aca1d548392da1850f5e38d4f98c8b45a23944046dc3795667cb6e5d98449752

Analysis

max time kernel
150s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-10-2024 02:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aca1d548392da1850f5e38d4f98c8b45a23944046dc3795667cb6e5d98449752.exe
Size

468KB
MD5

635c04aa0a2decd968fc5133a664d135
SHA1

0481e382bb6588a7f7bec48194c1d452463018be
SHA256

aca1d548392da1850f5e38d4f98c8b45a23944046dc3795667cb6e5d98449752
SHA512

e2f1d0868dd8e228b2b5095f8ad513bb4321d8a20be5e7328b42eaccf8e16c377dc38316257120a54c81cc23d1d3bceff8afb8a421bc1301f865db7655670a9c
SSDEEP

3072:ab8uorldB03YObY2PzcAffT/ECpHtumpnsHjOVhgb1AanS/7Kslz:ab1oJOYOBP4AffZhQbb1bS/7K

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2712	Unicorn-9502.exe
1920	Unicorn-24520.exe
3052	Unicorn-24651.exe
2660	Unicorn-41700.exe
2540	Unicorn-56012.exe
2604	Unicorn-11488.exe
2656	Unicorn-28318.exe
2468	Unicorn-7337.exe
1236	Unicorn-21296.exe
2228	Unicorn-56621.exe
2688	Unicorn-24441.exe
2212	Unicorn-44042.exe
2168	Unicorn-33264.exe
2552	Unicorn-38177.exe
2020	Unicorn-63658.exe
2252	Unicorn-62566.exe
1140	Unicorn-47412.exe
2872	Unicorn-25120.exe
2572	Unicorn-7906.exe
1684	Unicorn-50510.exe
1312	Unicorn-19753.exe
1468	Unicorn-17968.exe
316	Unicorn-18234.exe
1316	Unicorn-24352.exe
1656	Unicorn-49178.exe
2676	Unicorn-29312.exe
588	Unicorn-23994.exe
2200	Unicorn-32925.exe
1880	Unicorn-39972.exe
2172	Unicorn-17994.exe
1448	Unicorn-34029.exe
1728	Unicorn-3895.exe
2160	Unicorn-8254.exe
2728	Unicorn-27352.exe
3024	Unicorn-776.exe
3048	Unicorn-65234.exe
1712	Unicorn-20475.exe
2740	Unicorn-24799.exe
2504	Unicorn-13563.exe
3064	Unicorn-19100.exe
1324	Unicorn-1887.exe
2564	Unicorn-52889.exe
1508	Unicorn-11311.exe
1900	Unicorn-53505.exe
872	Unicorn-51393.exe
1924	Unicorn-44394.exe
608	Unicorn-37194.exe
1988	Unicorn-31063.exe
2816	Unicorn-35082.exe
2580	Unicorn-50349.exe
468	Unicorn-35859.exe
520	Unicorn-39534.exe
2088	Unicorn-33668.exe
2116	Unicorn-7510.exe
2924	Unicorn-7947.exe
688	Unicorn-32913.exe
1208	Unicorn-37547.exe
1180	Unicorn-13831.exe
1132	Unicorn-50136.exe
1516	Unicorn-29352.exe
1976	Unicorn-27955.exe
1908	Unicorn-34086.exe
1612	Unicorn-14220.exe
2272	Unicorn-3484.exe

