dcbe1a2e27fdb8c32541ab148e9ad9e9bf4aca2194b6e64a7a614cf8416f2f88

Analysis

max time kernel
111s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 22:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dcbe1a2e27fdb8c32541ab148e9ad9e9bf4aca2194b6e64a7a614cf8416f2f88N.exe
Size

468KB
MD5

16d0b29e0f09859093d0bbeb327b9310
SHA1

021a7cc52a7a9350551e75b09d35a67b6a26f9fa
SHA256

dcbe1a2e27fdb8c32541ab148e9ad9e9bf4aca2194b6e64a7a614cf8416f2f88
SHA512

3f01154fa27686f067c2cffd3a42e40b221963baa93592690d28ac5781af7494750343968353379600d5558f2425e029004edf47d6ebc8abe3e53d4d1454ff80
SSDEEP

3072:1GSHoglKI05TtbY2HzcOcf8/zChaPpptnLHeTVtNgq5LVCzgzSlL:1GKoe8TtxH4OcfufgNgqVczgz

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2392	Unicorn-25737.exe
2512	Unicorn-27958.exe
1956	Unicorn-38818.exe
2832	Unicorn-47392.exe
2820	Unicorn-23442.exe
2716	Unicorn-39224.exe
3068	Unicorn-24925.exe
2668	Unicorn-45529.exe
2172	Unicorn-9135.exe
672	Unicorn-55643.exe
2780	Unicorn-16483.exe
2980	Unicorn-16749.exe
2856	Unicorn-15933.exe
1912	Unicorn-35799.exe
2944	Unicorn-29668.exe
2308	Unicorn-51642.exe
2572	Unicorn-58419.exe
2112	Unicorn-50272.exe
1920	Unicorn-11277.exe
3016	Unicorn-5155.exe
844	Unicorn-46743.exe
1864	Unicorn-23173.exe
832	Unicorn-23438.exe
2496	Unicorn-39866.exe
2468	Unicorn-45996.exe
1788	Unicorn-41912.exe
1512	Unicorn-28897.exe
3032	Unicorn-40328.exe
824	Unicorn-60194.exe
1952	Unicorn-32160.exe
880	Unicorn-63100.exe
2688	Unicorn-23354.exe
2344	Unicorn-43220.exe
2412	Unicorn-59648.exe
2360	Unicorn-45166.exe
2420	Unicorn-56027.exe
2144	Unicorn-28830.exe
3012	Unicorn-35606.exe
2996	Unicorn-51123.exe
2724	Unicorn-12301.exe
2852	Unicorn-49805.exe
2656	Unicorn-4133.exe
2212	Unicorn-30675.exe
2012	Unicorn-30675.exe
1692	Unicorn-59364.exe
1108	Unicorn-37875.exe
2884	Unicorn-41143.exe
1940	Unicorn-13946.exe
1672	Unicorn-7816.exe
1292	Unicorn-11039.exe
2876	Unicorn-1694.exe
1296	Unicorn-1694.exe
2128	Unicorn-22669.exe
2624	Unicorn-33604.exe
2488	Unicorn-14501.exe
2228	Unicorn-64901.exe
2248	Unicorn-30091.exe
444	Unicorn-5321.exe
3020	Unicorn-16447.exe
2900	Unicorn-61777.exe
1064	Unicorn-25575.exe
908	Unicorn-10630.exe
2444	Unicorn-53509.exe
3060	Unicorn-20745.exe

