        PID:4280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49486.exe
        6⤵
        
        PID:6124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18348.exe
        6⤵
        
        PID:6528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32386.exe
        5⤵
        
        PID:2008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46653.exe
        5⤵
        
        PID:4068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47437.exe
        5⤵
        
        PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47216.exe
        5⤵
        
        PID:5188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20177.exe
        5⤵
        
        PID:6712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49286.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52388.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46229.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41474.exe
        6⤵
        
        PID:2992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43951.exe
        6⤵
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
        6⤵
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46686.exe
        6⤵
        
        PID:4980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23594.exe
        6⤵
        
        PID:6268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29435.exe
        5⤵
        
        PID:264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24538.exe
        5⤵
        
        PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64687.exe
        5⤵
        
        PID:4464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8478.exe
        5⤵
        
        PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28872.exe
        5⤵
        
        PID:5564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55599.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46614.exe
        5⤵
        
        PID:2880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59652.exe
        6⤵
        
        PID:5996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23050.exe
        6⤵
        
        PID:6384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41474.exe
        5⤵
        
        PID:2532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38819.exe
        5⤵
        
        PID:3852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56697.exe
        5⤵
        
        PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55571.exe
        5⤵
        
        PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16809.exe
        5⤵
        
        PID:7088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46349.exe
      4⤵
      PID:2784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
        5⤵
        
        PID:3324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11902.exe
        5⤵
        
        PID:4168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16270.exe
        5⤵
        
        PID:5036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36610.exe
        5⤵
        
        PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62894.exe
        5⤵
        
        PID:6780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52410.exe
      4⤵
      PID:3156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6302.exe
      4⤵
      PID:3772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35696.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45770.exe
      4⤵
      PID:5728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59681.exe
      4⤵
      PID:7020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8200.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8200.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57802.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13213.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15107.exe
        6⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17977.exe
        7⤵
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50791.exe
        7⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23596.exe
        7⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13892.exe
        7⤵
        
        PID:6936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24538.exe
        6⤵
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64687.exe
        6⤵
        
        PID:4392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8478.exe
        6⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28872.exe
        6⤵
        
        PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-755.exe
        5⤵
        
        PID:1292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40772.exe
        6⤵
        
        PID:4012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28312.exe
        6⤵
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56128.exe
        6⤵
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61934.exe
        6⤵
        
        PID:6752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55210.exe
        5⤵
        
        PID:3148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31503.exe
        5⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40161.exe
        5⤵
        
        PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7099.exe
        5⤵
        
        PID:5492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60815.exe
        5⤵
        
        PID:7028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22870.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46198.exe
        5⤵
        
        PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3115.exe
        5⤵
        
        PID:3512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1950.exe
        5⤵
        
        PID:4472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33679.exe
        5⤵
        
        PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28341.exe
        5⤵
        
        PID:5788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32958.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9370.exe
        5⤵
        
        PID:3548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50548.exe
        5⤵
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49486.exe
        5⤵
        
        PID:6140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1903.exe
        5⤵
        
        PID:6576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60373.exe
      4⤵
      PID:4020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60515.exe
      4⤵
      PID:4696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46819.exe
      4⤵
      PID:5540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
      4⤵
      PID:5484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56280.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56280.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24018.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46229.exe
        5⤵
        
        PID:1724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41474.exe
        5⤵
        
        PID:2304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25637.exe
        5⤵
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
        5⤵
        
        PID:4904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12643.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42151.exe
        5⤵
        
        PID:6840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58382.exe
      4⤵
      PID:2288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24538.exe
      4⤵
      PID:3920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64687.exe
      4⤵
      PID:4376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43096.exe
      4⤵
      PID:4844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28872.exe
      4⤵
      PID:5808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24713.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24713.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18073.exe
      4⤵
      PID:288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9370.exe
        5⤵
        
        PID:3768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50548.exe
        5⤵
        
        PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23596.exe
        5⤵
        
        PID:5844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41474.exe
      4⤵
      PID:1356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7815.exe
      4⤵
      PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59632.exe
      4⤵
      PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11806.exe
      4⤵
      PID:6008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11690.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11690.exe
    3⤵
    PID:1744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1373.exe
      4⤵
      PID:3992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50548.exe
      4⤵
      PID:4744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15443.exe
      4⤵
      PID:5640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35874.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35874.exe
    3⤵
    PID:3076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23367.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23367.exe
    3⤵
    PID:4128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40482.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40482.exe
    3⤵
    PID:4620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20350.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20350.exe
    3⤵
    PID:6116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36639.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36639.exe
    3⤵
    PID:6584
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17593.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17593.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16875.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16875.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62410.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25554.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8645.exe
        6⤵
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19512.exe
        7⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53038.exe
        7⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49486.exe
        7⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18348.exe
        7⤵
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65494.exe
        6⤵
        
