39c4a068d6c40eb145157fab54fc5af795fd89288f68a527ca51ba5aa9a29dca

Analysis

max time kernel
120s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 12:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39c4a068d6c40eb145157fab54fc5af795fd89288f68a527ca51ba5aa9a29dcaN.exe
Size

468KB
MD5

1d4c444134db966a3f024ea021202d00
SHA1

c0430959e195783b06bd0689bdd1a8f595299553
SHA256

39c4a068d6c40eb145157fab54fc5af795fd89288f68a527ca51ba5aa9a29dca
SHA512

a51cf65eab391cbf173a37a69c29a8aa104d2e1082d520412cbd3c674786bc1f3a44b6e10499c1b8b87b57e31040159c1a39da39ad9c83560366f89f76641bd1
SSDEEP

3072:46elogxaId5fFbYZPzcfmbfD/D2AnsIH/QmyeZVqp9QQkkdDuxulj:464oCbfFCP4fmbfaa1y9QJ8Dux

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1988	Unicorn-40843.exe
2064	Unicorn-495.exe
2756	Unicorn-28529.exe
2992	Unicorn-13235.exe
2956	Unicorn-64474.exe
2696	Unicorn-5067.exe
2572	Unicorn-1730.exe
2232	Unicorn-56907.exe
2628	Unicorn-8261.exe
1572	Unicorn-55454.exe
1824	Unicorn-18698.exe
1736	Unicorn-22782.exe
1600	Unicorn-2916.exe
2952	Unicorn-22325.exe
296	Unicorn-16459.exe
2252	Unicorn-56881.exe
2500	Unicorn-53544.exe
1060	Unicorn-60773.exe
1688	Unicorn-58727.exe
1340	Unicorn-15657.exe
904	Unicorn-21447.exe
1760	Unicorn-16809.exe
1636	Unicorn-37037.exe
1776	Unicorn-37591.exe
3028	Unicorn-24785.exe
1624	Unicorn-15854.exe
1984	Unicorn-16617.exe
2108	Unicorn-10486.exe
1248	Unicorn-45013.exe
2476	Unicorn-53928.exe
1724	Unicorn-24328.exe
1756	Unicorn-12999.exe
1868	Unicorn-31181.exe
2076	Unicorn-37312.exe
2860	Unicorn-13362.exe
1064	Unicorn-54395.exe
2824	Unicorn-34572.exe
2664	Unicorn-9802.exe
2176	Unicorn-10067.exe
2584	Unicorn-2262.exe
2600	Unicorn-25143.exe
2920	Unicorn-44778.exe
2456	Unicorn-16783.exe
1972	Unicorn-33865.exe
1384	Unicorn-20675.exe
1616	Unicorn-47409.exe
1508	Unicorn-34427.exe
316	Unicorn-56693.exe
676	Unicorn-58739.exe
1660	Unicorn-58739.exe
2880	Unicorn-57785.exe
768	Unicorn-33081.exe
2812	Unicorn-54463.exe
1008	Unicorn-18261.exe
2212	Unicorn-38127.exe
440	Unicorn-50742.exe
2412	Unicorn-33851.exe
2876	Unicorn-33851.exe
2892	Unicorn-26762.exe
1872	Unicorn-7161.exe
2520	Unicorn-27027.exe
568	Unicorn-51894.exe
2904	Unicorn-27197.exe
1692	Unicorn-63207.exe

