6641df0aac40e044594ad5affb7c0bd6760bba0a7bd38846f8f281e79bb8ad90

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 02:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6641df0aac40e044594ad5affb7c0bd6760bba0a7bd38846f8f281e79bb8ad90N.exe
Size

468KB
MD5

e7a6c7096685bad1e497d0086d6a58d0
SHA1

ad0ba466af8384cbb5bce60aafe59a85a317bfee
SHA256

6641df0aac40e044594ad5affb7c0bd6760bba0a7bd38846f8f281e79bb8ad90
SHA512

4549e1ea940d9b41e7d24f3b6a2d8c7e0b90179f10ad857c6ccbbdf100b4141aa0dcd7d6209880be4510e52a5afd4de3ae91bcef1f1f6176367ed22dbc0cada4
SSDEEP

3072:4relogxaIU57tbYEPzcfmbfD/n2DnGIH9QmyeQVqxq5KkkbIuxGlj:4r4oCc7t7P4fmbfRa7Bq5DaIux

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2004	Unicorn-47268.exe
2876	Unicorn-60138.exe
2884	Unicorn-20921.exe
1408	Unicorn-64840.exe
2996	Unicorn-53392.exe
2784	Unicorn-7720.exe
2704	Unicorn-1782.exe
2776	Unicorn-12134.exe
2656	Unicorn-12004.exe
2532	Unicorn-31870.exe
2612	Unicorn-21489.exe
1356	Unicorn-43271.exe
2320	Unicorn-8714.exe
1872	Unicorn-28315.exe
1792	Unicorn-3027.exe
1256	Unicorn-23085.exe
1528	Unicorn-65482.exe
1624	Unicorn-26871.exe
2792	Unicorn-26841.exe
2808	Unicorn-713.exe
2588	Unicorn-11024.exe
2724	Unicorn-30890.exe
800	Unicorn-30890.exe
680	Unicorn-11922.exe
1688	Unicorn-5792.exe
2372	Unicorn-57594.exe
1368	Unicorn-62192.exe
1384	Unicorn-57102.exe
1936	Unicorn-230.exe
1344	Unicorn-50441.exe
2344	Unicorn-18859.exe
1592	Unicorn-30325.exe
880	Unicorn-49647.exe
1596	Unicorn-42761.exe
1604	Unicorn-24733.exe
1232	Unicorn-25190.exe
2572	Unicorn-42412.exe
1952	Unicorn-62278.exe
1248	Unicorn-10700.exe
1956	Unicorn-30566.exe
1980	Unicorn-30566.exe
2596	Unicorn-82.exe
2740	Unicorn-40684.exe
2500	Unicorn-8718.exe
3004	Unicorn-8718.exe
2796	Unicorn-3356.exe
2488	Unicorn-33327.exe
2756	Unicorn-24396.exe
2764	Unicorn-18060.exe
2908	Unicorn-18060.exe
632	Unicorn-62195.exe
1684	Unicorn-10393.exe
1800	Unicorn-16524.exe
1784	Unicorn-55994.exe
296	Unicorn-55729.exe
1960	Unicorn-23706.exe
1280	Unicorn-55620.exe
1308	Unicorn-36875.exe
2732	Unicorn-46119.exe
3068	Unicorn-59502.exe
2728	Unicorn-46887.exe
688	Unicorn-62107.exe
1848	Unicorn-62372.exe
2008	Unicorn-16226.exe