Loads dropped DLL 64 IoCs

pid	Process
1728	dcbe1a2e27fdb8c32541ab148e9ad9e9bf4aca2194b6e64a7a614cf8416f2f88N.exe
1728	dcbe1a2e27fdb8c32541ab148e9ad9e9bf4aca2194b6e64a7a614cf8416f2f88N.exe
2392	Unicorn-25737.exe
1728	dcbe1a2e27fdb8c32541ab148e9ad9e9bf4aca2194b6e64a7a614cf8416f2f88N.exe
2392	Unicorn-25737.exe
1728	dcbe1a2e27fdb8c32541ab148e9ad9e9bf4aca2194b6e64a7a614cf8416f2f88N.exe
2512	Unicorn-27958.exe
2512	Unicorn-27958.exe
2392	Unicorn-25737.exe
2392	Unicorn-25737.exe
1956	Unicorn-38818.exe
1956	Unicorn-38818.exe
1728	dcbe1a2e27fdb8c32541ab148e9ad9e9bf4aca2194b6e64a7a614cf8416f2f88N.exe
1728	dcbe1a2e27fdb8c32541ab148e9ad9e9bf4aca2194b6e64a7a614cf8416f2f88N.exe
2832	Unicorn-47392.exe
2832	Unicorn-47392.exe
2512	Unicorn-27958.exe
2512	Unicorn-27958.exe
3068	Unicorn-24925.exe
3068	Unicorn-24925.exe
1728	dcbe1a2e27fdb8c32541ab148e9ad9e9bf4aca2194b6e64a7a614cf8416f2f88N.exe
2716	Unicorn-39224.exe
1728	dcbe1a2e27fdb8c32541ab148e9ad9e9bf4aca2194b6e64a7a614cf8416f2f88N.exe
2716	Unicorn-39224.exe
1956	Unicorn-38818.exe
2820	Unicorn-23442.exe
1956	Unicorn-38818.exe
2820	Unicorn-23442.exe
2392	Unicorn-25737.exe
2392	Unicorn-25737.exe
2668	Unicorn-45529.exe
2668	Unicorn-45529.exe
2832	Unicorn-47392.exe
2832	Unicorn-47392.exe
2172	Unicorn-9135.exe
2172	Unicorn-9135.exe
2512	Unicorn-27958.exe
2512	Unicorn-27958.exe
1912	Unicorn-35799.exe
1912	Unicorn-35799.exe
2820	Unicorn-23442.exe
2820	Unicorn-23442.exe
2392	Unicorn-25737.exe
2856	Unicorn-15933.exe
2392	Unicorn-25737.exe
2856	Unicorn-15933.exe
2780	Unicorn-16483.exe
1956	Unicorn-38818.exe
2780	Unicorn-16483.exe
1956	Unicorn-38818.exe
672	Unicorn-55643.exe
672	Unicorn-55643.exe
1728	dcbe1a2e27fdb8c32541ab148e9ad9e9bf4aca2194b6e64a7a614cf8416f2f88N.exe
1728	dcbe1a2e27fdb8c32541ab148e9ad9e9bf4aca2194b6e64a7a614cf8416f2f88N.exe
3068	Unicorn-24925.exe
2980	Unicorn-16749.exe
3068	Unicorn-24925.exe
2980	Unicorn-16749.exe
2716	Unicorn-39224.exe
2716	Unicorn-39224.exe
2308	Unicorn-51642.exe
2308	Unicorn-51642.exe
2572	Unicorn-58419.exe
2668	Unicorn-45529.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7348.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42647.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36782.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4204.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45996.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54579.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65303.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36782.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49309.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16483.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12993.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50272.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53976.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51178.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48234.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26406.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52641.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40864.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42675.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-88.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17446.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35799.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51079.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42647.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42709.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43707.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27442.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6556.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45532.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47129.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30701.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10802.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43045.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16999.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2301.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6055.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36782.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20265.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64901.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37391.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36788.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36782.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46743.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9135.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64373.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15090.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31575.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29309.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49751.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17128.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32759.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1728	dcbe1a2e27fdb8c32541ab148e9ad9e9bf4aca2194b6e64a7a614cf8416f2f88N.exe
2392	Unicorn-25737.exe
2512	Unicorn-27958.exe
1956	Unicorn-38818.exe
2832	Unicorn-47392.exe
3068	Unicorn-24925.exe
2716	Unicorn-39224.exe
2820	Unicorn-23442.exe
2668	Unicorn-45529.exe
2172	Unicorn-9135.exe
1912	Unicorn-35799.exe
672	Unicorn-55643.exe
2944	Unicorn-29668.exe
2780	Unicorn-16483.exe
2856	Unicorn-15933.exe
2980	Unicorn-16749.exe
2308	Unicorn-51642.exe
2572	Unicorn-58419.exe
2112	Unicorn-50272.exe
1920	Unicorn-11277.exe
3016	Unicorn-5155.exe
844	Unicorn-46743.exe
1864	Unicorn-23173.exe
832	Unicorn-23438.exe
2496	Unicorn-39866.exe
2468	Unicorn-45996.exe
1788	Unicorn-41912.exe
824	Unicorn-60194.exe
1952	Unicorn-32160.exe
1512	Unicorn-28897.exe
880	Unicorn-63100.exe
2688	Unicorn-23354.exe
2344	Unicorn-43220.exe
2412	Unicorn-59648.exe
2360	Unicorn-45166.exe
2420	Unicorn-56027.exe
2144	Unicorn-28830.exe
3012	Unicorn-35606.exe
2996	Unicorn-51123.exe
2852	Unicorn-49805.exe
2724	Unicorn-12301.exe
2656	Unicorn-4133.exe
2212	Unicorn-30675.exe
2012	Unicorn-30675.exe
1692	Unicorn-59364.exe
1108	Unicorn-37875.exe
2884	Unicorn-41143.exe
2876	Unicorn-1694.exe
1940	Unicorn-13946.exe
1672	Unicorn-7816.exe
1296	Unicorn-1694.exe
1292	Unicorn-11039.exe
2624	Unicorn-33604.exe
2128	Unicorn-22669.exe
2488	Unicorn-14501.exe
2228	Unicorn-64901.exe
2248	Unicorn-30091.exe
3020	Unicorn-16447.exe
444	Unicorn-5321.exe
2900	Unicorn-61777.exe
1064	Unicorn-25575.exe
908	Unicorn-10630.exe
2444	Unicorn-53509.exe
3060	Unicorn-20745.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2392	1728	dcbe1a2e27fdb8c32541ab148e9ad9e9bf4aca2194b6e64a7a614cf8416f2f88N.exe	30
PID 1728 wrote to memory of 2392	1728	dcbe1a2e27fdb8c32541ab148e9ad9e9bf4aca2194b6e64a7a614cf8416f2f88N.exe	30
PID 1728 wrote to memory of 2392	1728	dcbe1a2e27fdb8c32541ab148e9ad9e9bf4aca2194b6e64a7a614cf8416f2f88N.exe	30
PID 1728 wrote to memory of 2392	1728	dcbe1a2e27fdb8c32541ab148e9ad9e9bf4aca2194b6e64a7a614cf8416f2f88N.exe	30
PID 2392 wrote to memory of 2512	2392	Unicorn-25737.exe	31
PID 2392 wrote to memory of 2512	2392	Unicorn-25737.exe	31
PID 2392 wrote to memory of 2512	2392	Unicorn-25737.exe	31
PID 2392 wrote to memory of 2512	2392	Unicorn-25737.exe	31
PID 1728 wrote to memory of 1956	1728	dcbe1a2e27fdb8c32541ab148e9ad9e9bf4aca2194b6e64a7a614cf8416f2f88N.exe	32
PID 1728 wrote to memory of 1956	1728	dcbe1a2e27fdb8c32541ab148e9ad9e9bf4aca2194b6e64a7a614cf8416f2f88N.exe	32
PID 1728 wrote to memory of 1956	1728	dcbe1a2e27fdb8c32541ab148e9ad9e9bf4aca2194b6e64a7a614cf8416f2f88N.exe	32
PID 1728 wrote to memory of 1956	1728	dcbe1a2e27fdb8c32541ab148e9ad9e9bf4aca2194b6e64a7a614cf8416f2f88N.exe	32
PID 2512 wrote to memory of 2832	2512	Unicorn-27958.exe	34
PID 2512 wrote to memory of 2832	2512	Unicorn-27958.exe	34
PID 2512 wrote to memory of 2832	2512	Unicorn-27958.exe	34
PID 2512 wrote to memory of 2832	2512	Unicorn-27958.exe	34
PID 2392 wrote to memory of 2820	2392	Unicorn-25737.exe	35
PID 2392 wrote to memory of 2820	2392	Unicorn-25737.exe	35
PID 2392 wrote to memory of 2820	2392	Unicorn-25737.exe	35
PID 2392 wrote to memory of 2820	2392	Unicorn-25737.exe	35
PID 1956 wrote to memory of 2716	1956	Unicorn-38818.exe	36
PID 1956 wrote to memory of 2716	1956	Unicorn-38818.exe	36
PID 1956 wrote to memory of 2716	1956	Unicorn-38818.exe	36
PID 1956 wrote to memory of 2716	1956	Unicorn-38818.exe	36
PID 1728 wrote to memory of 3068	1728	dcbe1a2e27fdb8c32541ab148e9ad9e9bf4aca2194b6e64a7a614cf8416f2f88N.exe	37
PID 1728 wrote to memory of 3068	1728	dcbe1a2e27fdb8c32541ab148e9ad9e9bf4aca2194b6e64a7a614cf8416f2f88N.exe	37
PID 1728 wrote to memory of 3068	1728	dcbe1a2e27fdb8c32541ab148e9ad9e9bf4aca2194b6e64a7a614cf8416f2f88N.exe	37
PID 1728 wrote to memory of 3068	1728	dcbe1a2e27fdb8c32541ab148e9ad9e9bf4aca2194b6e64a7a614cf8416f2f88N.exe	37
PID 2832 wrote to memory of 2668	2832	Unicorn-47392.exe	38
PID 2832 wrote to memory of 2668	2832	Unicorn-47392.exe	38
PID 2832 wrote to memory of 2668	2832	Unicorn-47392.exe	38
PID 2832 wrote to memory of 2668	2832	Unicorn-47392.exe	38
PID 2512 wrote to memory of 2172	2512	Unicorn-27958.exe	39
PID 2512 wrote to memory of 2172	2512	Unicorn-27958.exe	39
PID 2512 wrote to memory of 2172	2512	Unicorn-27958.exe	39
PID 2512 wrote to memory of 2172	2512	Unicorn-27958.exe	39
PID 3068 wrote to memory of 672	3068	Unicorn-24925.exe	40
PID 3068 wrote to memory of 672	3068	Unicorn-24925.exe	40
PID 3068 wrote to memory of 672	3068	Unicorn-24925.exe	40
PID 3068 wrote to memory of 672	3068	Unicorn-24925.exe	40
PID 1728 wrote to memory of 2780	1728	dcbe1a2e27fdb8c32541ab148e9ad9e9bf4aca2194b6e64a7a614cf8416f2f88N.exe	41
PID 1728 wrote to memory of 2780	1728	dcbe1a2e27fdb8c32541ab148e9ad9e9bf4aca2194b6e64a7a614cf8416f2f88N.exe	41
PID 1728 wrote to memory of 2780	1728	dcbe1a2e27fdb8c32541ab148e9ad9e9bf4aca2194b6e64a7a614cf8416f2f88N.exe	41
PID 1728 wrote to memory of 2780	1728	dcbe1a2e27fdb8c32541ab148e9ad9e9bf4aca2194b6e64a7a614cf8416f2f88N.exe	41
PID 2716 wrote to memory of 2980	2716	Unicorn-39224.exe	42
PID 2716 wrote to memory of 2980	2716	Unicorn-39224.exe	42
PID 2716 wrote to memory of 2980	2716	Unicorn-39224.exe	42
PID 2716 wrote to memory of 2980	2716	Unicorn-39224.exe	42
PID 1956 wrote to memory of 2856	1956	Unicorn-38818.exe	43
PID 1956 wrote to memory of 2856	1956	Unicorn-38818.exe	43
PID 1956 wrote to memory of 2856	1956	Unicorn-38818.exe	43
PID 1956 wrote to memory of 2856	1956	Unicorn-38818.exe	43
PID 2820 wrote to memory of 1912	2820	Unicorn-23442.exe	44
PID 2820 wrote to memory of 1912	2820	Unicorn-23442.exe	44
PID 2820 wrote to memory of 1912	2820	Unicorn-23442.exe	44
PID 2820 wrote to memory of 1912	2820	Unicorn-23442.exe	44
PID 2392 wrote to memory of 2944	2392	Unicorn-25737.exe	45
PID 2392 wrote to memory of 2944	2392	Unicorn-25737.exe	45
PID 2392 wrote to memory of 2944	2392	Unicorn-25737.exe	45
PID 2392 wrote to memory of 2944	2392	Unicorn-25737.exe	45
PID 2668 wrote to memory of 2308	2668	Unicorn-45529.exe	46
PID 2668 wrote to memory of 2308	2668	Unicorn-45529.exe	46
PID 2668 wrote to memory of 2308	2668	Unicorn-45529.exe	46
PID 2668 wrote to memory of 2308	2668	Unicorn-45529.exe	46