Loads dropped DLL 64 IoCs

pid	Process
2724	aca1d548392da1850f5e38d4f98c8b45a23944046dc3795667cb6e5d98449752.exe
2724	aca1d548392da1850f5e38d4f98c8b45a23944046dc3795667cb6e5d98449752.exe
2724	aca1d548392da1850f5e38d4f98c8b45a23944046dc3795667cb6e5d98449752.exe
2712	Unicorn-9502.exe
2724	aca1d548392da1850f5e38d4f98c8b45a23944046dc3795667cb6e5d98449752.exe
2712	Unicorn-9502.exe
2712	Unicorn-9502.exe
2724	aca1d548392da1850f5e38d4f98c8b45a23944046dc3795667cb6e5d98449752.exe
1920	Unicorn-24520.exe
2712	Unicorn-9502.exe
1920	Unicorn-24520.exe
2724	aca1d548392da1850f5e38d4f98c8b45a23944046dc3795667cb6e5d98449752.exe
3052	Unicorn-24651.exe
3052	Unicorn-24651.exe
2604	Unicorn-11488.exe
2604	Unicorn-11488.exe
1920	Unicorn-24520.exe
1920	Unicorn-24520.exe
2660	Unicorn-41700.exe
2660	Unicorn-41700.exe
2724	aca1d548392da1850f5e38d4f98c8b45a23944046dc3795667cb6e5d98449752.exe
2712	Unicorn-9502.exe
3052	Unicorn-24651.exe
2540	Unicorn-56012.exe
2712	Unicorn-9502.exe
3052	Unicorn-24651.exe
2724	aca1d548392da1850f5e38d4f98c8b45a23944046dc3795667cb6e5d98449752.exe
2540	Unicorn-56012.exe
2656	Unicorn-28318.exe
2656	Unicorn-28318.exe
1236	Unicorn-21296.exe
1236	Unicorn-21296.exe
1920	Unicorn-24520.exe
1920	Unicorn-24520.exe
2688	Unicorn-24441.exe
2688	Unicorn-24441.exe
2468	Unicorn-7337.exe
2468	Unicorn-7337.exe
3052	Unicorn-24651.exe
3052	Unicorn-24651.exe
2604	Unicorn-11488.exe
2604	Unicorn-11488.exe
2712	Unicorn-9502.exe
2020	Unicorn-63658.exe
2712	Unicorn-9502.exe
2020	Unicorn-63658.exe
2552	Unicorn-38177.exe
2552	Unicorn-38177.exe
2212	Unicorn-44042.exe
2212	Unicorn-44042.exe
2540	Unicorn-56012.exe
2540	Unicorn-56012.exe
2724	aca1d548392da1850f5e38d4f98c8b45a23944046dc3795667cb6e5d98449752.exe
2724	aca1d548392da1850f5e38d4f98c8b45a23944046dc3795667cb6e5d98449752.exe
2168	Unicorn-33264.exe
2168	Unicorn-33264.exe
2228	Unicorn-56621.exe
2228	Unicorn-56621.exe
2656	Unicorn-28318.exe
2656	Unicorn-28318.exe
2660	Unicorn-41700.exe
2660	Unicorn-41700.exe
2252	Unicorn-62566.exe
2252	Unicorn-62566.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54478.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22787.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62174.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62174.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14126.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38177.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17968.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38561.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42013.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44011.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44227.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52889.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54738.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63004.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18167.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32399.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32342.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25894.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-215.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18519.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20915.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61770.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64509.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21533.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5235.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26250.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50510.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14431.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19818.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-850.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37392.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50577.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44856.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-167.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14552.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26303.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14552.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11488.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-680.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25120.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2387.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47781.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32193.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60763.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29833.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29585.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43906.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3530.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33978.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54550.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11262.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51128.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39972.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25299.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37392.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18167.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36058.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18752.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19887.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2724	aca1d548392da1850f5e38d4f98c8b45a23944046dc3795667cb6e5d98449752.exe
2712	Unicorn-9502.exe
3052	Unicorn-24651.exe
1920	Unicorn-24520.exe
2604	Unicorn-11488.exe
2660	Unicorn-41700.exe
2540	Unicorn-56012.exe
2656	Unicorn-28318.exe
2468	Unicorn-7337.exe
1236	Unicorn-21296.exe