Loads dropped DLL 64 IoCs

pid	Process
2380	6641df0aac40e044594ad5affb7c0bd6760bba0a7bd38846f8f281e79bb8ad90N.exe
2380	6641df0aac40e044594ad5affb7c0bd6760bba0a7bd38846f8f281e79bb8ad90N.exe
2004	Unicorn-47268.exe
2380	6641df0aac40e044594ad5affb7c0bd6760bba0a7bd38846f8f281e79bb8ad90N.exe
2004	Unicorn-47268.exe
2380	6641df0aac40e044594ad5affb7c0bd6760bba0a7bd38846f8f281e79bb8ad90N.exe
2876	Unicorn-60138.exe
2876	Unicorn-60138.exe
2884	Unicorn-20921.exe
2004	Unicorn-47268.exe
2884	Unicorn-20921.exe
2004	Unicorn-47268.exe
2380	6641df0aac40e044594ad5affb7c0bd6760bba0a7bd38846f8f281e79bb8ad90N.exe
2380	6641df0aac40e044594ad5affb7c0bd6760bba0a7bd38846f8f281e79bb8ad90N.exe
1408	Unicorn-64840.exe
1408	Unicorn-64840.exe
2996	Unicorn-53392.exe
2876	Unicorn-60138.exe
2996	Unicorn-53392.exe
2876	Unicorn-60138.exe
2004	Unicorn-47268.exe
2004	Unicorn-47268.exe
2784	Unicorn-7720.exe
2784	Unicorn-7720.exe
2380	6641df0aac40e044594ad5affb7c0bd6760bba0a7bd38846f8f281e79bb8ad90N.exe
2884	Unicorn-20921.exe
2884	Unicorn-20921.exe
2380	6641df0aac40e044594ad5affb7c0bd6760bba0a7bd38846f8f281e79bb8ad90N.exe
2704	Unicorn-1782.exe
2704	Unicorn-1782.exe
2656	Unicorn-12004.exe
2656	Unicorn-12004.exe
2776	Unicorn-12134.exe
2776	Unicorn-12134.exe
2876	Unicorn-60138.exe
2876	Unicorn-60138.exe
1408	Unicorn-64840.exe
1408	Unicorn-64840.exe
2532	Unicorn-31870.exe
2532	Unicorn-31870.exe
2996	Unicorn-53392.exe
2996	Unicorn-53392.exe
2320	Unicorn-8714.exe
1356	Unicorn-43271.exe
2320	Unicorn-8714.exe
1356	Unicorn-43271.exe
2784	Unicorn-7720.exe
2884	Unicorn-20921.exe
2612	Unicorn-21489.exe
2884	Unicorn-20921.exe
2784	Unicorn-7720.exe
2612	Unicorn-21489.exe
1872	Unicorn-28315.exe
1872	Unicorn-28315.exe
2380	6641df0aac40e044594ad5affb7c0bd6760bba0a7bd38846f8f281e79bb8ad90N.exe
2004	Unicorn-47268.exe
2380	6641df0aac40e044594ad5affb7c0bd6760bba0a7bd38846f8f281e79bb8ad90N.exe
2004	Unicorn-47268.exe
1792	Unicorn-3027.exe
1792	Unicorn-3027.exe
1256	Unicorn-23085.exe
1256	Unicorn-23085.exe
2704	Unicorn-1782.exe
2704	Unicorn-1782.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29925.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53237.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53880.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58614.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21493.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46887.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57923.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53237.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45521.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36875.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45510.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63230.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10393.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58006.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57511.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42209.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42209.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49732.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42209.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58614.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22357.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4615.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11082.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39749.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44572.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49009.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16305.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34812.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57573.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53880.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40684.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60874.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2152.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21201.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62885.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48842.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52859.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2270.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57966.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22873.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48284.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65436.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30325.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10078.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48074.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41877.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13174.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38190.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57511.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29242.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2380	6641df0aac40e044594ad5affb7c0bd6760bba0a7bd38846f8f281e79bb8ad90N.exe
2004	Unicorn-47268.exe
2876	Unicorn-60138.exe
2884	Unicorn-20921.exe
1408	Unicorn-64840.exe
2996	Unicorn-53392.exe
2784	Unicorn-7720.exe
2704	Unicorn-1782.exe
2776	Unicorn-12134.exe
2656	Unicorn-12004.exe
2532	Unicorn-31870.exe
1356	Unicorn-43271.exe
1872	Unicorn-28315.exe
2320	Unicorn-8714.exe
2612	Unicorn-21489.exe
1792	Unicorn-3027.exe
1256	Unicorn-23085.exe
1528	Unicorn-65482.exe
1624	Unicorn-26871.exe
2808	Unicorn-713.exe
2792	Unicorn-26841.exe
800	Unicorn-30890.exe
2588	Unicorn-11024.exe
2724	Unicorn-30890.exe
680	Unicorn-11922.exe
1688	Unicorn-5792.exe
2372	Unicorn-57594.exe
1368	Unicorn-62192.exe
1936	Unicorn-230.exe
1384	Unicorn-57102.exe
1344	Unicorn-50441.exe
2344	Unicorn-18859.exe
880	Unicorn-49647.exe
1592	Unicorn-30325.exe
1596	Unicorn-42761.exe
1604	Unicorn-24733.exe
1232	Unicorn-25190.exe
2572	Unicorn-42412.exe
1248	Unicorn-10700.exe
1956	Unicorn-30566.exe
1980	Unicorn-30566.exe
2596	Unicorn-82.exe
1952	Unicorn-62278.exe
2740	Unicorn-40684.exe
2500	Unicorn-8718.exe
3004	Unicorn-8718.exe
2796	Unicorn-3356.exe
2756	Unicorn-24396.exe
2764	Unicorn-18060.exe
2488	Unicorn-33327.exe
2908	Unicorn-18060.exe
632	Unicorn-62195.exe
1784	Unicorn-55994.exe
1800	Unicorn-16524.exe
1684	Unicorn-10393.exe
296	Unicorn-55729.exe
1960	Unicorn-23706.exe
1280	Unicorn-55620.exe
1308	Unicorn-36875.exe
3068	Unicorn-59502.exe
2732	Unicorn-46119.exe
2728	Unicorn-46887.exe
688	Unicorn-62107.exe
1848	Unicorn-62372.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2004	2380	6641df0aac40e044594ad5affb7c0bd6760bba0a7bd38846f8f281e79bb8ad90N.exe	28
PID 2380 wrote to memory of 2004	2380	6641df0aac40e044594ad5affb7c0bd6760bba0a7bd38846f8f281e79bb8ad90N.exe	28
PID 2380 wrote to memory of 2004	2380	6641df0aac40e044594ad5affb7c0bd6760bba0a7bd38846f8f281e79bb8ad90N.exe	28
PID 2380 wrote to memory of 2004	2380	6641df0aac40e044594ad5affb7c0bd6760bba0a7bd38846f8f281e79bb8ad90N.exe	28
PID 2004 wrote to memory of 2876	2004	Unicorn-47268.exe	29
PID 2004 wrote to memory of 2876	2004	Unicorn-47268.exe	29
PID 2004 wrote to memory of 2876	2004	Unicorn-47268.exe	29
PID 2004 wrote to memory of 2876	2004	Unicorn-47268.exe	29
PID 2380 wrote to memory of 2884	2380	6641df0aac40e044594ad5affb7c0bd6760bba0a7bd38846f8f281e79bb8ad90N.exe	30
PID 2380 wrote to memory of 2884	2380	6641df0aac40e044594ad5affb7c0bd6760bba0a7bd38846f8f281e79bb8ad90N.exe	30
PID 2380 wrote to memory of 2884	2380	6641df0aac40e044594ad5affb7c0bd6760bba0a7bd38846f8f281e79bb8ad90N.exe	30
PID 2380 wrote to memory of 2884	2380	6641df0aac40e044594ad5affb7c0bd6760bba0a7bd38846f8f281e79bb8ad90N.exe	30
PID 2876 wrote to memory of 1408	2876	Unicorn-60138.exe	31
PID 2876 wrote to memory of 1408	2876	Unicorn-60138.exe	31
PID 2876 wrote to memory of 1408	2876	Unicorn-60138.exe	31
PID 2876 wrote to memory of 1408	2876	Unicorn-60138.exe	31
PID 2884 wrote to memory of 2784	2884	Unicorn-20921.exe	32
PID 2884 wrote to memory of 2784	2884	Unicorn-20921.exe	32
PID 2884 wrote to memory of 2784	2884	Unicorn-20921.exe	32
PID 2884 wrote to memory of 2784	2884	Unicorn-20921.exe	32
PID 2004 wrote to memory of 2996	2004	Unicorn-47268.exe	33
PID 2004 wrote to memory of 2996	2004	Unicorn-47268.exe	33
PID 2004 wrote to memory of 2996	2004	Unicorn-47268.exe	33
PID 2004 wrote to memory of 2996	2004	Unicorn-47268.exe	33
PID 2380 wrote to memory of 2704	2380	6641df0aac40e044594ad5affb7c0bd6760bba0a7bd38846f8f281e79bb8ad90N.exe	34
PID 2380 wrote to memory of 2704	2380	6641df0aac40e044594ad5affb7c0bd6760bba0a7bd38846f8f281e79bb8ad90N.exe	34
PID 2380 wrote to memory of 2704	2380	6641df0aac40e044594ad5affb7c0bd6760bba0a7bd38846f8f281e79bb8ad90N.exe	34
PID 2380 wrote to memory of 2704	2380	6641df0aac40e044594ad5affb7c0bd6760bba0a7bd38846f8f281e79bb8ad90N.exe	34
PID 1408 wrote to memory of 2776	1408	Unicorn-64840.exe	35
PID 1408 wrote to memory of 2776	1408	Unicorn-64840.exe	35
PID 1408 wrote to memory of 2776	1408	Unicorn-64840.exe	35
PID 1408 wrote to memory of 2776	1408	Unicorn-64840.exe	35
PID 2996 wrote to memory of 2532	2996	Unicorn-53392.exe	36
PID 2996 wrote to memory of 2532	2996	Unicorn-53392.exe	36
PID 2996 wrote to memory of 2532	2996	Unicorn-53392.exe	36
PID 2996 wrote to memory of 2532	2996	Unicorn-53392.exe	36
PID 2876 wrote to memory of 2656	2876	Unicorn-60138.exe	37
PID 2876 wrote to memory of 2656	2876	Unicorn-60138.exe	37
PID 2876 wrote to memory of 2656	2876	Unicorn-60138.exe	37
PID 2876 wrote to memory of 2656	2876	Unicorn-60138.exe	37
PID 2004 wrote to memory of 2612	2004	Unicorn-47268.exe	38
PID 2004 wrote to memory of 2612	2004	Unicorn-47268.exe	38
PID 2004 wrote to memory of 2612	2004	Unicorn-47268.exe	38
PID 2004 wrote to memory of 2612	2004	Unicorn-47268.exe	38
PID 2784 wrote to memory of 1356	2784	Unicorn-7720.exe	39
PID 2784 wrote to memory of 1356	2784	Unicorn-7720.exe	39
PID 2784 wrote to memory of 1356	2784	Unicorn-7720.exe	39
PID 2784 wrote to memory of 1356	2784	Unicorn-7720.exe	39
PID 2884 wrote to memory of 2320	2884	Unicorn-20921.exe	41
PID 2884 wrote to memory of 2320	2884	Unicorn-20921.exe	41
PID 2884 wrote to memory of 2320	2884	Unicorn-20921.exe	41
PID 2884 wrote to memory of 2320	2884	Unicorn-20921.exe	41
PID 2380 wrote to memory of 1872	2380	6641df0aac40e044594ad5affb7c0bd6760bba0a7bd38846f8f281e79bb8ad90N.exe	40
PID 2380 wrote to memory of 1872	2380	6641df0aac40e044594ad5affb7c0bd6760bba0a7bd38846f8f281e79bb8ad90N.exe	40
PID 2380 wrote to memory of 1872	2380	6641df0aac40e044594ad5affb7c0bd6760bba0a7bd38846f8f281e79bb8ad90N.exe	40
PID 2380 wrote to memory of 1872	2380	6641df0aac40e044594ad5affb7c0bd6760bba0a7bd38846f8f281e79bb8ad90N.exe	40
PID 2704 wrote to memory of 1792	2704	Unicorn-1782.exe	42
PID 2704 wrote to memory of 1792	2704	Unicorn-1782.exe	42
PID 2704 wrote to memory of 1792	2704	Unicorn-1782.exe	42
PID 2704 wrote to memory of 1792	2704	Unicorn-1782.exe	42
PID 2656 wrote to memory of 1256	2656	Unicorn-12004.exe	43
PID 2656 wrote to memory of 1256	2656	Unicorn-12004.exe	43
PID 2656 wrote to memory of 1256	2656	Unicorn-12004.exe	43
PID 2656 wrote to memory of 1256	2656	Unicorn-12004.exe	43