C:\Users\Admin\AppData\Local\Temp\dcbe1a2e27fdb8c32541ab148e9ad9e9bf4aca2194b6e64a7a614cf8416f2f88N.exe
"C:\Users\Admin\AppData\Local\Temp\dcbe1a2e27fdb8c32541ab148e9ad9e9bf4aca2194b6e64a7a614cf8416f2f88N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25737.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25737.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27958.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27958.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47392.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45529.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51642.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63100.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61777.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31.exe
        9⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47696.exe
        9⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45444.exe
        9⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64177.exe
        8⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45667.exe
        9⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        9⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46465.exe
        8⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7836.exe
        8⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25575.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39451.exe
        8⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47146.exe
        9⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12366.exe
        9⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8687.exe
        9⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52994.exe
        8⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10840.exe
        8⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60582.exe
        7⤵
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9626.exe
        8⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3264.exe
        8⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        8⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31344.exe
        7⤵
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29959.exe
        7⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21530.exe
        7⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23354.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10630.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32731.exe
        8⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28568.exe
        9⤵
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14940.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        9⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9225.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34541.exe
        8⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33981.exe
        8⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60473.exe
        7⤵
        
        PID:892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7348.exe
        8⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        8⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38216.exe
        7⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6766.exe
        7⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2607.exe
        7⤵
        