2688	Unicorn-24441.exe
2020	Unicorn-63658.exe
2552	Unicorn-38177.exe
2168	Unicorn-33264.exe
2212	Unicorn-44042.exe
2228	Unicorn-56621.exe
2252	Unicorn-62566.exe
1140	Unicorn-47412.exe
2872	Unicorn-25120.exe
2572	Unicorn-7906.exe
1684	Unicorn-50510.exe
1316	Unicorn-24352.exe
316	Unicorn-18234.exe
1312	Unicorn-19753.exe
1656	Unicorn-49178.exe
2676	Unicorn-29312.exe
1468	Unicorn-17968.exe
588	Unicorn-23994.exe
2200	Unicorn-32925.exe
1880	Unicorn-39972.exe
1448	Unicorn-34029.exe
2172	Unicorn-17994.exe
1728	Unicorn-3895.exe
2160	Unicorn-8254.exe
2728	Unicorn-27352.exe
3024	Unicorn-776.exe
3048	Unicorn-65234.exe
1712	Unicorn-20475.exe
2740	Unicorn-24799.exe
2504	Unicorn-13563.exe
1324	Unicorn-1887.exe
2564	Unicorn-52889.exe
3064	Unicorn-19100.exe
1508	Unicorn-11311.exe
872	Unicorn-51393.exe
1900	Unicorn-53505.exe
1924	Unicorn-44394.exe
1988	Unicorn-31063.exe
2580	Unicorn-50349.exe
608	Unicorn-37194.exe
2816	Unicorn-35082.exe
468	Unicorn-35859.exe
520	Unicorn-39534.exe
2088	Unicorn-33668.exe
2116	Unicorn-7510.exe
688	Unicorn-32913.exe
2924	Unicorn-7947.exe
1132	Unicorn-50136.exe
1180	Unicorn-13831.exe
1976	Unicorn-27955.exe
1612	Unicorn-14220.exe
1208	Unicorn-37547.exe
1516	Unicorn-29352.exe
1908	Unicorn-34086.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2712	2724	aca1d548392da1850f5e38d4f98c8b45a23944046dc3795667cb6e5d98449752.exe	30
PID 2724 wrote to memory of 2712	2724	aca1d548392da1850f5e38d4f98c8b45a23944046dc3795667cb6e5d98449752.exe	30
PID 2724 wrote to memory of 2712	2724	aca1d548392da1850f5e38d4f98c8b45a23944046dc3795667cb6e5d98449752.exe	30
PID 2724 wrote to memory of 2712	2724	aca1d548392da1850f5e38d4f98c8b45a23944046dc3795667cb6e5d98449752.exe	30
PID 2724 wrote to memory of 1920	2724	aca1d548392da1850f5e38d4f98c8b45a23944046dc3795667cb6e5d98449752.exe	32
PID 2724 wrote to memory of 1920	2724	aca1d548392da1850f5e38d4f98c8b45a23944046dc3795667cb6e5d98449752.exe	32
PID 2724 wrote to memory of 1920	2724	aca1d548392da1850f5e38d4f98c8b45a23944046dc3795667cb6e5d98449752.exe	32
PID 2724 wrote to memory of 1920	2724	aca1d548392da1850f5e38d4f98c8b45a23944046dc3795667cb6e5d98449752.exe	32
PID 2712 wrote to memory of 3052	2712	Unicorn-9502.exe	31
PID 2712 wrote to memory of 3052	2712	Unicorn-9502.exe	31
PID 2712 wrote to memory of 3052	2712	Unicorn-9502.exe	31
PID 2712 wrote to memory of 3052	2712	Unicorn-9502.exe	31
PID 2712 wrote to memory of 2660	2712	Unicorn-9502.exe	34
PID 2712 wrote to memory of 2660	2712	Unicorn-9502.exe	34
PID 2712 wrote to memory of 2660	2712	Unicorn-9502.exe	34
PID 2712 wrote to memory of 2660	2712	Unicorn-9502.exe	34
PID 1920 wrote to memory of 2604	1920	Unicorn-24520.exe	35
PID 1920 wrote to memory of 2604	1920	Unicorn-24520.exe	35
PID 1920 wrote to memory of 2604	1920	Unicorn-24520.exe	35
PID 1920 wrote to memory of 2604	1920	Unicorn-24520.exe	35
PID 2724 wrote to memory of 2540	2724	aca1d548392da1850f5e38d4f98c8b45a23944046dc3795667cb6e5d98449752.exe	36
PID 2724 wrote to memory of 2540	2724	aca1d548392da1850f5e38d4f98c8b45a23944046dc3795667cb6e5d98449752.exe	36
PID 2724 wrote to memory of 2540	2724	aca1d548392da1850f5e38d4f98c8b45a23944046dc3795667cb6e5d98449752.exe	36
PID 2724 wrote to memory of 2540	2724	aca1d548392da1850f5e38d4f98c8b45a23944046dc3795667cb6e5d98449752.exe	36
PID 3052 wrote to memory of 2656	3052	Unicorn-24651.exe	33
PID 3052 wrote to memory of 2656	3052	Unicorn-24651.exe	33
PID 3052 wrote to memory of 2656	3052	Unicorn-24651.exe	33
PID 3052 wrote to memory of 2656	3052	Unicorn-24651.exe	33
PID 2604 wrote to memory of 2468	2604	Unicorn-11488.exe	37
PID 2604 wrote to memory of 2468	2604	Unicorn-11488.exe	37
PID 2604 wrote to memory of 2468	2604	Unicorn-11488.exe	37
PID 2604 wrote to memory of 2468	2604	Unicorn-11488.exe	37
PID 1920 wrote to memory of 1236	1920	Unicorn-24520.exe	38
PID 1920 wrote to memory of 1236	1920	Unicorn-24520.exe	38
PID 1920 wrote to memory of 1236	1920	Unicorn-24520.exe	38
PID 1920 wrote to memory of 1236	1920	Unicorn-24520.exe	38
PID 2660 wrote to memory of 2228	2660	Unicorn-41700.exe	39
PID 2660 wrote to memory of 2228	2660	Unicorn-41700.exe	39
PID 2660 wrote to memory of 2228	2660	Unicorn-41700.exe	39
PID 2660 wrote to memory of 2228	2660	Unicorn-41700.exe	39
PID 2712 wrote to memory of 2552	2712	Unicorn-9502.exe	41
PID 2712 wrote to memory of 2552	2712	Unicorn-9502.exe	41
PID 2712 wrote to memory of 2552	2712	Unicorn-9502.exe	41
PID 2712 wrote to memory of 2552	2712	Unicorn-9502.exe	41
PID 3052 wrote to memory of 2688	3052	Unicorn-24651.exe	42
PID 3052 wrote to memory of 2688	3052	Unicorn-24651.exe	42
PID 3052 wrote to memory of 2688	3052	Unicorn-24651.exe	42
PID 3052 wrote to memory of 2688	3052	Unicorn-24651.exe	42
PID 2724 wrote to memory of 2212	2724	aca1d548392da1850f5e38d4f98c8b45a23944046dc3795667cb6e5d98449752.exe	40
PID 2724 wrote to memory of 2212	2724	aca1d548392da1850f5e38d4f98c8b45a23944046dc3795667cb6e5d98449752.exe	40
PID 2724 wrote to memory of 2212	2724	aca1d548392da1850f5e38d4f98c8b45a23944046dc3795667cb6e5d98449752.exe	40
PID 2724 wrote to memory of 2212	2724	aca1d548392da1850f5e38d4f98c8b45a23944046dc3795667cb6e5d98449752.exe	40
PID 2540 wrote to memory of 2020	2540	Unicorn-56012.exe	43
PID 2540 wrote to memory of 2020	2540	Unicorn-56012.exe	43
PID 2540 wrote to memory of 2020	2540	Unicorn-56012.exe	43
PID 2540 wrote to memory of 2020	2540	Unicorn-56012.exe	43
PID 2656 wrote to memory of 2168	2656	Unicorn-28318.exe	44
PID 2656 wrote to memory of 2168	2656	Unicorn-28318.exe	44
PID 2656 wrote to memory of 2168	2656	Unicorn-28318.exe	44
PID 2656 wrote to memory of 2168	2656	Unicorn-28318.exe	44
PID 1236 wrote to memory of 2252	1236	Unicorn-21296.exe	45
PID 1236 wrote to memory of 2252	1236	Unicorn-21296.exe	45
PID 1236 wrote to memory of 2252	1236	Unicorn-21296.exe	45
PID 1236 wrote to memory of 2252	1236	Unicorn-21296.exe	45