C:\Users\Admin\AppData\Local\Temp\6641df0aac40e044594ad5affb7c0bd6760bba0a7bd38846f8f281e79bb8ad90N.exe
"C:\Users\Admin\AppData\Local\Temp\6641df0aac40e044594ad5affb7c0bd6760bba0a7bd38846f8f281e79bb8ad90N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60138.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60138.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64840.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12134.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65482.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25190.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58745.exe
        8⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20112.exe
        9⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exe
        9⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42209.exe
        9⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1742.exe
        9⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34152.exe
        9⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        8⤵
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56309.exe
        8⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59745.exe
        8⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        8⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7141.exe
        7⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-436.exe
        8⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2083.exe
        8⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65001.exe
        8⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
        8⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21224.exe
        7⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53237.exe
        7⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48671.exe
        7⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        7⤵
        
        PID:6632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42412.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36540.exe
        7⤵
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60379.exe
        8⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61191.exe
        8⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19234.exe
        8⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27359.exe
        8⤵
        
        PID:1272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7489.exe
        7⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47372.exe
        7⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41685.exe
        7⤵
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7415.exe
        6⤵
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27165.exe
        7⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45510.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21493.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27090.exe
        6⤵
        
        PID:3728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23641.exe
        6⤵
        
        PID:4796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59336.exe
        6⤵
        
        PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26841.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23706.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30382.exe
        7⤵
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11082.exe
        8⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40177.exe
        8⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42078.exe
        8⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19223.exe
        8⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4952.exe
        7⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44911.exe
        7⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65498.exe
        7⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56866.exe
        7⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63230.exe
        7⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28220.exe
        6⤵
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39744.exe
        7⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42210.exe
        7⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7948.exe
        7⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56336.exe
        7⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        7⤵
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65139.exe
        6⤵
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12366.exe
        6⤵
        
        PID:3108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6589.exe
        6⤵
        
        PID:4664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20893.exe
        6⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43904.exe
        6⤵
        
        PID:6760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36875.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17768.exe
        6⤵
        