        PID:1852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49453.exe
        6⤵
        
        PID:3952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38897.exe
        6⤵
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28896.exe
        6⤵
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63293.exe
        6⤵
        
        PID:6772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26748.exe
        5⤵
        
        PID:2768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61102.exe
        6⤵
        
        PID:5820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55210.exe
        5⤵
        
        PID:3164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31503.exe
        5⤵
        
        PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40161.exe
        5⤵
        
        PID:4296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7099.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60815.exe
        5⤵
        
        PID:7048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64505.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5831.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8080.exe
        6⤵
        
        PID:4588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64220.exe
        6⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31597.exe
        6⤵
        
        PID:6272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41474.exe
        5⤵
        
        PID:2320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7815.exe
        5⤵
        
        PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25013.exe
        5⤵
        
        PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
        5⤵
        
        PID:5952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40099.exe
      4⤵
      PID:2980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61075.exe
      4⤵
      PID:3084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22837.exe
      4⤵
      PID:4104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44947.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16681.exe
      4⤵
      PID:5436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58827.exe
      4⤵
      PID:6824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2306.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2306.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43748.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15609.exe
        5⤵
        
        PID:2912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
        6⤵
        
        PID:3340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11902.exe
        6⤵
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16270.exe
        6⤵
        
        PID:5052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6761.exe
        6⤵
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65281.exe
        6⤵
        
        PID:6968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12785.exe
        5⤵
        
        PID:1644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8080.exe
        6⤵
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34370.exe
        6⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31597.exe
        6⤵
        
        PID:6320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49453.exe
        5⤵
        
        PID:3884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38897.exe
        5⤵
        
        PID:2456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46686.exe
        5⤵
        
        PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58685.exe
        5⤵
        
        PID:6492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34031.exe
      4⤵
      PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51583.exe
        5⤵
        
        PID:3508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19488.exe
        5⤵
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49486.exe
        5⤵
        
        PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18348.exe
        5⤵
        
        PID:6476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49847.exe
      4⤵
      PID:2136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55318.exe
      4⤵
      PID:3220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14759.exe
      4⤵
      PID:4364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7291.exe
      4⤵
      PID:5984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60815.exe
      4⤵
      PID:7104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11691.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11691.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19764.exe
      4⤵
      PID:900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49453.exe
      4⤵
      PID:3872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38897.exe
      4⤵
      PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28872.exe
      4⤵
      PID:6060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49945.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49945.exe
    3⤵
    PID:2144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28018.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28018.exe
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35617.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35617.exe
    3⤵
    PID:4868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14272.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14272.exe
    3⤵
    PID:5720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7797.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7797.exe
    3⤵
    PID:6200
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27801.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27801.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57802.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57802.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52388.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45622.exe
        5⤵
        
        PID:2104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41978.exe
        5⤵
        
        PID:3396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1950.exe
        5⤵
        
        PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33679.exe
        5⤵
        
        PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28341.exe
        5⤵
        
        PID:6096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18647.exe
      4⤵
      PID:2140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
        5⤵
        
        PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11902.exe
        5⤵
        
        PID:4192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65362.exe
        5⤵
        
        PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6569.exe
        5⤵
        
        PID:5668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55210.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31503.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61483.exe
      4⤵
      PID:4684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30150.exe
      4⤵
      PID:5988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41708.exe
      4⤵
      PID:6664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23882.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23882.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2831.exe
      4⤵
      PID:1552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37841.exe
        5⤵
        
        PID:3480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62379.exe
        5⤵
        
        PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31696.exe
        5⤵
        
        PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40155.exe
        5⤵
        
        PID:6460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41474.exe
      4⤵
      PID:2312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7815.exe
      4⤵
      PID:4496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25013.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11806.exe
      4⤵
      PID:6044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51486.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51486.exe
    3⤵
    PID:2428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
      4⤵
      PID:3300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1950.exe
      4⤵
      PID:4408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33679.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28341.exe
      4⤵
      PID:5716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61075.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61075.exe
    3⤵
    PID:3092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22837.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22837.exe
    3⤵
    PID:4112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44947.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44947.exe
    3⤵
    PID:2424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64429.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64429.exe
    3⤵
    PID:5420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19129.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19129.exe
    3⤵
    PID:6252
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53480.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53480.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36379.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36379.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46229.exe
      4⤵
      PID:1112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65352.exe
        5⤵
        