C:\Users\Admin\AppData\Local\Temp\aca1d548392da1850f5e38d4f98c8b45a23944046dc3795667cb6e5d98449752.exe
"C:\Users\Admin\AppData\Local\Temp\aca1d548392da1850f5e38d4f98c8b45a23944046dc3795667cb6e5d98449752.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9502.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9502.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24651.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24651.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28318.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33264.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32925.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13831.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37732.exe
        8⤵
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43239.exe
        8⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39266.exe
        8⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13833.exe
        8⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18461.exe
        7⤵
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60603.exe
        7⤵
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29677.exe
        7⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36058.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51284.exe
        7⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62174.exe
        7⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18752.exe
        7⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14220.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28150.exe
        7⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49828.exe
        7⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-654.exe
        7⤵
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12868.exe
        7⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35886.exe
        7⤵
        
        PID:4916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18461.exe
        6⤵
        
        PID:1156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60603.exe
        6⤵
        
        PID:1932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14218.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37812.exe
        6⤵
        
        PID:3992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35825.exe
        6⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62174.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18752.exe
        6⤵
        
        PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17994.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52889.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18100.exe
        7⤵
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50577.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31156.exe
        7⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5379.exe
        7⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54478.exe
        7⤵
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61718.exe
        6⤵
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51128.exe
        6⤵
        
        PID:1776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51095.exe
        6⤵
        
        PID:3596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3361.exe
        6⤵
        
        PID:3736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9880.exe
        6⤵
        
        PID:4476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18167.exe
        6⤵
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14552.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53505.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63284.exe
        6⤵
        
        PID:2360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17531.exe
        6⤵
        
        PID:1344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63563.exe
        6⤵
        
        PID:3852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6519.exe
        6⤵
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36875.exe
        6⤵
        
        PID:4288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5646.exe
        6⤵
        
        PID:1044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38231.exe
        5⤵
        
        PID:2944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25299.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54922.exe
        6⤵
        
        PID:4924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57278.exe
        6⤵
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48328.exe
        5⤵
        
        PID:2064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42723.exe
        5⤵
        
        PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5235.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-272.exe
        5⤵
        
        PID:4468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8811.exe
        5⤵
        
        PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50479.exe
        5⤵
        
        PID:5972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24441.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25120.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24799.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42641.exe
        7⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23574.exe
        7⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13370.exe
        7⤵
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56114.exe
        7⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38112.exe
        7⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19887.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44754.exe
        6⤵
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51128.exe
        6⤵
        
        PID:2800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2387.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4705.exe
        6⤵
        
        PID:3572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40922.exe
        6⤵
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-850.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14552.exe
        6⤵
        
        PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1887.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3484.exe
        6⤵
        Executes dropped EXE
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5019.exe
        7⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33521.exe
        7⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16802.exe
        7⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26303.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34934.exe
        7⤵
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61623.exe
        6⤵
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54738.exe
        6⤵
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22884.exe
        6⤵
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54348.exe
        6⤵
        
        PID:3980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34218.exe
        6⤵
        
        PID:4856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7698.exe
        6⤵
        
        PID:3976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26486.exe
        6⤵
        
        PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-561.exe
        5⤵
        
        PID:2288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62769.exe
        6⤵
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32764.exe
        6⤵
        
        PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15686.exe
        5⤵
        
        PID:2204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51938.exe
        5⤵
        
        PID:1032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63220.exe
        5⤵
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54878.exe
        5⤵
        
        PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29753.exe
        5⤵
        
        PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56838.exe
        5⤵
        
        PID:3700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32534.exe
        5⤵
        
        PID:5564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50510.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50349.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24592.exe
        6⤵
        
        PID:1904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41002.exe
        6⤵
        
        PID:2144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-215.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59723.exe
        6⤵
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9057.exe
        6⤵
        
        PID:4908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6359.exe
        6⤵
        
        PID:4820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19887.exe
        6⤵
        
        PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61770.exe
        5⤵
        
        PID:1696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51128.exe
        5⤵
        
        PID:2848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29833.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12014.exe
        6⤵
        
        PID:2420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10614.exe
        5⤵
        
        PID:3104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47028.exe
        5⤵
        
        PID:3124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47781.exe
        5⤵
        
        PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62174.exe
        5⤵
        
        PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18752.exe
        5⤵
        
        PID:5324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39534.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26568.exe
        5⤵
        
        PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43688.exe
        5⤵
        
        PID:5304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41211.exe
      4⤵
      PID:2400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64509.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43455.exe
        5⤵
        
        PID:3712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43770.exe
        5⤵
        
        PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23776.exe
        5⤵
        
        PID:6032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31792.exe
      4⤵
      PID:2328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59789.exe
      4⤵
      PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49241.exe
      4⤵
      PID:2364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14319.exe
      4⤵
      PID:3920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12969.exe
      4⤵
      PID:4244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50600.exe
      4⤵
      PID:5136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41700.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41700.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56621.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39972.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37547.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        6⤵
        
        PID:2880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51128.exe
        6⤵
        
        PID:864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44227.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63921.exe
        6⤵
        
        PID:4076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64391.exe
        6⤵
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8049.exe
        6⤵
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29352.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32135.exe
        6⤵
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30616.exe
        6⤵
        
        PID:4808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57278.exe
        6⤵
        
        PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63744.exe
        5⤵
        
        PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19987.exe
        5⤵
        
        PID:2016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5235.exe
        5⤵
        
        PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35113.exe
        5⤵
        
        PID:3716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28312.exe
        5⤵
        
        PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32342.exe
        5⤵
        
        PID:5248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34029.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11311.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1240.exe
        6⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52456.exe
        7⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7003.exe
        7⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44552.exe
        7⤵
        
        PID:4100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65334.exe
        6⤵
        
        PID:2844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32193.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39968.exe
        6⤵
        
        PID:752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30715.exe
        6⤵
        
        PID:4624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18167.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27681.exe
        6⤵
        
        PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46290.exe
        5⤵
        
        PID:1764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51128.exe
        5⤵
        
        PID:1676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37676.exe
        5⤵
        
        PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15240.exe
        5⤵
        
        PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30715.exe
        5⤵
        
        PID:4668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18167.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14126.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51393.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14026.exe
        5⤵
        
        PID:2004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23574.exe
        5⤵
        
        PID:3324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13370.exe
        5⤵
        
        PID:876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10072.exe
        5⤵
        
        PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18167.exe
        5⤵
        
        PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3338.exe
        5⤵
        
        PID:5388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15833.exe
      4⤵
      PID:944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48328.exe
      4⤵
      PID:1404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25894.exe
      4⤵
      PID:3628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3123.exe
      4⤵
      PID:3540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3593.exe
      4⤵
      PID:3520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39521.exe
      4⤵
      PID:4572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12799.exe
      4⤵
      PID:5224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38177.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38177.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24352.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13563.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4337.exe
        6⤵
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41002.exe
        6⤵
        
        PID:1980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17018.exe
        6⤵
        
        PID:3212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63013.exe
        6⤵
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35294.exe
        6⤵
        
        PID:4828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
        6⤵
        
        PID:4108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47280.exe
        6⤵
        
        PID:5892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47084.exe
        5⤵
        
        PID:1080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59029.exe
        6⤵
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-330.exe
        6⤵
        
        PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51128.exe
        5⤵
        
        PID:2436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5235.exe
        5⤵
        
        PID:2600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-272.exe
        5⤵
        
        PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47571.exe
        5⤵
        
        PID:4904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50479.exe
        5⤵
        
        PID:5976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19100.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6959.exe
        5⤵
        
        PID:4316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54922.exe
        5⤵
        
        PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57278.exe
        5⤵
        
        PID:5336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34617.exe
      4⤵
      PID:1424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56993.exe
      4⤵
      PID:1872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59259.exe
      4⤵
      PID:3448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53707.exe
      4⤵
      PID:3196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57988.exe
      4⤵
      PID:4172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44856.exe
      4⤵
      PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28142.exe
      4⤵
      PID:5440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17968.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17968.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7510.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45353.exe
        5⤵
        
        PID:4956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43542.exe
        5⤵
        
        PID:5400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21827.exe
      4⤵
      PID:1536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51128.exe
      4⤵
      PID:1704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58132.exe
      4⤵
      PID:3724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15520.exe
      4⤵
      PID:3796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30715.exe
      4⤵
      PID:4656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18167.exe
      4⤵
      PID:4504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33477.exe
      4⤵
      PID:5412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7947.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7947.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52054.exe
      4⤵
      PID:564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22787.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3891.exe
      4⤵
      PID:3808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63391.exe
      4⤵
      PID:3900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53205.exe
      4⤵
      PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36417.exe
      4⤵
      PID:5064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19818.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19818.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48858.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48858.exe
    3⤵
    PID:2080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38258.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38258.exe
    3⤵
    PID:3468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43906.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43906.exe
    3⤵
    PID:3360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18519.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18519.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50770.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50770.exe
    3⤵
    PID:4324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32399.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32399.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5216
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24520.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24520.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11488.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11488.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7337.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7906.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65234.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12919.exe
        7⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18650.exe
        7⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48633.exe
        7⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47251.exe
        7⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1102.exe
        7⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55008.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-680.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51128.exe
        6⤵
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56923.exe
        6⤵
        
        PID:3800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30725.exe
        6⤵
        
        PID:3496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30715.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18167.exe
        6⤵
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14126.exe
        6⤵
        
        PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20475.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34086.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4726.exe
        6⤵
        
        PID:2344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28653.exe
        6⤵
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60763.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46855.exe
        6⤵
        
        PID:4056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37406.exe
        6⤵
        
        PID:4340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14886.exe
        6⤵
        
        PID:2072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27955.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14810.exe
        6⤵
        
        PID:5112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15743.exe
        6⤵
        
        PID:5544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24327.exe
        5⤵
        
        PID:1252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51938.exe
        5⤵
        
        PID:1360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13360.exe
        5⤵
        
        PID:3392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42390.exe
        5⤵
        
        PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10540.exe
        5⤵
        
        PID:4296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33102.exe
        5⤵
        
        PID:4380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19753.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23393.exe
        6⤵
        
        PID:2744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37392.exe
        6⤵
        
        PID:1264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62059.exe
        6⤵
        
        PID:3488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13370.exe
        6⤵
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10072.exe
        6⤵
        
        PID:4500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16245.exe
        6⤵
        
        PID:3704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-167.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61770.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51128.exe
        5⤵
        
        PID:2124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18967.exe
        5⤵
        
        PID:3096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17900.exe
        5⤵
        
        PID:4128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50633.exe
        5⤵
        
        PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17256.exe
        5⤵
        
        PID:6076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31063.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48494.exe
        5⤵
        
        PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58914.exe
        5⤵
        
        PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63313.exe
        5⤵
        
        PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54478.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15833.exe
      4⤵
      PID:2916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48328.exe
      4⤵
      PID:1088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42723.exe
      4⤵
      PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5235.exe
      4⤵
      PID:2224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19654.exe
      4⤵
      PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8769.exe
      4⤵
      PID:4336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55977.exe
      4⤵
      PID:6020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21296.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21296.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62566.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3895.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16277.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65334.exe
        6⤵
        
        PID:2608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29440.exe
        6⤵
        
        PID:3304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4705.exe
        6⤵
        
        PID:3548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24944.exe
        6⤵
        