        PID:3060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7489.exe
        6⤵
        
        PID:3612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47372.exe
        6⤵
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57144.exe
        6⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61597.exe
        5⤵
        
        PID:2928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10451.exe
        6⤵
        
        PID:4980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3771.exe
        6⤵
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21493.exe
        6⤵
        
        PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51673.exe
        5⤵
        
        PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28036.exe
        5⤵
        
        PID:4488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49009.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12004.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23085.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18859.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22357.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36056.exe
        8⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24454.exe
        8⤵
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61752.exe
        8⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1716.exe
        8⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
        8⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51904.exe
        7⤵
        
        PID:532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5709.exe
        7⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48074.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58614.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        7⤵
        
        PID:6428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35739.exe
        6⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15194.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44572.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16484.exe
        7⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19223.exe
        7⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29925.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44055.exe
        6⤵
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39409.exe
        6⤵
        
        PID:4076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26785.exe
        6⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19223.exe
        6⤵
        
        PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49647.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62372.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39749.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59263.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9389.exe
        7⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25100.exe
        7⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
        7⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56754.exe
        6⤵
        
        PID:2188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11083.exe
        6⤵
        
        PID:4008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59745.exe
        6⤵
        
        PID:4740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58614.exe
        6⤵
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        6⤵
        
        PID:6588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16226.exe
        5⤵
        Executes dropped EXE
        
        PID:2008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50262.exe
        6⤵
        
        PID:1832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exe
        6⤵
        
        PID:872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42209.exe
        6⤵
        
        PID:4152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20363.exe
        6⤵
        
        PID:5228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48177.exe
        6⤵
        
        PID:6508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60874.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2909.exe
        5⤵
        
        PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22873.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59144.exe
        5⤵
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63230.exe
        5⤵
        
        PID:5288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26871.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42761.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59217.exe
        6⤵
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45521.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29242.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21224.exe
        6⤵
        
        PID:3820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40177.exe
        6⤵
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42078.exe
        6⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19223.exe
        6⤵
        
        PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51033.exe
        5⤵
        
        PID:1752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11082.exe
        6⤵
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2148.exe
        6⤵
        
        PID:3980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38486.exe
        6⤵
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16305.exe
        6⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48177.exe
        6⤵
        
        PID:6484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4952.exe
        5⤵
        
        PID:1740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16948.exe
        5⤵
        
        PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51080.exe
        5⤵
        
        PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16835.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24733.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32215.exe
        5⤵
        
        PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7489.exe
        5⤵
        
        PID:3668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47372.exe
        5⤵
        
        PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41685.exe
        5⤵
        
        PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
        5⤵
        
        PID:6572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41318.exe
      4⤵
      PID:1708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1889.exe
      4⤵
      PID:3744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45102.exe
      4⤵
      PID:4464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12019.exe
      4⤵
      PID:5132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53392.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53392.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31870.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-713.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18060.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56991.exe
        7⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11082.exe
        8⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62885.exe
        8⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53880.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9448.exe
        8⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
        8⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21224.exe
        7⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53237.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33019.exe
        7⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        7⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44118.exe
        6⤵
        
        PID:1536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27090.exe
        6⤵
        
        PID:3792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44572.exe
        6⤵
        
        PID:4312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32135.exe
        6⤵
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19223.exe
        6⤵
        
        PID:5324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36201.exe
        5⤵
        
        PID:1720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65529.exe
        6⤵
        
        PID:2840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42209.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1742.exe
        6⤵
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
        6⤵
        
        PID:6580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57923.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54239.exe
        5⤵
        
        PID:3940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39600.exe
        5⤵
        
        PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60970.exe
        5⤵
        
        PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57894.exe
        5⤵
        
        PID:6216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11024.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33327.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16979.exe
        6⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21853.exe
        7⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7948.exe
        7⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4596.exe
        7⤵
        
        PID:5352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7489.exe
        6⤵
        
        PID:3700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47372.exe
        6⤵
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41877.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
        6⤵
        
        PID:6348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13174.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33752.exe
        6⤵
        
        PID:2580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exe
        6⤵
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42209.exe
        6⤵
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1716.exe
        6⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
        6⤵
        
        PID:6596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1446.exe
        5⤵
        
        PID:1900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11574.exe
        5⤵
        
        PID:3428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39409.exe
        5⤵
        
        PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16835.exe
        5⤵
        
        PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43904.exe
        5⤵
        
        PID:6752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10393.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26916.exe
        5⤵
        
        PID:2540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63254.exe
        5⤵
        
        PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1094.exe
        5⤵
        
        PID:4924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58614.exe
        5⤵
        
        PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49983.exe
      4⤵
      PID:2552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1463.exe
        5⤵
        
        PID:1324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exe
        5⤵
        
        PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42209.exe
        5⤵
        
        PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16305.exe
        5⤵
        
        PID:5836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48177.exe
        5⤵
        
        PID:6492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56599.exe
      4⤵
      PID:3000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57573.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51125.exe
      4⤵
      PID:4648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35542.exe
      4⤵
      PID:6024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62095.exe
      4⤵
      PID:6152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21489.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21489.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11922.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62278.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54936.exe
        6⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46972.exe
        7⤵
        
        PID:1868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64820.exe
        7⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21661.exe
        7⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45664.exe
        6⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49265.exe
        7⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48017.exe
        7⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62348.exe
        7⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27359.exe
        7⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62652.exe
        6⤵
        
        PID:4084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45547.exe
        6⤵
        
        PID:4904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        6⤵
        
        PID:5920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38879.exe
        5⤵
        
        PID:2604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11082.exe
        6⤵
        
        PID:2768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33694.exe
        6⤵
        
        PID:4280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33211.exe
        6⤵
        
        PID:1488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        6⤵
        
        PID:6660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34936.exe
        5⤵
        
        PID:3096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3767.exe
        5⤵
        
        PID:3080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35685.exe
        5⤵
        
        PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43012.exe
        5⤵
        
        PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19223.exe
        5⤵
        
        PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10700.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58745.exe
        5⤵
        
        PID:2568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25397.exe
        6⤵
        
        PID:1660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11899.exe
        6⤵
        
        PID:4612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49732.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19223.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54016.exe
        5⤵
        
        PID:1372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38190.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48074.exe
        5⤵
        
        PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58614.exe
        5⤵
        
        PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        5⤵
        
        PID:6516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5417.exe
      4⤵
      PID:1704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44091.exe
        5⤵
        
        PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3272.exe
        5⤵
        
        PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57336.exe
        5⤵
        
        PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
        5⤵
        
        PID:6404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27090.exe
      4⤵
      PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44572.exe
      4⤵
      PID:4376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16484.exe
      4⤵
      PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19223.exe
      4⤵
      PID:5756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-230.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-230.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8718.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29944.exe
        5⤵
        
        PID:2376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7576.exe
        6⤵
        
        PID:2164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exe
        6⤵
        
        PID:3808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42209.exe
        6⤵
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1742.exe
        6⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
        6⤵
        
        PID:6536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45664.exe
        5⤵
        
        PID:868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-171.exe
        5⤵
        
        PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48284.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56866.exe
        5⤵
        
        PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63230.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35070.exe
      4⤵
      PID:2364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22014.exe
        5⤵
        
        PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24750.exe
        5⤵
        
        PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24971.exe
        5⤵
        
        PID:5844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64905.exe
        5⤵
        
        PID:6768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47568.exe
      4⤵
      PID:3172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13902.exe
      4⤵
      PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39070.exe
      4⤵
      PID:4580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65436.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19223.exe
      4⤵
      PID:5632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24396.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24396.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27251.exe
      4⤵
      PID:2116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7489.exe
      4⤵
      PID:3644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47372.exe
      4⤵
      PID:4384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41685.exe
      4⤵
      PID:936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
      4⤵
      PID:6792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57050.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57050.exe
    3⤵
    PID:1944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25763.exe
      4⤵
      PID:3952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28473.exe
      4⤵
      PID:5112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46398.exe
      4⤵
      PID:5972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3705.exe
      4⤵
      PID:6896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18954.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18954.exe
    3⤵
    PID:3604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23571.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23571.exe
    3⤵
    PID:4472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6876.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6876.exe
    3⤵
    PID:4236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62095.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62095.exe
    3⤵
    PID:6160
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20921.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20921.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7720.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7720.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43271.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30890.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30566.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45621.exe
        7⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9319.exe
        8⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43903.exe
        8⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1094.exe
        8⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58806.exe
        8⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30382.exe
        7⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21224.exe
        7⤵
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40177.exe
        7⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16835.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54946.exe
        6⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56754.exe
        7⤵
        
        PID:1128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11083.exe
        7⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59745.exe
        7⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43321.exe
        7⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9064.exe
        6⤵
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19160.exe
        6⤵
        
        PID:3340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55591.exe
        6⤵
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16964.exe
        6⤵
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63230.exe
        6⤵
        
        PID:6168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40684.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51807.exe
        6⤵
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27355.exe
        7⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33636.exe
        7⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35820.exe
        7⤵
        
        PID:4592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7489.exe
        6⤵
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47372.exe
        6⤵
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41685.exe
        6⤵
        
        PID:920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
        6⤵
        
        PID:6612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52859.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11082.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47711.exe
        6⤵
        
        PID:4140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25162.exe
        6⤵
        
        PID:4920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56336.exe
        6⤵
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        6⤵
        
        PID:6364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10817.exe
        5⤵
        
        PID:764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8283.exe
        5⤵
        
        PID:3860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34544.exe
        5⤵
        
        PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60078.exe
        5⤵
        
        PID:5668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57594.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8718.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47131.exe
        6⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46898.exe
        7⤵
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56704.exe
        7⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61388.exe
        7⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27359.exe
        7⤵
        
        PID:6044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56754.exe
        6⤵
        
        PID:2060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53576.exe
        6⤵
        
        PID:4120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16496.exe
        6⤵
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39800.exe
        6⤵
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19223.exe
        6⤵
        
        PID:5428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10078.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6019.exe
        6⤵
        
        PID:876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49997.exe
        6⤵
        
        PID:4056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42209.exe
        6⤵
        
        PID:4172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16305.exe
        6⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48177.exe
        6⤵
        
        PID:6500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61856.exe
        5⤵
        
        PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
        5⤵
        
        PID:4032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39409.exe
        5⤵
        
        PID:4188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42078.exe
        5⤵
        
        PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19223.exe
        5⤵
        
        PID:5404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3356.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16979.exe
        5⤵
        
        PID:2384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53841.exe
        6⤵
        
        PID:4200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5561.exe
        6⤵
        
        PID:2132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2047.exe
        6⤵
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27359.exe
        6⤵
        
        PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7489.exe
        5⤵
        
        PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48842.exe
        5⤵
        
        PID:4828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        5⤵
        
        PID:5992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65243.exe
        5⤵
        
        PID:6604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32775.exe
      4⤵
      PID:1700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11082.exe
        5⤵
        
        PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62885.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53880.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1742.exe
        5⤵
        
        PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59851.exe
        5⤵
        
        PID:6920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2152.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57285.exe
      4⤵
      PID:3936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
      4⤵
      PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37613.exe
      4⤵
      PID:5740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57894.exe
      4⤵
      PID:6192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8714.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8714.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30890.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18060.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60782.exe
        6⤵
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-437.exe
        7⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2598.exe
        7⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23040.exe
        7⤵
        
        PID:6888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7489.exe
        6⤵
        
        PID:3652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47372.exe
        6⤵
        
        PID:4368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50571.exe
        6⤵
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        6⤵
        
        PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12157.exe
        5⤵
        
        PID:1760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36493.exe
        6⤵
        
        PID:6948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21224.exe
        5⤵
        
        PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40177.exe
        5⤵
        
        PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35041.exe
        5⤵
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19223.exe
        5⤵
        
        PID:5776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62195.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58006.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53152.exe
        5⤵
        
        PID:1532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39409.exe
        5⤵
        
        PID:4180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16835.exe
        5⤵
        
        PID:5828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43712.exe
        5⤵
        
        PID:6620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2270.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53841.exe
        5⤵
        
        PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5561.exe
        5⤵
        
        PID:4692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59136.exe
        5⤵
        
        PID:5364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27090.exe
      4⤵
      PID:3800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23641.exe
      4⤵
      PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59144.exe
      4⤵
      PID:5684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16524.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50248.exe
        5⤵
        