        PID:6952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53509.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25488.exe
        7⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22639.exe
        8⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32175.exe
        9⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24992.exe
        9⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56149.exe
        8⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9682.exe
        8⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        8⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16459.exe
        7⤵
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16642.exe
        7⤵
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16862.exe
        6⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62472.exe
        7⤵
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20509.exe
        8⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49751.exe
        8⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1971.exe
        8⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46881.exe
        7⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23301.exe
        7⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17830.exe
        7⤵
        
        PID:6816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33168.exe
        6⤵
        
        PID:1312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16916.exe
        6⤵
        
        PID:3604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61216.exe
        6⤵
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12981.exe
        6⤵
        
        PID:5492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58419.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43220.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30859.exe
        7⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48788.exe
        8⤵
        
        PID:1472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-145.exe
        8⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        8⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45553.exe
        8⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45703.exe
        7⤵
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11846.exe
        7⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        7⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43665.exe
        6⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24969.exe
        7⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33393.exe
        7⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        7⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43031.exe
        7⤵
        
        PID:6840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57541.exe
        6⤵
        
        PID:2848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37151.exe
        6⤵
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5495.exe
        6⤵
        
        PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59648.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25466.exe
        6⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18062.exe
        7⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5542.exe
        8⤵
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49751.exe
        8⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45444.exe
        8⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10181.exe
        7⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55894.exe
        7⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        7⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59438.exe
        6⤵
        
        PID:2960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17711.exe
        6⤵
        
        PID:4784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33981.exe
        6⤵
        
        PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63266.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52138.exe
        6⤵
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7348.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        6⤵
        
        PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20265.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17700.exe
        5⤵
        
        PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34512.exe
        5⤵
        
        PID:5628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9135.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50272.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45166.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20745.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57257.exe
        8⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65433.exe
        9⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14940.exe
        9⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45444.exe
        9⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4343.exe
        8⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46274.exe
        8⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33981.exe
        8⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37391.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4347.exe
        7⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46274.exe
        7⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33981.exe
        7⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10993.exe
        6⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36645.exe
        7⤵
        
        PID:628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6943.exe
        7⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        7⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10742.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20976.exe
        6⤵
        
        PID:1796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52994.exe
        6⤵
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23301.exe
        6⤵
        
        PID:6044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52641.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56027.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27050.exe
        6⤵
        
        PID:1344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14888.exe
        7⤵
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19024.exe
        7⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64836.exe
        6⤵
        
        PID:3820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63486.exe
        6⤵
        
        PID:5032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        6⤵
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45808.exe
        5⤵
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52872.exe
        6⤵
        
        PID:2268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29309.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43720.exe
        6⤵
        
        PID:5184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43031.exe
        6⤵
        
        PID:6856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65303.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49285.exe
        5⤵
        
        PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37309.exe
        5⤵
        
        PID:6468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11277.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28830.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12384.exe
        6⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14278.exe
        7⤵
        
        PID:352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56149.exe
        7⤵
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9682.exe
        7⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36778.exe
        7⤵
        
        PID:6560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16779.exe
        6⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35595.exe
        7⤵
        
        PID:6168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20678.exe
        6⤵
        
        PID:4328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18858.exe
        6⤵
        
        PID:6096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2077.exe
        6⤵
        
        PID:6960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46380.exe
        5⤵
        
        PID:1600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17128.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57784.exe
        7⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14940.exe
        7⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        7⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30326.exe
        6⤵
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46274.exe
        6⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20243.exe
        6⤵
        
        PID:6620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56114.exe
        5⤵
        
        PID:1448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58251.exe
        6⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13190.exe
        6⤵
        
        PID:5288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        6⤵
        
        PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11950.exe
        5⤵
        
        PID:4224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23831.exe
        5⤵
        
        PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46613.exe
        5⤵
        
        PID:7000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51123.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58077.exe
        5⤵
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44621.exe
        6⤵
        
        PID:1796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34952.exe
        6⤵
        
        PID:1828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47129.exe
        6⤵
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31967.exe
        6⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3639.exe
        6⤵
        
        PID:6696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34869.exe
        5⤵
        
        PID:1576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26430.exe
        6⤵
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14940.exe
        6⤵
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45444.exe
        6⤵
        
        PID:6636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28467.exe
        5⤵
        
        PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3814.exe
        5⤵
        
        PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33981.exe
        5⤵
        
        PID:928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59453.exe
      4⤵
      PID:584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24969.exe
        5⤵
        
        PID:1328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29309.exe
        5⤵
        
        PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43720.exe
        5⤵
        
        PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43031.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7479.exe
      4⤵
      PID:2824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41007.exe
        5⤵
        
        PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60711.exe
        5⤵
        
        PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6439.exe
        5⤵
        
        PID:6732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29016.exe
      4⤵
      PID:4272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2301.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8030.exe
      4⤵
      PID:6808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23442.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23442.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35799.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5155.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12301.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33765.exe
        7⤵
        
        PID:1200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50267.exe
        8⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50659.exe
        9⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49751.exe
        9⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        9⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14457.exe
        8⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36844.exe
        8⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36778.exe
        8⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39145.exe
        7⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48504.exe
        7⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22865.exe
        7⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33981.exe
        7⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20998.exe
        6⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35226.exe
        7⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14940.exe
        7⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        7⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44062.exe
        6⤵
        
        PID:3216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3814.exe
        6⤵
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33981.exe
        6⤵
        
        PID:5908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49805.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42208.exe
        6⤵
        
        PID:876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58217.exe
        7⤵
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17550.exe
        7⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        7⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2160.exe
        7⤵
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6556.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47129.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18858.exe
        6⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3639.exe
        6⤵
        
        PID:6704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29855.exe
        5⤵
        
        PID:2844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8858.exe
        6⤵
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14940.exe
        6⤵
        
        PID:4640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        6⤵
        
        PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4893.exe
        5⤵
        
        PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25875.exe
        5⤵
        
        PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17446.exe
        5⤵
        
        PID:5888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46743.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4133.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51855.exe
        6⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8775.exe
        7⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23300.exe
        7⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        7⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52117.exe
        6⤵
        