        PID:4248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51177.exe
        6⤵
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28142.exe
        6⤵
        
        PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25277.exe
        5⤵
        
        PID:2960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26321.exe
        6⤵
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59307.exe
        6⤵
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35273.exe
        6⤵
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17637.exe
        6⤵
        
        PID:4064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18591.exe
        6⤵
        
        PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27821.exe
        5⤵
        
        PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20774.exe
        5⤵
        
        PID:3332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63544.exe
        5⤵
        
        PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26250.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56838.exe
        5⤵
        
        PID:3696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32342.exe
        5⤵
        
        PID:5184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8254.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48190.exe
        5⤵
        
        PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37392.exe
        5⤵
        
        PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19253.exe
        5⤵
        
        PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44457.exe
        5⤵
        
        PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63004.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18167.exe
        5⤵
        
        PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3530.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54550.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45685.exe
      4⤵
      PID:2896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29585.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40498.exe
      4⤵
      PID:4044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26250.exe
      4⤵
      PID:4632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56838.exe
      4⤵
      PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12991.exe
      4⤵
      PID:5488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47412.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47412.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27352.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11299.exe
        5⤵
        
        PID:748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50397.exe
        6⤵
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52324.exe
        6⤵
        
        PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34736.exe
        5⤵
        
        PID:656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54738.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38561.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51058.exe
        5⤵
        
        PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58059.exe
        5⤵
        
        PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18167.exe
        5⤵
        
        PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14552.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14431.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13532.exe
      4⤵
      PID:880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38059.exe
      4⤵
      PID:2588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31019.exe
      4⤵
      PID:3148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47781.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62174.exe
      4⤵
      PID:5076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8791.exe
      4⤵
      PID:5536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-776.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-776.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52450.exe
      4⤵
      PID:1144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37392.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62251.exe
      4⤵
      PID:3644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13765.exe
      4⤵
      PID:3968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47251.exe
      4⤵
      PID:4744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
      4⤵
      PID:5084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31821.exe
      4⤵
      PID:5900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57225.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57225.exe
    3⤵
    PID:1876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31792.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31792.exe
    3⤵
    PID:2264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38679.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38679.exe
    3⤵
    PID:3756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42013.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42013.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20915.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20915.exe
    3⤵
    PID:4728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61039.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61039.exe
    3⤵
    PID:4536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4606.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4606.exe
    3⤵
    PID:5344
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56012.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56012.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63658.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63658.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18234.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37194.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42641.exe
        6⤵
        
        PID:2780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42326.exe
        6⤵
        
        PID:2536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13370.exe
        6⤵
        
        PID:1548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8999.exe
        6⤵
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48335.exe
        6⤵
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35465.exe
        6⤵
        
        PID:5124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61770.exe
        5⤵
        
        PID:1952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4239.exe
        5⤵
        
        PID:3340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18967.exe
        5⤵
        
        PID:3132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20915.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44364.exe
        5⤵
        
        PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50287.exe
        5⤵
        
        PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35859.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19663.exe
        5⤵
        
        PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23574.exe
        5⤵
        
        PID:3312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13370.exe
        5⤵
        
        PID:3220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40655.exe
        5⤵
        
        PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18569.exe
        5⤵
        
        PID:4236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35465.exe
        5⤵
        
        PID:4140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44011.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51938.exe
      4⤵
      PID:1856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46416.exe
      4⤵
      PID:3408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51588.exe
      4⤵
      PID:3284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6038.exe
      4⤵
      PID:5040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58997.exe
      4⤵
      PID:5024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32342.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29312.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29312.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35082.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32802.exe
        5⤵
        
        PID:2140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18458.exe
        5⤵
        
        PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7505.exe
        5⤵
        
        PID:3372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49320.exe
        5⤵
        
        PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54648.exe
        5⤵
        
        PID:4432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51072.exe
        5⤵
        
        PID:4612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61770.exe
      4⤵
      PID:932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51128.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49239.exe
      4⤵
      PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31569.exe
      4⤵
      PID:3768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47781.exe
      4⤵
      PID:4708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62174.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18752.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33668.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33668.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28692.exe
      4⤵
      PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34282.exe
      4⤵
      PID:2636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28196.exe
      4⤵
      PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46734.exe
      4⤵
      PID:3792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27038.exe
      4⤵
      PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35549.exe
      4⤵
      PID:4988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35657.exe
      4⤵
      PID:5596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
    3⤵
    PID:1544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48328.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48328.exe
    3⤵
    PID:1492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25894.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25894.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18473.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18473.exe
    3⤵
    PID:3748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20479.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20479.exe
    3⤵
    PID:4228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39521.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39521.exe
    3⤵
    PID:4620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32342.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32342.exe
    3⤵
    PID:5328
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44042.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44042.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49178.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49178.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32913.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56181.exe
        5⤵
        
        PID:4776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6702.exe
        5⤵
        
        PID:4224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57278.exe
        5⤵
        