        PID:304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60985.exe
        6⤵
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53970.exe
        6⤵
        
        PID:6728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7489.exe
        5⤵
        
        PID:3684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47372.exe
        5⤵
        
        PID:4400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50571.exe
        5⤵
        
        PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        5⤵
        
        PID:6292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30382.exe
      4⤵
      PID:1292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21224.exe
      4⤵
      PID:3836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53237.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33019.exe
      4⤵
      PID:4560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
      4⤵
      PID:5360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55729.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55729.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34812.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42341.exe
        5⤵
        
        PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7489.exe
      4⤵
      PID:3628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48842.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58614.exe
      4⤵
      PID:5128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
      4⤵
      PID:6356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4615.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4615.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53841.exe
      4⤵
      PID:4208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5561.exe
      4⤵
      PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17506.exe
      4⤵
      PID:5448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27359.exe
      4⤵
      PID:5936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1889.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1889.exe
    3⤵
    PID:3904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45102.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45102.exe
    3⤵
    PID:4508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12211.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12211.exe
    3⤵
    PID:5148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57894.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57894.exe
    3⤵
    PID:6200
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1782.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1782.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3027.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3027.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50441.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46119.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61139.exe
        6⤵
        
        PID:564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exe
        6⤵
        
        PID:3592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42209.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1716.exe
        6⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
        6⤵
        
        PID:6396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56754.exe
        5⤵
        
        PID:700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11083.exe
        5⤵
        
        PID:3984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59745.exe
        5⤵
        
        PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58614.exe
        5⤵
        
        PID:5156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        5⤵
        
        PID:6300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59502.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58006.exe
        5⤵
        
        PID:2640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57826.exe
        5⤵
        
        PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9137.exe
        5⤵
        
        PID:4656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50809.exe
        5⤵
        
        PID:4248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        5⤵
        
        PID:6412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54652.exe
      4⤵
      PID:2576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27090.exe
      4⤵
      PID:3776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44572.exe
      4⤵
      PID:4332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51101.exe
      4⤵
      PID:5636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63230.exe
      4⤵
      PID:5884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30325.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30325.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46887.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2755.exe
        5⤵
        
        PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49519.exe
        5⤵
        
        PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60766.exe
        5⤵
        
        PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1716.exe
        5⤵
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
        5⤵
        
        PID:6668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29293.exe
      4⤵
      PID:1876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40857.exe
      4⤵
      PID:3388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15017.exe
      4⤵
      PID:5000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20918.exe
      4⤵
      PID:5864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
      4⤵
      PID:6380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62107.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62107.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21201.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63439.exe
      4⤵
      PID:3092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44351.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58614.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
      4⤵
      PID:6340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9043.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9043.exe
    3⤵
    PID:2504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51911.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51911.exe
    3⤵
    PID:3392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39939.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39939.exe
    3⤵
    PID:4584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55506.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55506.exe
    3⤵
    PID:5824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58037.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58037.exe
    3⤵
    PID:6736
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28315.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28315.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62192.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62192.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55994.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
        5⤵
        
        PID:1436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6019.exe
        6⤵
        
        PID:1728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21960.exe
        6⤵
        
        PID:3944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15254.exe
        6⤵
        
        PID:4688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64016.exe
        6⤵
        
        PID:6032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        6⤵
        
        PID:6388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51691.exe
        5⤵
        
        PID:1540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63732.exe
        5⤵
        
        PID:4044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48074.exe
        5⤵
        
        PID:5104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58588.exe
        5⤵
        
        PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        5⤵
        
        PID:6652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31941.exe
      4⤵
      PID:1584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14093.exe
        5⤵
        
        PID:4264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59236.exe
        5⤵
        
        PID:5644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21224.exe
      4⤵
      PID:3912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53237.exe
      4⤵
      PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33019.exe
      4⤵
      PID:4576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
      4⤵
      PID:5780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55620.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55620.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60782.exe
      4⤵
      PID:2708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21853.exe
        5⤵
        
        PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28473.exe
        5⤵
        
        PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61414.exe
        5⤵
        
        PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27359.exe
        5⤵
        
        PID:5948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7489.exe
      4⤵
      PID:3660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47372.exe
      4⤵
      PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50571.exe
      4⤵
      PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
      4⤵
      PID:6252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1284.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1284.exe
    3⤵
    PID:2312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36056.exe
      4⤵
      PID:2316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24454.exe
      4⤵
      PID:3212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42209.exe
      4⤵
      PID:4320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1742.exe
      4⤵
      PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
      4⤵
      PID:6720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35791.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35791.exe
    3⤵
    PID:2628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35389.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35389.exe
    3⤵
    PID:3272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42416.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42416.exe
    3⤵
    PID:4304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60841.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60841.exe
    3⤵
    PID:6060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38569.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38569.exe
    3⤵
    PID:6744
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57102.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57102.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30566.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30566.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9274.exe
      4⤵
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50248.exe
        5⤵
        
        PID:1932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7489.exe
        5⤵
        
        PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47372.exe
        5⤵
        
        PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50571.exe
        5⤵
        
        PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        5⤵
        
        PID:6544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41996.exe
      4⤵
      PID:1288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13289.exe
        5⤵
        
        PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23217.exe
        5⤵
        
        PID:6284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54473.exe
      4⤵
      PID:3920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53237.exe
      4⤵
      PID:4516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34035.exe
      4⤵
      PID:5580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19223.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9720.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9720.exe
    3⤵
    PID:2100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39289.exe
      4⤵
      PID:2068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exe
      4⤵
      PID:3596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42209.exe
      4⤵
      PID:5084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16305.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48177.exe
      4⤵
      PID:6476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40842.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40842.exe
    3⤵
    PID:1988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57043.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57043.exe
    3⤵
    PID:3120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65350.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65350.exe
    3⤵
    PID:5092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35335.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35335.exe
    3⤵
    PID:5392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57894.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57894.exe
    3⤵
    PID:6208
- C:\Users\Admin\AppData\Local\Temp\Unicorn-82.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-82.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64181.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64181.exe
    3⤵
    PID:2264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26881.exe
      4⤵
      PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30167.exe
      4⤵
      PID:3304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60766.exe
      4⤵
      PID:4856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2676.exe
      4⤵
      PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
      4⤵
      PID:6176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38540.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38540.exe
    3⤵
    PID:2300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1444.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1444.exe
    3⤵
    PID:3236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57966.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57966.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42052.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42052.exe
    3⤵
    PID:5396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19223.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19223.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5208
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50345.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50345.exe
  2⤵
  PID:2812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36056.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36056.exe
    3⤵
    PID:2516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24454.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24454.exe
    3⤵
    PID:3184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42209.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42209.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1742.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1742.exe
    3⤵
    PID:5192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
    3⤵
    PID:6224
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6125.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6125.exe
  2⤵
  PID:2592
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9054.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9054.exe
  2⤵
  PID:3144
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17273.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17273.exe
  2⤵
  PID:4100
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8742.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8742.exe
  2⤵
  PID:5692
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16158.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16158.exe
  2⤵
  PID:5964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12004.exe

Filesize
468KB

MD5
1797c9fe8de2d6ab683655e8c2522463

SHA1
980b6d59fde59082fda9d14c298ae921cabb99b6

SHA256
3098c050f178003c69573321d887afdcf91365cb0b857c0ef67a0f906e9a0925

SHA512
0c4d2911a917fe22dab5e291e0ddca21168240061dba6e40d621df4aed6d826ff6928bcb2a228474e1b5c0f3aac5f892db6aac5a061dd9cd232e83a62524661e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12134.exe

Filesize
468KB

MD5
2c2096f2a968672ab5c92b157b8c9b65

SHA1
5b5ac51c066680c47b71eb39c6184f7f9760248c

SHA256
685dd1d395a840a5c2398cfd956711d87009edca44a422aa3dbb303dc6e47f6f

SHA512
22b1e3535c1cc8685780f4b4232e2f28ca1f3bf9b894925c6eb04e4125cacf13eda1032d747ac29f5db7733bc54d62772ec27fda220aa4609d6f8ec2b2481756

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1782.exe

Filesize
468KB

MD5
55818e60b623deb92371b459d7035a96

SHA1
22deeb0f3ec934bd860ea3d1d945f9a5058fb963

SHA256
a563f531695474812a6dd421e8153ad75a48e9cf9521d225a2b3c0cbeaa26f03

SHA512
af1e188f504b19161da5c09231762508efe1f3069129e50843d1e9ed79222559a7ffc134b4eac8ffefe0c89070240f367adea2c543da73d9e685343af81d2717

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21489.exe

Filesize
468KB

MD5
3659bf97bf607aca2b8e138163033a3e

SHA1
f809afce294854b302626cfb26c3ddb12a2f62ce

SHA256
a0236967865f147b11f0218b15b6a81fd42052deb46322700b4a4825e43afad2

SHA512
07a9317981ec6c335b3e46766db694f77af59704b209066cea71df538794717dfc09a3ac272238843f16708d3fc5014861c8ca761585894d6a25090546c12cf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23085.exe

Filesize
468KB

MD5
0b826b2166e444bf629d04a180990236

SHA1
92a982ecc0c4d027a8aff90107d61a917339da3d

SHA256
27fbd5e3d73274390f11d973d675521c53f3c7760859664c788c43ef587bf651

SHA512
d3c0b5462be84dfc035c5c2b94fdd9990929857cb6bc5383dd4af357e864363fd8e185b0ebf5372e2101f4a817e13bc54bbe395324a141e7b54997d2fcec3434

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33211.exe

Filesize
468KB

MD5
ac66d97d485aff2c1970315d543b13e5

SHA1
f82ec540556471b65f0b9cf2e6e8a39d273af8ed

SHA256
81fbec1c616a2c62fa27b04bd9846eb3df08d5e123ae68b10a941069a4f7e445

SHA512
40ac98b833a6b2f9170bf6c9909ca1e2b048429b13b5682a74529a1af7d46279490ceb58f44d459f8be993bbf99a854ba482a854aa8cd00a2f1c03150f037673

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42341.exe

Filesize
468KB

MD5
e8b2d1728deb124e4bea6f10fd018297

SHA1
cbde0653f6afecca3dcc2889ecd5c19df9065a8b

SHA256
e517ca4065b1c759022f669d866b28159d079d04d8e7e405a86f89b56947d201

SHA512
611b9484ed1c297841b9c0d6546450205e1a20a43b50bf820ddb2aa9db9a4c639aa43d1a53b9237b86cc56f047d207905fc0d778e9b19c7892a4d10de1c433ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43271.exe

Filesize
468KB

MD5
8c2c5dbfa752ca9a2dc3c0fc45e1deff

SHA1
3c46b3dab7676776ad07c97664ab85c157d55c4b

SHA256
caadb870b9074463a83f9d2ac76c249b0b5844ce000dafd75b7eb9197d2a2a60

SHA512
5b01b4d38128106a51194e023078454df24c6853138efa688b2f1d6ca243edd5cf22f6674806ad6d66a0ce95d339da32977884842d53366af7e20751af21dd12

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43321.exe

Filesize
468KB

MD5
e347cd2639c6b94febd97467e4181ea5

SHA1
4b1c69fb189c73bb055f65b12cdc5520fce33d67

SHA256
c60a2306dde6acf898fdb310bce0f60bc6a6dcb5ad99b175e085df24b3795c2f

SHA512
9dd161c4bf7d150e1130908cd957d14028a9a1abbf5aab3f446e195b25acebfc15fadec4b76c9fc4c1eb7dc47e6fbe3d240cd18155ba47f9e26a2977be4dea7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44118.exe

Filesize
468KB

MD5
6dfa773f3937c93d38c3c866f0487c88

SHA1
d0eb6d4e4321f7de9c11779e6401943bf3a1d33e

SHA256
1b3ffa5a39893c4a3a2ac116a16f7162ffa813ddd80b7e673fc90d9fb71b709a

SHA512
35a881138a69a1367c4b756a31f210df4205591cbb4e0d5b5ee929617be8f139c867218311cac1dd8ea06424318b73ee4885ad27d33dca5873cb51fe217d1dff