        PID:3148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32759.exe
        6⤵
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        6⤵
        
        PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25767.exe
        5⤵
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42675.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63486.exe
        6⤵
        
        PID:4220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        6⤵
        
        PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46659.exe
        5⤵
        
        PID:2992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61614.exe
        6⤵
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        6⤵
        
        PID:6380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48915.exe
        5⤵
        
        PID:3164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60686.exe
        5⤵
        
        PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17446.exe
        5⤵
        
        PID:5644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30675.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27050.exe
        5⤵
        
        PID:1668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32561.exe
        6⤵
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1733.exe
        7⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49751.exe
        7⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        7⤵
        
        PID:5596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6943.exe
        6⤵
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        6⤵
        
        PID:6104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22.exe
        6⤵
        
        PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25715.exe
        5⤵
        
        PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43045.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49585.exe
        5⤵
        
        PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3639.exe
        5⤵
        
        PID:6688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10256.exe
      4⤵
      PID:1536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54159.exe
        5⤵
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36788.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23300.exe
        6⤵
        
        PID:4688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13414.exe
        5⤵
        
        PID:1792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37036.exe
        5⤵
        
        PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        5⤵
        
        PID:5360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4196.exe
      4⤵
      PID:1780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65433.exe
        5⤵
        
        PID:3840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19024.exe
        5⤵
        
        PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        5⤵
        
        PID:5868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39775.exe
      4⤵
      PID:3924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26406.exe
      4⤵
      PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12981.exe
      4⤵
      PID:5556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29668.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29668.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35606.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19733.exe
        5⤵
        
        PID:2696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47146.exe
        6⤵
        
        PID:4188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12366.exe
        6⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39688.exe
        6⤵
        
        PID:6892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61027.exe
        5⤵
        
        PID:3332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21083.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        5⤵
        
        PID:5472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13410.exe
      4⤵
      PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63186.exe
        5⤵
        
        PID:3872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19024.exe
        5⤵
        
        PID:5040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        5⤵
        
        PID:5532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11390.exe
      4⤵
      PID:3624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18283.exe
      4⤵
      PID:4604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48172.exe
      4⤵
      PID:6288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23173.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23173.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1694.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49006.exe
        5⤵
        
        PID:1348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50550.exe
        6⤵
        
        PID:4040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49751.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        6⤵
        
        PID:5280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43814.exe
        5⤵
        
        PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19055.exe
        5⤵
        
        PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33981.exe
        5⤵
        
        PID:5272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50630.exe
      4⤵
      PID:2196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-88.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-88.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49751.exe
        5⤵
        
        PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45444.exe
        5⤵
        
        PID:6416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46881.exe
      4⤵
      PID:4132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23301.exe
      4⤵
      PID:6036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17830.exe
      4⤵
      PID:6832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33604.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33604.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6738.exe
      4⤵
      PID:2712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51178.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54027.exe
        5⤵
        
        PID:4752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37918.exe
      4⤵
      PID:2924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32759.exe
      4⤵
      PID:4984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
      4⤵
      PID:2896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48755.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48755.exe
    3⤵
    PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39310.exe
      4⤵
      PID:2708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14940.exe
      4⤵
      PID:4572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
      4⤵
      PID:5816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41792.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41792.exe
    3⤵
    PID:3224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39685.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39685.exe
    3⤵
    PID:4288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7646.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7646.exe
    3⤵
    PID:4980
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38818.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38818.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39224.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39224.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16749.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60194.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59364.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39494.exe
        7⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27442.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45667.exe
        8⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        8⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30518.exe
        7⤵
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63486.exe
        7⤵
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        7⤵
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3292.exe
        6⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39044.exe
        7⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21083.exe
        7⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        7⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9142.exe
        6⤵
        
        PID:3284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65267.exe
        6⤵
        
        PID:4796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33981.exe
        6⤵
        
        PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41143.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51938.exe
        6⤵
        
        PID:700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31417.exe
        7⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7348.exe
        7⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        7⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50830.exe
        6⤵
        
        PID:3092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63486.exe
        6⤵
        
        PID:4156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        6⤵
        
        PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45808.exe
        5⤵
        
        PID:2088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11105.exe
        6⤵
        
        PID:3300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49751.exe
        6⤵
        
        PID:5084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1971.exe
        6⤵
        
        PID:6328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8702.exe
        5⤵
        
        PID:3448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34043.exe
        5⤵
        
        PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45477.exe
        5⤵
        
        PID:6284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32160.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37875.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11564.exe
        6⤵
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24484.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14940.exe
        7⤵
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        7⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49351.exe
        6⤵
        
        PID:3356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21083.exe
        6⤵
        
        PID:4412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        6⤵
        
        PID:5284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63842.exe
        5⤵
        
        PID:1844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17878.exe
        6⤵
        
        PID:3792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19024.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        6⤵
        
        PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11747.exe
        5⤵
        
        PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38625.exe
        5⤵
        
        PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5393.exe
        5⤵
        
        PID:5668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7816.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40864.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50000.exe
        6⤵
        
        PID:3564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13190.exe
        6⤵
        
        PID:5300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50939.exe
        5⤵
        
        PID:3652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16999.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        5⤵
        
        PID:6080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26785.exe
      4⤵
      PID:1032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36788.exe
        5⤵
        
        PID:2736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23300.exe
        5⤵
        
        PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45444.exe
        5⤵
        
        PID:6512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38740.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48234.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15778.exe
      4⤵
      PID:6608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15933.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15933.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23438.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1694.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50931.exe
        6⤵
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16233.exe
        7⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3264.exe
        7⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        7⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64373.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34541.exe
        6⤵
        
        PID:4776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33981.exe
        6⤵
        
        PID:5896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28289.exe
        5⤵
        
        PID:1756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22831.exe
        6⤵
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54634.exe
        7⤵
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14940.exe
        7⤵
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        7⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8702.exe
        6⤵
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32759.exe
        6⤵
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        6⤵
        
        PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6394.exe
        5⤵
        
        PID:1036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52994.exe
        5⤵
        