        PID:3668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53752.exe
        5⤵
        
        PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7810.exe
        5⤵
        
        PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32449.exe
        5⤵
        
        PID:6708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41474.exe
      4⤵
      PID:3064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38819.exe
      4⤵
      PID:3848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
      4⤵
      PID:4828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1467.exe
      4⤵
      PID:6024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16809.exe
      4⤵
      PID:7000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18647.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18647.exe
    3⤵
    PID:2964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-915.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64526.exe
      4⤵
      PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55351.exe
      4⤵
      PID:5240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57151.exe
      4⤵
      PID:6192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32354.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32354.exe
    3⤵
    PID:4052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48475.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48475.exe
    3⤵
    PID:4820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27027.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27027.exe
    3⤵
    PID:5740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12262.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12262.exe
    3⤵
    PID:6160
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29034.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29034.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45971.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45971.exe
    3⤵
    PID:1896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38787.exe
      4⤵
      PID:5864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20554.exe
      4⤵
      PID:6368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41474.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41474.exe
    3⤵
    PID:2852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38819.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38819.exe
    3⤵
    PID:3820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
    3⤵
    PID:4328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28896.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28896.exe
    3⤵
    PID:5620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14954.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14954.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6416
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39154.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39154.exe
  2⤵
  PID:1548
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31409.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31409.exe
  2⤵
  PID:3184
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62039.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62039.exe
  2⤵
  PID:4136
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39347.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39347.exe
  2⤵
  PID:4692
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28309.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28309.exe
  2⤵
  PID:5524
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11756.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11756.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11691.exe

Filesize
468KB

MD5
de71a8151e21563f9347e0dd84839e49

SHA1
34b98e16d400151b5980973edff24b3d8b18c97b

SHA256
effdd8fa9543e92deadfc3e61980ee1ca56ce3a5b2897d2956e8c30182566070

SHA512
1ea5b7713a8b690be8e647cc59a43b618a648b47754e23cc7f13e67731c0e10d34c41bce7438e6a70ad42891447395a9a53ec952b72136e7c81c8226412f2d4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49557.exe

Filesize
468KB

MD5
cd94ed795822e4349388a929d374183f

SHA1
3a884c793de3c311f19a755706e31b92c26285c8

SHA256
f3b7a6c5d6d6d4aef7fefe35a5eaf96444222806ca659cc4c748f04dd8afabf5

SHA512
ef81a28c287a3e9fc9fb0aef7dc1ef0593a5325ec8d02fcf57b88739fe7a911020039e9e75fa5087183379f07f3d2e7e1c8c17b1d9341d68b61365b5cc249492

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5831.exe

Filesize
468KB

MD5
ca72fd7f15bc7701e2a0aa4951b6713c

SHA1
3d5308aa44ae78707906f73b5413bc903cb3afa4

SHA256
462e7a20daf35ba48fd583cff86c0d0ac24bdca34bae59e348c9fdf73005f49c

SHA512
bf9b24aecce2c075521a1a2585dc96398e1c0c6e02d4af3e056d2118ff901e9e55d87075879e48e0178203bce1cb0d54cdad1e115e1d50ad1d3d37b26763f542

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7294.exe

Filesize
468KB

MD5
53e867556babbdc4dc97a97323d23491

SHA1
27787b70e9c527ee9d815bad935d2aa3a51a0c1b

SHA256
ce366bc2b622574bcdb1c3af4a448a7ef51bb1d0a51f2dbe5801875ca2acf1c9

SHA512
15ddba24487f2dadfcd759282919eb2558b4903f99e45acf36dcd5ef943af695fed9d76f90340f9a08f6110d1f5d9c2ab21e56ef37b337385aab6af15fb7a751

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1216.exe

Filesize
468KB

MD5
359a8eca9282985539069d82ca51f02c

SHA1
95eaa323af59dc4eaa41ad306a80e7f717720eac

SHA256
4f28a4212e7cf673d5c8df5253148464acee916bd6ba77455e27764837bd7eba

SHA512
c0407b22ae03d8cedf6a053aeed609b924ffcd7a58e442dfa5077c75c60355e4941c9a6d3fc22639f3a8ea611ce98597e82c51878dff49fb5c1d6ff39b70fc7d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16875.exe

Filesize
468KB

MD5
577563faf9a5fd1f6f8f495f6d1dae97

SHA1
adfa675f2bb889721053516b505118458847b3bc

SHA256
28e8075bde89769a28fc88309481f0e584908100392d75f5a2bc06e8680b3c5f

SHA512
76770513980fb620642bef4df239a29b5af39e68b6baf063da3e73bfec148d3530867239afb92f339646352a46e84b2153b1b1f88ad154562930bed3da7ddb44