        PID:5256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25418.exe
      4⤵
      PID:1912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51128.exe
      4⤵
      PID:1736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25396.exe
      4⤵
      PID:3564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21533.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27569.exe
      4⤵
      PID:5016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50627.exe
      4⤵
      PID:4936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7730.exe
      4⤵
      PID:5480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50136.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50136.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10260.exe
      4⤵
      PID:3996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4305.exe
      4⤵
      PID:3828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50051.exe
      4⤵
      PID:4716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26303.exe
      4⤵
      PID:5088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35126.exe
      4⤵
      PID:5580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42060.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42060.exe
    3⤵
    PID:1560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56993.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56993.exe
    3⤵
    PID:2772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42430.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42430.exe
    3⤵
    PID:3612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19114.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19114.exe
    3⤵
    PID:3652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25124.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25124.exe
    3⤵
    PID:4032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44856.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44856.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8599.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8599.exe
    3⤵
    PID:4784
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23994.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23994.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-618.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-618.exe
    3⤵
    PID:2620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37392.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37392.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45230.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45230.exe
    3⤵
    PID:3620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27102.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27102.exe
    3⤵
    PID:3636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57458.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57458.exe
    3⤵
    PID:4144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48335.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48335.exe
    3⤵
    PID:4952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2600.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2600.exe
    3⤵
    PID:4920
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32863.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32863.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2856
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11262.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11262.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2852
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8393.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8393.exe
  2⤵
  PID:784
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43906.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43906.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2444
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33978.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33978.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3892
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4776.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4776.exe
  2⤵
  PID:4404
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51943.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51943.exe
  2⤵
  PID:5588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11488.exe

Filesize
468KB

MD5
fc70ae3928d083a0a26f1d01d2858330

SHA1
262ae2d33ff377c8ae13e294885f79194c7b7e1c

SHA256
19d7b3c427f2d08317b063c905b49e2e58f37f93f212e2257f7f82e6e572e6f9

SHA512
4acb7c016920d74988d137b7cb564fbff75c29a8564df0531d3c3c11ab21c13262f84f68d9a018653d7253ba1ae4564212a32c178030ee3373aaf0d64e7fefcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33264.exe

Filesize
468KB

MD5
82010aaf32ae750832e32c10c419ef4e

SHA1
b46ee833880137e6dd457ebe9dce4db5220015b5

SHA256
dc0528bafd5919899041dd8105c2a494211bf408672e04f12f1ce6f397d96512

SHA512
850ea7db025b12da6606a982fbc11d08aefa8048e1872f70dad37d39bbd9aa5d0d37cb3abf33e4ed9413186f8b471d4f8b2f8776b12e5c710d350be160dadb08

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56012.exe

Filesize
468KB

MD5
14c9c9272bef7d469fb3305b0dbc527b

SHA1
9df62fd7bc872d9b534b511f0bb1cd8cd95da4b3

SHA256
62a29f33b4a6c7acfa35d500d7640fccd981446c8e7ed7d6a2f1ceec4c576985

SHA512
73e16abcd7195799bd3d7d2adba58c9bd0a002161aaaf8e0f83005eef56e3ba274d0cf73d98c855d5ba30b4f6f3fed4640c292ea431b6a17cf750112c76520fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56621.exe

Filesize
468KB

MD5
529251228a00c3df44a3e96d959794c2

SHA1
56c56b76d7658dbc8c16a4a6f67b8264579f9676

SHA256
b7de8ce03366dc3de49ae739e5d62c121ad92a588b5e97cc453d8c1726700ddc

SHA512
e5f65779ed8484ef1bf4513102dcccaa9c72009e4382fef3d359a7493da623c7b66a3cc34541b32988a49660c820c38c9edda4439dc961eaadfb2ff6b74e84e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59307.exe

Filesize
468KB

MD5
4d4dcdbb7c269745a9548064a0073bf4

SHA1
2d3366ad21a29a0a021bd8f0b8e67f8d6764fe23

SHA256
06bbca0dc32b17dc9edafa3e51f886d265c35209a99257007f671a55086f486e

SHA512
f13bfbf7db0006cbc2c08fe48374dab4728281509f4a5e438e55be4e6db940ed0ef39ba5b2e96e5e0983cb3c743722284f9354cd9b171404ce6290bed156d508

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7337.exe

Filesize
468KB

MD5
7029f97a700a5645876dd8eaad30910a

SHA1
39b43b5df5263b362b75612c6d89f2a88a542b5c

SHA256
4cbf6827f8226a4168d0b505cff794a285d5ee982c51a9d8306f4ad532aa0c0d

SHA512
0ee7bee8cbc140f0e69660f87fdb245313358d2c65aec8936015fc4f089a36ffd40fbfc616d9f3e78a5306ebffeb1ebef5016e933208682000d3d2502ecf4311

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-21296.exe

Filesize
468KB

MD5
826953875bc474c5aabcba434f6bc5da

SHA1
8b1ca49a31fd48ce8eb73054e5176f637fea2f56

SHA256
cdf991fb2f16ceedac4d4ad5a0624d29549e411811dbe5b138a644fbd2a03b3e

SHA512
f281faa87ff992d6c8d19647b93817801fdeca80526557c18a81202787d6c3f09c8272e6a5c72af69caf2a726138f7d73bea0d40884a91c27dcef9079131019e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24441.exe

Filesize
468KB

MD5
0ee3e687dac92709926ba3c380983918

SHA1
73c4bbfc0970e8bd1f14f3ce4d612350da273ca5

SHA256
1c50dd4f2e3ce2e08e48a08761c0eb75830fe4ae536146dc917f8d8907e08ec5

SHA512
158f95388d1d07b758eef751c657c1251ed8ea869f1b12c323222e508c9c413316dd4d88073d780fb3fc342035d7aee681d96e7e5cd9167aebf00e8cc4afd4ce

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24520.exe

Filesize
468KB

MD5
d34ad1ba50b8c04153e400a70d1b62ae

SHA1
1a2973fec92c11a19992a3cc81cc4032c1bcc5fe

SHA256
0176bf5b1974e141f4adadb0b191382ef951dee061a7f695b68453a137eb63ec

SHA512
237d77f5df4088181a0cb4a750e28b439b31aa4af05c7befb097fd08393c75a9285517cfe1f0ad3769eb7a2089a6df0d53d2b5499fb4bb180e7ce67f7b3f7668