        PID:4464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10193.exe
        5⤵
        
        PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17830.exe
        5⤵
        
        PID:6824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22669.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60473.exe
        5⤵
        
        PID:2608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56648.exe
        6⤵
        
        PID:5392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32003.exe
        5⤵
        
        PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25875.exe
        5⤵
        
        PID:4748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17446.exe
        5⤵
        
        PID:5848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54579.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5158.exe
        5⤵
        
        PID:1640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45667.exe
        5⤵
        
        PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        5⤵
        
        PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4204.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44150.exe
      4⤵
      PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34512.exe
      4⤵
      PID:5744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39866.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39866.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64901.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40624.exe
        5⤵
        
        PID:2200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50000.exe
        6⤵
        
        PID:3552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14940.exe
        6⤵
        
        PID:1724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exe
        5⤵
        
        PID:3688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22865.exe
        5⤵
        
        PID:4856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64708.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50163.exe
      4⤵
      PID:2240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31575.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63486.exe
        5⤵
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36778.exe
        5⤵
        
        PID:6528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63270.exe
      4⤵
      PID:3008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52994.exe
      4⤵
      PID:4452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23301.exe
      4⤵
      PID:6012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51079.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5321.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5321.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46567.exe
      4⤵
      PID:2456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47146.exe
        5⤵
        
        PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64795.exe
        5⤵
        
        PID:1120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4877.exe
        5⤵
        
        PID:7016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10648.exe
      4⤵
      PID:3512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32759.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
      4⤵
      PID:5592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48519.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48519.exe
    3⤵
    PID:2764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23522.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23522.exe
    3⤵
    PID:3720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26406.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26406.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43707.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43707.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6296
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24925.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24925.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55643.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55643.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41912.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30091.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-774.exe
        6⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22154.exe
        7⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13190.exe
        7⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46731.exe
        7⤵
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15090.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34043.exe
        6⤵
        
        PID:4800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17446.exe
        6⤵
        
        PID:5528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13899.exe
        5⤵
        
        PID:1308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36788.exe
        6⤵
        
        PID:2940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23300.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49309.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41540.exe
        5⤵
        
        PID:2120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42709.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33981.exe
        5⤵
        
        PID:5344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16447.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14989.exe
        5⤵
        
        PID:988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45581.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21838.exe
        7⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33393.exe
        6⤵
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22.exe
        6⤵
        
        PID:6364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23577.exe
        5⤵
        
        PID:2700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20678.exe
        5⤵
        
        PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31967.exe
        5⤵
        
        PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49023.exe
        5⤵
        
        PID:6264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53976.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22180.exe
        5⤵
        
        PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14940.exe
        5⤵
        
        PID:4680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        5⤵
        
        PID:5892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54749.exe
      4⤵
      PID:3988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1748.exe
      4⤵
      PID:4512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40328.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40328.exe
    3⤵
    - Executes dropped EXE
    PID:3032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30675.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30675.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4491.exe
      4⤵
      PID:2324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45532.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49751.exe
        5⤵
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        5⤵
        
        PID:1364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56777.exe
      4⤵
      PID:3324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63486.exe
      4⤵
      PID:5108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
      4⤵
      PID:5224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34953.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34953.exe
    3⤵
    PID:1028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17787.exe
      4⤵
      PID:1592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47146.exe
        5⤵
        
        PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29984.exe
        5⤵
        
        PID:5216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6439.exe
        5⤵
        
        PID:6740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61027.exe
      4⤵
      PID:3264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36844.exe
      4⤵
      PID:4832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
      4⤵
      PID:6072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10802.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10802.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26430.exe
      4⤵
      PID:3676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14940.exe
      4⤵
      PID:4620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
      4⤵
      PID:5752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55427.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55427.exe
    3⤵
    PID:3236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26406.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26406.exe
    3⤵
    PID:2340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12981.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12981.exe
    3⤵
    PID:5768
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16483.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16483.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45996.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45996.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44242.exe
      4⤵
      PID:2156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50843.exe
        5⤵
        
        PID:2644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47146.exe
        6⤵
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12366.exe
        6⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6439.exe
        6⤵
        
        PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30684.exe
        5⤵
        
        PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28675.exe
        5⤵
        
        PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24100.exe
      4⤵
      PID:888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30701.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27623.exe
        5⤵
        
        PID:5540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48915.exe
      4⤵
      PID:3248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38216.exe
      4⤵
      PID:4140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6766.exe
      4⤵
      PID:6028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34896.exe
      4⤵
      PID:6872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14501.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14501.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40624.exe
      4⤵
      PID:1908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17520.exe
        5⤵
        
        PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14940.exe
        5⤵
        
        PID:952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45444.exe
        5⤵
        
        PID:6504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23340.exe
      4⤵
      PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36539.exe
      4⤵
      PID:5452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17446.exe
      4⤵
      PID:5136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20919.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20919.exe
    3⤵
    PID:916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48246.exe
      4⤵
      PID:3776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40409.exe
      4⤵
      PID:5336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
      4⤵
      PID:5504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18899.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18899.exe
    3⤵
    PID:3828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25875.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25875.exe
    3⤵
    PID:4732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17446.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17446.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5856
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28897.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28897.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13946.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13946.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8684.exe
      4⤵
      PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2410.exe
        5⤵
        
        PID:1056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29309.exe
        5⤵
        
        PID:4524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43720.exe
        5⤵
        
        PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12304.exe
        5⤵
        
        PID:6724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2965.exe
      4⤵
      PID:856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47129.exe
      4⤵
      PID:4376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18858.exe
      4⤵
      PID:6140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3639.exe
      4⤵
      PID:6712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13899.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13899.exe
    3⤵
    PID:1476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60306.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60306.exe
      4⤵
      PID:3368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7348.exe
      4⤵
      PID:4880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45444.exe
      4⤵
      PID:6536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27341.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27341.exe
    3⤵
    PID:3592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42709.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42709.exe
    3⤵
    PID:4816
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11039.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11039.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44621.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44621.exe
    3⤵
    PID:1740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65049.exe
      4⤵
      PID:3536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49751.exe
      4⤵
      PID:5000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6055.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55298.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55298.exe
    3⤵
    PID:3580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15547.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15547.exe
    3⤵
    PID:5380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38065.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38065.exe
    3⤵
    PID:5700
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38167.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38167.exe
  2⤵
  PID:2152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20162.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20162.exe
    3⤵
    PID:5580
- C:\Users\Admin\AppData\Local\Temp\Unicorn-583.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-583.exe
  2⤵
  PID:3528
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30266.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30266.exe
  2⤵
  PID:4368
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42572.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42572.exe
  2⤵
  PID:6320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11747.exe