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17593.exe

Filesize
468KB

MD5
0e705cd407cb4b631a7c2d088c6da249

SHA1
dc98b86729ab65af321ad323d0c822d61461f591

SHA256
3aa1d4950a74d37a776312572eed679153b4b5917b1be41c2046669b78b9d8f5

SHA512
b8cf516eaa93a19cc48c3abdd7ef5edc1e041f3c42d11b789b36ee92650888e035fce78ea6f9fe45fe7b41f73764070d03d7fc8398d9072b177b3a7be5bee84a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-182.exe

Filesize
468KB

MD5
9b7265e18fd4c0593fa3a7bb6f8a92ed

SHA1
e2da9af468a4ed668aa4d775317c32393077001f

SHA256
e47e97bfd12d6fa8f610bb939a5b1336c0f5adde5a0dafc929c3f6b9b224a45a

SHA512
3f4ac0fcb8b6b90532b313c95ff980bafacb7d3f0540361aeed8304c5671c94963b06c8dce79192ea6e0560352fabfe12192e7445461805cdc4f828c3439d9cf

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25923.exe

Filesize
468KB

MD5
67f1693b69f23ed2008fe55ce52d0151

SHA1
a0181d6560511de8f8e871f8938c34e990220d88

SHA256
a3e1203991da2ce93b95ec78f39390ef61be2d464320ae2927d5e214fbffd601

SHA512
c30b57aa61c8860f38494d3827edea7215fcd6c2a28c8b2a68c0755aa5d73b117e3ee986251e1886b0996143973b9a937530de4ae26b8336b25c62d0fbc8274e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27335.exe

Filesize
468KB

MD5
681a399687995ac47df7b85b2371d75f

SHA1
f28b4484c196f96898d1379f89dc2f88bccb010a

SHA256
037a0249f7a5f7b1b970344bf2a80b0fa3fb2dfa437b8a2439f770eee0bc2205

SHA512
0f0c81056c9245d23a3dbc5919d7e232a996e3d8b784c95df57035afc76db0120ecff4d2f04505e2efa9573a72d2ac7e3238df9dc762ae73e3f67e62ca887245

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27801.exe

Filesize
468KB

MD5
9eaf8e8e0ff19200784a60f464c143dc

SHA1
1ca3450e02e0030c2bd58da8edfcebef5feeba5b

SHA256
a76c3e448bec4bf26694f32df78eccce9615694e04c4b5ce24d5bbef58756f86

SHA512
bb761b0c3fec31434b96fe0338673a9a517d79a2a41b0819bd433b21583b7fdccb766d56c9f2f9be390b07b7e2b21d849813d6ca04b87d8a1098ce60414a8c77

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28066.exe

Filesize
468KB

MD5
a88544718d11176956e6f00a1488e6dc

SHA1
73b0baec8a0b7dd59975e573df8cc33eba45c083

SHA256
2daa2c83b3a6c799da1bd85caec07621ffc6ff0283bbf2c5f63e94f34af3caf4

SHA512
75c3f47565e24a8ab72ffcba09067249941eae3e07c9b57e5716b8a97387e35ca93a28223a9fc25ae399aad343273499f14ef489fcf14f0c267e81f8db62ec99

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28555.exe

Filesize
468KB

MD5
3a03fa2f797d17d2c79a7b318c5a798d

SHA1
2d95b51907329bc48a7e44036dd97f7cbb0f17b4

SHA256
8f2737f9b5ba7c8c2f9faec989dd8992d25f2db10d99700b626a581feb7d7851

SHA512
0e774e3214a9c8f1719f0ddbfc4a7cef1c7a4f32f628fe032cc7983e651b8e0aa78c2a392c8229655f597dd88d16046bb6d271e0011a73e3def8c22908aac995

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-30824.exe

Filesize
468KB

MD5
a41bd30d1f88f1153b75b0d4b366b2eb

SHA1
c0d77dfab26a46e8003ba464361e6b3b0c20caae

SHA256
b8757e2188843ee720edf57755644b62ddd5de86024e6b1a39c54d2bf035e4f2

SHA512
65c4fa5069ecb2e200656af4c4d8af9545530cc55ecf06211160cb311ffba21196259d1cc1d15a8df0755239b1719b63e001e6848f5e95af19b989d59c5b8efe