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20921.exe

Filesize
468KB

MD5
af6f28a26c6b3f25611f1825f2361deb

SHA1
0fd6225554efc4442673e0eba51eab84884be7a3

SHA256
5028593721290b767ba5da54ed28c0fb4b078d056b04ac03d3984173ad49cb33

SHA512
55b4cf3dad13c6d3dd53dd8b8ee432a9a9cb83566c6d349155912503effdc671495035ae599cfdbfde20365ba1e3df4977bef2579e3bdd79bc77738219fd9131

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26871.exe

Filesize
468KB

MD5
f6d980dffc0ad18f822a848258f1a8a3

SHA1
55e44ae41bc6e1cfa56c282c8d967605b70d172b

SHA256
7ee570186888929d390f5ed9ebecb66528aa2c0f7097e6ad22a5113ff4744615

SHA512
04236e6025d0727b3bf9e25c49e0b9bc0a82310d7b6a6f351811453e175084d5b2d359a5c8a8730456ba10d2abd8300b9040e699f53e30b86e3323c9f66562e3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28315.exe

Filesize
468KB

MD5
6372ddea439553b21472415a42b93ac9

SHA1
3ece8ace49c594a5b7d6c391d0198e68b0158ef3

SHA256
652f0bb1f7ce158e9e15515e5d03b488d6a61c7b5c1f5b06053424e5b89f42b4

SHA512
9158d15b230b88eaff179684d1772184adf037a190b04546b502a46f8b62c05b07ef4a496fc2d5defe9c88677532edd4219d66f14787930b3520abc0772179e9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3027.exe

Filesize
468KB

MD5
a19dd85b2f007a396d0e001ac250b759

SHA1
08bee2fb66fd927a5d1f414e0ccd61872ba77629

SHA256
ae54a985ac58fab17080c8d51eb72f5b39de9aa078523738d0162d840ed8d1a5

SHA512
75fae6cf7b8bc78867fda3f2e53dfa651580ebdcf2feec8583264ff04aa52fd7a58cab52fefc16b6671e64e8dce53fe1567f8d7792fc9c31669f2745677cd823

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31870.exe

Filesize
468KB

MD5
f3642c5eff7bf59e71097d6772d02982

SHA1
6b92fc867147a07d95b8235c42c43fe60cf006f2

SHA256
2dc8d9368b8fe81d5397470231bc2a4e335d4d37410f8eb21107f9cb35bd7458

SHA512
d986153bc6fac5fc3ead3f5d7fe9fb8fc263cdcda593f2b407dabd1f165de3d5989e6f4c115c9877f4210847e2e86aaafbd01b0f093631b8307c5eb86885f3ec

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe

Filesize
468KB

MD5
9ac45d33a0a3185aafced7965b165049

SHA1
c5820158e24f878e58cda063c6539f50236c5020

SHA256
c78c3415e98bb9f5b745d7884339346b57b31a1e0aeeb312afe981de2a3178cd

SHA512
3ecce1c429cecea3bbf7cc3841e89ca65e60e3f51efa991ae70e99032689730b6dfaae37986e6a4287879bae46c6b6cd7ce7efc03c68d427eb7589f0dc45a32c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53392.exe

Filesize
468KB

MD5
f7c2a41b8a0ad250587e975ae5e61de3

SHA1
ae8eb3c2b3e0624508d809faff99b50368f4c8e7

SHA256
e09278e312c853011e626c433efe740a70e63991d4ed1890491c1a81500777f1

SHA512
1fae3789d32ff26c87ca0830f60c354079e16f0a631b7b5dc17dc54dd71b3d194bbddbd0933c177b3160241501894a96ca0326d757ff295660b99719d8a0ca91

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60138.exe

Filesize
468KB

MD5
ace583baeeadb16c03da4ea528934392

SHA1
c1af6bb8faed55d9e88a82143eed9df124b4fa13

SHA256
dcb6b6004181909402f09a1704e3647ba86e0c38606d57bd54cc83ffcfa67fa3

SHA512
b9ecab05515fea9c0c8aa0dd3a32a0110ecab23934da2b52f27292c7113b791849673551a0c6d1a0ba79902a286be37a4e56da92225e7db4e45d9ac875a252a3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64840.exe

Filesize
468KB

MD5
755cedb9d62333901f277d3a728d975c

SHA1
d3a50e4a9841ba219d002cb4138ce6580315681c

SHA256
c22bb4794e131bd361e41448d7bf00a4428d530cfd882b18e05f1e0c360e78ea

SHA512
08f8d7f37e64ee9760808340ff8901648e7a44732faa5a41ba49b231bf90ffe4e7d7ac099efbb270d0950479008c474976901103157ed348cb39fa2a5c83429b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-65482.exe

Filesize
468KB

MD5
29bb2d345ae9bd010d2282ce6ab8b17c

SHA1
8f1329f3171454593ca6e540d002901c2968dc3d

SHA256
849481216bb524b671866c371e01edc08b6d52db743c5cd4c01ea816b6ee7642

SHA512
248490f49d1258198ceefb643a5aeb72b83ad208e869df5c85d4f5e666e8ecea6b2ecb90504739284366cf8a8f1af64468009a9df7b7ddce3b54e6473c3e2a69

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-7720.exe

Filesize
468KB

MD5
fab671f98c4445841d0b4b1f7ed2ce20

SHA1
991c1ee924fe97f5e39da9ef65bf29ce0d5cff35

SHA256
20ee92c497c180466213047c710276aba63281b1f296341e687db552d049ce85

SHA512
59ad9a0d881521fbdffc9773caf8ac9a6947bcef049f7a92391d8795ff810fb9e22617b7e05641d36a41706437a81dd45073132f7221700c578e771e460d626a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8714.exe

Filesize
468KB

MD5
f31b0e897ef612e4ebfba22d10345057

SHA1
021a7e1d753421390e8d9b35df8e8882bd29e14a

SHA256
0e3e0baec95ac489cfbfd6c463e45ae53adb49a51f30064eaeeb4aaa01509a14

SHA512
cd8cb42592cd9c87de1e57a24ef33e34e8a472f9a8d35d9d68c801b1685b1ea85833ddd302cfedbcdee3798cc9383b6f93b4c3c0b0d7c89b68c2cdc20c14f351

Download Submit