Filesize
468KB

MD5
a736e91e40210ba0be87907b6e579d70

SHA1
ce33fb8518d0783547714fdfcab6539693e3ca9e

SHA256
be656b85aedbee0e45319dad491d32c9ccb6e1fcac42471415cdfde82ffd1347

SHA512
c43a7176f86e07942ca0bc37e51bc354a0bbb997a664fe21d98eff62c5c875d1b7a9d5be361cd795738fa9e65c98f25663bc530e54b5703b2c7921538c8ddf2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16483.exe

Filesize
468KB

MD5
d73a698803dd752c895c217eeb19ef42

SHA1
e42c21cfc8650e53780188a64525e8d0c16cfdf7

SHA256
e735bf5d9b4f6b5b42daaafc18e8683501cc27fdcd87bf537003fa6ffed926a1

SHA512
794f35cf2436a33a051fe65149839bc54b552561867cfa77177dff8138064f46a6e3acd6e3e75184aa869eca15a49f1e2886020618102873244de8b03daf015d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20162.exe

Filesize
468KB

MD5
26dcced7fa4d109a530daebaf6e204e4

SHA1
568e8a53e0822fa1e3404eba3e8cdff8dcd7a700

SHA256
abb4dfd7b1441d231fcf4eb9bce5818fe6086255cb076ee9a8a4435b9135fb22

SHA512
7ec1131aafee85dc4b41418278271125dd1a2d2a405a7781e3958601424106e60f546c290e9ccb890bfa4eacb5ec62f3b45958a10f3792928ae2ea6ddb4b298f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23442.exe

Filesize
468KB

MD5
cac5c82aecf71f0225fc95ee4ff5b442

SHA1
487c276ba51290f77107747c15037a2633b86ad8

SHA256
d73bcf461f0305f30f866f27be9d2263c55d766063aef8d07d69ac9727a2fc4e

SHA512
adee72fa88a8693fa0aadfddc5ac8f4ecc7cb244b69712f7129c24368826665a632442b5e4060e4982492d2b8879bf558ad6f0565b1b9f220d86e05a358d9a31

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35799.exe

Filesize
468KB

MD5
5a67fb7b5df03f6d912bd0d7054ce6e1

SHA1
4b74d83944541e6def971de92912675747bd227a

SHA256
8a59185682cdf5668b70f703448fa7714d97e2d8068c745531b6072e0d082d4a

SHA512
7c66c0f5b5ee36a6689026d5fe34a5dfb0f5a5a59cff85814b720bc11e53083a618e85d184ad74d1fc28df317f71c5e548ef5596a7bb64b228454febbe2bb467

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5542.exe

Filesize
468KB

MD5
40c0521720cf7a7159bf2041bf13e6cc

SHA1
2070bd487285b497160c80a583717196324d666f

SHA256
b6a72331d60db5a82098227dc2b7dd822943820f69be72b8643930482d947057

SHA512
6d19330ee0eedb02f8b2d10fac694974b30e42a8c22820cc09c0c012236d6c6d7ad5523d5d8fc1d80a1c0df9914dbb08fd760fbcd1c8fb194bc61234f5d6a0de

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-11277.exe

Filesize
468KB

MD5
6f9a284ff8f029a7ffa9bb5d012552e9

SHA1
9efc8261ecda8899fd1e8f1a27089a1ffd305327

SHA256
6e234000155808eef861db27f4ac59a0eda88e4cf265b30d9d865ab1cb775e4f

SHA512
e761a2d276f4ad8e617d3e46e7e392334a279aa60d693847810c6ae4b9005875371d2a0f0c9c9bd35217cb25dd36589430b64f08db04f26fb3b6b1fbd80ebf03

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15933.exe

Filesize
468KB

MD5
75cd1fdec1fe4c9fac5c8c8ccf5fa738

SHA1
23c7dac0020210b1c60d588e9ad1a4917535d6b3

SHA256
1eb7d811b113547c10653592fd6a5bff18d63e4eea3a7336463f07dd64315eba

SHA512
6d3b409f6741209f32257ff1d82028283aff147875e7137f2a1ee811b8548b0442abe3ac2bbc65f15a4e6992755f432c47fda33d3b4a8b529bd4d2b20ae9e67d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16749.exe

Filesize
468KB

MD5
2e790f15fccb11d823b626fba4ba16f4

SHA1
a13501255ec647fd88ca691ec57688d29607c280

SHA256
1bf8d66eb9a50b77a45b863afd63cc78f6bbcf9b01253a37988fd4a92e17e396

SHA512
7f9b34f07fd99133b08f1e8d54a8945fd64015dbe49c5b9953c409a9be5b5da9345a22d04357de14655e17a7605b063d9419b9f3555ecaeef25a3d09509ed086

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24925.exe

Filesize
468KB

MD5
c5f67003926555666dde08dfc0137263

SHA1
b283f72bf5464d87446fd5a91e21600949ee38a0

SHA256
214ce1df8591960686b81a79402213b3d6c5e8ebdffa1e2dacaf1fffc0bbb34f

SHA512
e9b50feb06c04798531778bdec7ff74cf08e1fc795e5e5bce5776661ade697c189b730db05537fa354f26c5c03881312f2bd805447a7791f81505cbaf17b2df1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25737.exe