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32936.exe

Filesize
468KB

MD5
3c70002bde63f5f571ca0e6caee50fb3

SHA1
c0543f5de75c28b956b13f3b73f5144dd1d5d272

SHA256
0cdcf88cf6ce7294d9fa88db08cde85e5e1c3f19d1bfd446dff70451d68641c3

SHA512
df218c8d59f7d148367e3de7066d87325766539100648a99d2b6fa8f448c250edbebcb4748b0bb9ce9d2de1d28f8023fd33b7705210296a18c7d052c01d21065

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46465.exe

Filesize
468KB

MD5
566690c6ad97b04fa8aea05dfcb51d0f

SHA1
253ad2db735d1f4e55093e49502dd238bc3d7d6e

SHA256
e94e4189a3ac84bdab4d5a692acb1cbac252863e1fffe732a542d42dadbc0c60

SHA512
179084dfc2dde0f6980e385ae97f22a62a90296c22d01e1910cf68c7d69441b53ea4b554241c3201dfc9c461c5e217d26f2e30f63246618318174e58a791fb02

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-50625.exe

Filesize
468KB

MD5
d84cb3a51250c2bd2ce9107a24da3cf7

SHA1
845bdb70bab2826324474402691767299f379c24

SHA256
666786c5aa47843acf006848a6027056bfe81f4617769671d1ff5dbc1f00345d

SHA512
f14e3eadb8b498cc15ff0bd3de6c9b00bc3510b3f2a481bb7beefbf5cc9d42e38d0d2f2bf919a9c575b0c037d8b6d909483d1f4d3211dbae6fc166463f57c0f8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52666.exe

Filesize
468KB

MD5
4f8d17b74a4c2aea428a19ecbeac8f83

SHA1
1d68dff75dbf776f074b46bc1e4de7d33416d0e7

SHA256
aa5ddcaf793143f8c4e60a62cff4a59fb64bb797f3fd9e26fdbce137127c6804

SHA512
271a9dfd539fe6b498869adbaa609e7b9c6d3e054648878d4f672f7739bf0a9ff4c39f0cf8cdb122f1f155864f53d7515f546c1438d8f78e99917ce4eb1be428

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61850.exe

Filesize
468KB

MD5
14097fed4a69c0540228e8b17563bc23

SHA1
b868838306c24cf0e9623f2118379f03779d256a

SHA256
debb016dfd67ff912764d4415cdcd570d8007c5f256aca04ddf95c2ed337922e

SHA512
4b0b8d1bdbec90b5d311449234b3179b926001083943b20c5f7e25c02acdcde211cea073a77e2b3bfed201cbca9eb603965d5bdd55bc48a5191a18497deaaf94

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64880.exe

Filesize
468KB

MD5
be19027cf936f2907158754fbf656b0d

SHA1
f2b2514804ece29455a320d9daa340963875f76d

SHA256
a283327c38bf9dc0061be21e9277ec26e64d7bf106c1af38a1fad80e115065ea

SHA512
4bd497904a15d94cbbcc2789d9c011b70dba674dcd91b1a9d2da228312baf68b8645137ff2bf864006952e50c6284196ef39eba7f03ac7151efc2c40e7a83e2e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-6702.exe

Filesize
468KB

MD5
841119f8bb7b17bf3b9fff7f7bbec786

SHA1
e49500f802b66ae675632d781fda69a166ebcb19

SHA256
3ac2ccfb5ff4dc103394ffd039187d665b2e1ee63a7ad774fc077ae11ab9f805

SHA512
32e32c36009f6ae3ba0719346b67f90a3e89e5928b9ac0eb95939bb5380bde913cc64a65f7918d36f927ea4883e97d8842db200d7be9f17cb407ae8849149359

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-7712.exe

Filesize
468KB

MD5
cae0306123d675d307716df8b91b7cc0

SHA1
18182ce982ce4a751fd88c36568405e4a343f428

SHA256
7c92f024bddcb7557e42fc7817d92a6dd7dbc35bc40e565cb180ecf4be589156

SHA512
412fb0bab7fe80b23fab5aa459e2a0393a8dfbae33461e3f93cc5c95083a8e5b140fccb2686ccdc232227bb568f01cadc44bbb73d022090062bbfe90f69cee1c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8200.exe

Filesize
468KB

MD5
16e9506c385036a807e4e6805d7f314d

SHA1
f2c9d7fae3777abf8d8dfb3c4c241d065dcfc3ae

SHA256
e828487d87341fcdef878846e5b18e191eba690edba76dbdcf102814888bb800

SHA512
0053af4b30c8a739fb1359f3fb75539b8f8caf3a3e84c90522e7da217c90d734332f5750c9e08c871b93c36e404e68a11a43571d7abb344c8bca1b78102af1ab

Download Submit