Loads dropped DLL 64 IoCs

pid	Process
2468	39c4a068d6c40eb145157fab54fc5af795fd89288f68a527ca51ba5aa9a29dcaN.exe
2468	39c4a068d6c40eb145157fab54fc5af795fd89288f68a527ca51ba5aa9a29dcaN.exe
2468	39c4a068d6c40eb145157fab54fc5af795fd89288f68a527ca51ba5aa9a29dcaN.exe
2468	39c4a068d6c40eb145157fab54fc5af795fd89288f68a527ca51ba5aa9a29dcaN.exe
1988	Unicorn-40843.exe
1988	Unicorn-40843.exe
2064	Unicorn-495.exe
2064	Unicorn-495.exe
2468	39c4a068d6c40eb145157fab54fc5af795fd89288f68a527ca51ba5aa9a29dcaN.exe
2468	39c4a068d6c40eb145157fab54fc5af795fd89288f68a527ca51ba5aa9a29dcaN.exe
2756	Unicorn-28529.exe
2756	Unicorn-28529.exe
1988	Unicorn-40843.exe
1988	Unicorn-40843.exe
2696	Unicorn-5067.exe
2696	Unicorn-5067.exe
2756	Unicorn-28529.exe
2756	Unicorn-28529.exe
2992	Unicorn-13235.exe
2992	Unicorn-13235.exe
2064	Unicorn-495.exe
2572	Unicorn-1730.exe
2956	Unicorn-64474.exe
2572	Unicorn-1730.exe
2956	Unicorn-64474.exe
2064	Unicorn-495.exe
2468	39c4a068d6c40eb145157fab54fc5af795fd89288f68a527ca51ba5aa9a29dcaN.exe
2468	39c4a068d6c40eb145157fab54fc5af795fd89288f68a527ca51ba5aa9a29dcaN.exe
1988	Unicorn-40843.exe
1988	Unicorn-40843.exe
2232	Unicorn-56907.exe
2232	Unicorn-56907.exe
2696	Unicorn-5067.exe
2696	Unicorn-5067.exe
2628	Unicorn-8261.exe
2628	Unicorn-8261.exe
2756	Unicorn-28529.exe
2756	Unicorn-28529.exe
1572	Unicorn-55454.exe
1572	Unicorn-55454.exe
2992	Unicorn-13235.exe
2992	Unicorn-13235.exe
1824	Unicorn-18698.exe
1824	Unicorn-18698.exe
2952	Unicorn-22325.exe
2952	Unicorn-22325.exe
2572	Unicorn-1730.exe
2572	Unicorn-1730.exe
2468	39c4a068d6c40eb145157fab54fc5af795fd89288f68a527ca51ba5aa9a29dcaN.exe
1600	Unicorn-2916.exe
1600	Unicorn-2916.exe
2468	39c4a068d6c40eb145157fab54fc5af795fd89288f68a527ca51ba5aa9a29dcaN.exe
2064	Unicorn-495.exe
2064	Unicorn-495.exe
1736	Unicorn-22782.exe
296	Unicorn-16459.exe
296	Unicorn-16459.exe
1736	Unicorn-22782.exe
2956	Unicorn-64474.exe
2956	Unicorn-64474.exe
1988	Unicorn-40843.exe
1988	Unicorn-40843.exe
2500	Unicorn-53544.exe
2500	Unicorn-53544.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7551.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45264.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24785.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44685.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32448.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47869.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37701.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33997.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29082.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26230.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63610.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1505.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8340.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50613.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57342.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43422.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42766.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15854.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53928.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43767.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3969.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13312.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6090.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47099.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8261.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42787.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22336.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10156.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23155.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38022.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14608.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21533.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48035.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56700.