Filesize
468KB

MD5
ff4d747b4c6157a516fd4177d7e063e9

SHA1
6620bbd4b7ab6a41166b38f170243d456e65e1cb

SHA256
4178f237ed8732d06d87c478ea6d577b8d8ad708998f2d2197138ccce8da9482

SHA512
a457443a99e94200d59bb841e83e371db6b5dfe64dff96e75ab2495d113e4a35d8df38f33b2385bada4251f6c761b6f44e4c0842efc354d5a98f022965cfc44b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27958.exe

Filesize
468KB

MD5
9739c8bcdc8ff08d61e562a80a2fa5b1

SHA1
163265d6812ba03be6c9ccb6b3a65ad933b6076b

SHA256
d69409172e7fd40fab74ff40967a4e9b9a14f5183f44778a5ce957730fb35164

SHA512
fc6daa4f621cf431ee276fb5769f6c440681998ae35b8c81ec60d338961d55fe148277ef436eba22c95204c9bc36bf6e8af56c9cd6793e16eabccef63311b7c5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29668.exe

Filesize
468KB

MD5
f3937d20c03f42367234b4217019aa56

SHA1
9d5100993d270689b87a112a7ad89bfc67474f77

SHA256
cd85e2bc285e03a350343b8cb3dca397c868281f84b6822d78c83816ee03e5e5

SHA512
0c79982ba1424d99c210766557720a836d2d8a16260a0cc7f15849be2bd75361c78b58a34928219e84117c2093190e4e23553151de5fa1d8cdf4350b7c220e57

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38818.exe

Filesize
468KB

MD5
8106454a2250be550a65790e081708f6

SHA1
f5369ad9caf6ad2172f427a2839bee53b51b542d

SHA256
f59de2acd4025dc4f0535fc9911a0d996752dd6f99cdb6ec83a88e99aa276c20

SHA512
d52837b02d969c86778c045cb1fc111efcc5ce385f5b94847cf29347d8e9cbabb5670922129263b25aafd9f1aa6c6b6c18e83b97b22373d02b8d5223f4aa8a07

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-39224.exe

Filesize
468KB

MD5
bc4ec392987245c5f01daec2783f9e57

SHA1
cadba6d2c50b446dc89a4fbb6b1ac2d5f10d500c

SHA256
b8f516913308f193a647fc32b41e0dad8081ec70eb1bc498ed99e26ec4d253fc

SHA512
5f51cf14e5d08c72379b06ef0ec86d58348f5f75b0c1b0dc888050b113ec202b5d61601e978a22a9b404f866216c23196777e695f75ba8c6239bcd71530e2c22

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45529.exe

Filesize
468KB

MD5
3cbe9cf527581e908660b4261cd9bccc

SHA1
09c3efc1e48641fbdcac97bd3e40799729323c5e

SHA256
b43f6f7c9322c14cb4c215948f853a879e52fa6bf0f08df5fd8920d6ac111c33

SHA512
628a1b2a753217e930cfc72ad7ee82f3e4eba75af0055571fe14df6befe5757248e92ffea236600f38e2d8f970ce36dd8087879e5830177e839fe050ff6f09c0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47392.exe

Filesize
468KB

MD5
5fc185fc4c9fc491911fd9f5805bb829

SHA1
facceb4fe3b097807119c796e1c2839dfc9c121c

SHA256
2b8270ab30646b8a708e0db6b461cc26d1f9a5c6cc9079ebca98ef5bc2b7301b

SHA512
48b2b980d8852c829630d715791fbe5febc3a72da212a1707c7a0c55c8ff97e0cde930157c98200f9ad72af0f5a52437aeb9307bbcb89961154c238052a13e38

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-50272.exe

Filesize
468KB

MD5
5325f1857d044367f71808aa393b58ae

SHA1
4b06e66243631ae6eda07771383919777136779a

SHA256
6d1667dcac55db0fe216ca94b9a3c5ffef7085641984a550fcae9ef5421f002f

SHA512
abb13e762e9f3b85b786648622f8d27483b1a447e70b7bffdb15e590c99b19bf024aac9b1d2bbe5a9f7f484d3354d882aadd8cba977f4f26548a20852ee8a505

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51642.exe

Filesize
468KB

MD5
412876b83dec70c8a251d032b7b3973c

SHA1
c70626d87cb25146f67074a0f5f180ac11c68cd7

SHA256
863c2be0bb429a1963ac34a8cf83f569426cf2bc60807a6805fc68e4d9fed9d2

SHA512
7abd446c375c6ceed5b3e4948eed7851a306e55a053d27563ee843fe6ad9e07ab74873e7b1da3056a840ee46f72a4ba9222200239295cc3a7f2e82f96d187a4e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55643.exe

Filesize
468KB

MD5
9f8eea31e811a9ef501a107e55e74476

SHA1
cccde6d94da366db8d2620835d630c68b0d29199

SHA256
01849d59bdca51441d98ffff971642a7971419861a194181921d9d943071ddd1

SHA512
7f2f5cbc59f50b3a55ff803d5e6f7f9489494bb20b253ebf4321adb0daf47afdd20800687070dd2b32c29b0d77daf5ccc920b7a8b078627e7c6303a611c263dd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58419.exe

Filesize
468KB

MD5
f18b9cf110f0f9963e61a0734c7cc66c

SHA1
d5c4be21c2d5f029488863aab0016443e20c4c3d

SHA256
63c18c1394cb7d48e2e96c4f2bc9aa6b856da5d5f0f4359ec98dbc28ad63a594

SHA512
1ae03e1abe66f335af7960f0018072ae74644bcfbf953385e5c2f0c98904bf6696658a22e1149b46586069781bc60b887d6638ddf967bb5bca583b58e2e1a437

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9135.exe

Filesize
468KB

MD5
76cf3bf4b73025142f4c403ebf1b8d30

SHA1
25a4f9c49d12d94d56f949770607efdf64c25cb2

SHA256
3179d81de67f403bcfdd461a78a8159b89091f58aa0d6e2d37c0184980129fe3

SHA512
586a294b294ff5e15f88a99c9b686b8e92109a87635e6690519f276bf04df84da07dec8a9de286f8ceb12ad8fffb8bc215ca795625ce11808eeb09eeaf4f4317

Download Submit