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24651.exe

Filesize
468KB

MD5
d08f7d2e3e782730eb8988866b178fdb

SHA1
a76d2e8b82597ec6843d3cafffae47ae43a58f75

SHA256
25f4f3840f5cfb8d6bb4ca81944c99b490275b4c0c4386ba7786c21f95189df5

SHA512
25cf75aff14e15c75e55a986361596358b33c826671eb815bd2d97edf1043301ed161d2e094729b847098c194d57a14a547bfb915b001a4461a33b0234ffe3f1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25120.exe

Filesize
468KB

MD5
9ad5745df5f6268ef8546e2665e5c48a

SHA1
21e7f772fbe831f8c2268345f9138df52b16a45d

SHA256
dccd5ad05f866bf509e73a9ad9c33a9e4e84e0c4a010576bef0303e7a9dcfaea

SHA512
24c7325a88eac1b82dbaea83a2a62f28c64845005e460dd95de34535bbf3350d1bff0fab4ecebe1e9e418fb9ff62c83ef5f93bd26e3d2999f5775db98d9d9007

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28318.exe

Filesize
468KB

MD5
d79c4ca08dd4445823bc0d5a73ebe39a

SHA1
3cca35855544ac2799b33c728c411ef598589901

SHA256
666fe7cc861c5b8dd1bcee80f0d9ade050e7f22db8d8eb90e9138d662db6d698

SHA512
d3df12cca8ac52202b540c5e633cfd50c4fed5b79f0c4b2884200d222dd35519e0673346b6b8ff45ce7b5f172a1a413b47f7f11f2df5e46ed9dfaf0b0102d5c8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38177.exe

Filesize
468KB

MD5
4b240a58a946da6b6e78e8904b999d11

SHA1
6fc1198b044c4dd780c026184fc99a44a0c5e28f

SHA256
ea238c766fb462420e17afdf8eb31a2622f0bc92cb0afd6e4f8556f06868e01c

SHA512
f57bf568bc1b0ac298019d03c133080a81c14ddebb716b9fb212a140a386868983b2e4bc1b7c88806470a5b1c8a8a6a03d0d9b269eb7bc05c1b4e23dc312b53e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-41700.exe

Filesize
468KB

MD5
690c0056f5f8d9fbbd2f70d546fa80dd

SHA1
4c162f2dfc084ef92e248d3c15b5e869705424f9

SHA256
dac4214f5e2dae09a458a96400ed05142ef023607c9837b54a72a1db19f483e6

SHA512
7c3832881471e5220cc85d7c8f04605049619d3be117437b9c7d015d020cd0397b6fd254ff982d2398f6163efeee79107d2bb60b72a8f66ade9541f2bbb05a10

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-44042.exe

Filesize
468KB

MD5
c21c266c4c320e6916430420852ef401

SHA1
8d771781104ed7b8f187806ad3ba9e94289dd826

SHA256
de8384c5d047621cd78b5c505ecd20755b8bf74f3ca273e1bc51456763589e53

SHA512
6e643fb6b7219b50728fdb3532b78b2b6f0b57db4b6085a87f276fcdaa987355426835799135d43ff0b4f7d2eceec6ac63dfc02b06812a1fe634d2ad519c9883

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47412.exe

Filesize
468KB

MD5
a624eedfe78b8bee5a9e80aff89c1440

SHA1
7f5d8853134dd3317b4f4e183a3cbfb9615b73ba

SHA256
c17a5d2b990ea83e25428ff329c8f5ca0b6a766cb3fc38bf6d58a482602bd398

SHA512
ff6faf4ab83d6d191e61643785ee844cabecdddd16de22dcb9758222218e02148e076b8bdd377fa31102f91f5b9785a41bd680e911d68ad0947e11a65621739f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62566.exe

Filesize
468KB

MD5
691c187de2b9d71d3fa0fddba94be6cc

SHA1
e33a0d5c08efd6a15be21b04d269816119ee178d

SHA256
8c733ff33f79a0771b2dfc7d537468a198a29adf9b4e01183d4baedeb955034b

SHA512
da8ce999acd46d3c3b729d56e57b130715a8c9903999a9131f45f32e978bf57ab61ceb13df494564aebea1b67db904ad3a4e11880bc44a2e96886cce8ad63e16

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63658.exe

Filesize
468KB

MD5
05620bb7db3c388fe484b8681b6e9108

SHA1
7471c37aed25ac455194492e2fbe9730cb687ddf

SHA256
69c7bdffc634b7dcd1a28aefb0d2ee872b999a48aad21ddf6c5bfcc6cccec5e5

SHA512
58b5e1aacbf2ad359102eea82eed6829d49f5ac17f2a8b06c3298896a2322ca20e4637b01c6d30d0039c8c39012fae21029cacc9ecdd85f7607a80e27708e287

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9502.exe

Filesize
468KB

MD5
4ef9fde2bbb925eaa863c8764f463c53

SHA1
611322158da4b81352a0b4e8e921553516da97e9

SHA256
911deb1ecceec6ba0c69c259af55c253aad5bbd2118700214d4a19d3e48a6ff4

SHA512
952da87331120f43cd9ae48572b0428c3e3fa7bf0332ff51dfa341b17e9a6c49f44fcd0262882099af436eed3c14cf45f79506554379df3f367fac335005e0ce

Download Submit