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61800.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46529.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44660.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61426.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46110.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29517.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44222.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54161.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64953.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26034.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15399.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63610.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47099.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58973.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34427.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33851.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35138.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16838.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27034.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7551.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2468	39c4a068d6c40eb145157fab54fc5af795fd89288f68a527ca51ba5aa9a29dcaN.exe
1988	Unicorn-40843.exe
2756	Unicorn-28529.exe
2064	Unicorn-495.exe
2696	Unicorn-5067.exe
2956	Unicorn-64474.exe
2992	Unicorn-13235.exe
2572	Unicorn-1730.exe
2232	Unicorn-56907.exe
2628	Unicorn-8261.exe
1572	Unicorn-55454.exe
1736	Unicorn-22782.exe
1824	Unicorn-18698.exe
2952	Unicorn-22325.exe
1600	Unicorn-2916.exe
296	Unicorn-16459.exe
2500	Unicorn-53544.exe
2252	Unicorn-56881.exe
1060	Unicorn-60773.exe
1688	Unicorn-58727.exe
1340	Unicorn-15657.exe
904	Unicorn-21447.exe
1760	Unicorn-16809.exe
1636	Unicorn-37037.exe
1776	Unicorn-37591.exe
2476	Unicorn-53928.exe
1624	Unicorn-15854.exe
1984	Unicorn-16617.exe
3028	Unicorn-24785.exe
2108	Unicorn-10486.exe
1724	Unicorn-24328.exe
1248	Unicorn-45013.exe
1756	Unicorn-12999.exe
1868	Unicorn-31181.exe
2076	Unicorn-37312.exe
1064	Unicorn-54395.exe
2860	Unicorn-13362.exe
2824	Unicorn-34572.exe
2176	Unicorn-10067.exe
2664	Unicorn-9802.exe
2584	Unicorn-2262.exe
2600	Unicorn-25143.exe
2920	Unicorn-44778.exe
2456	Unicorn-16783.exe
1972	Unicorn-33865.exe
1384	Unicorn-20675.exe
1616	Unicorn-47409.exe
1508	Unicorn-34427.exe
316	Unicorn-56693.exe
1660	Unicorn-58739.exe
676	Unicorn-58739.exe
2880	Unicorn-57785.exe
768	Unicorn-33081.exe
2812	Unicorn-54463.exe
1008	Unicorn-18261.exe
2212	Unicorn-38127.exe
440	Unicorn-50742.exe
2876	Unicorn-33851.exe
2412	Unicorn-33851.exe
1872	Unicorn-7161.exe
2520	Unicorn-27027.exe
2892	Unicorn-26762.exe
568	Unicorn-51894.exe
2904	Unicorn-27197.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 1988	2468	39c4a068d6c40eb145157fab54fc5af795fd89288f68a527ca51ba5aa9a29dcaN.exe	30
PID 2468 wrote to memory of 1988	2468	39c4a068d6c40eb145157fab54fc5af795fd89288f68a527ca51ba5aa9a29dcaN.exe	30
PID 2468 wrote to memory of 1988	2468	39c4a068d6c40eb145157fab54fc5af795fd89288f68a527ca51ba5aa9a29dcaN.exe	30
PID 2468 wrote to memory of 1988	2468	39c4a068d6c40eb145157fab54fc5af795fd89288f68a527ca51ba5aa9a29dcaN.exe	30
PID 2468 wrote to memory of 2064	2468	39c4a068d6c40eb145157fab54fc5af795fd89288f68a527ca51ba5aa9a29dcaN.exe	31
PID 2468 wrote to memory of 2064	2468	39c4a068d6c40eb145157fab54fc5af795fd89288f68a527ca51ba5aa9a29dcaN.exe	31
PID 2468 wrote to memory of 2064	2468	39c4a068d6c40eb145157fab54fc5af795fd89288f68a527ca51ba5aa9a29dcaN.exe	31
PID 2468 wrote to memory of 2064	2468	39c4a068d6c40eb145157fab54fc5af795fd89288f68a527ca51ba5aa9a29dcaN.exe	31
PID 1988 wrote to memory of 2756	1988	Unicorn-40843.exe	32
PID 1988 wrote to memory of 2756	1988	Unicorn-40843.exe	32
PID 1988 wrote to memory of 2756	1988	Unicorn-40843.exe	32
PID 1988 wrote to memory of 2756	1988	Unicorn-40843.exe	32
PID 2064 wrote to memory of 2992	2064	Unicorn-495.exe	33
PID 2064 wrote to memory of 2992	2064	Unicorn-495.exe	33
PID 2064 wrote to memory of 2992	2064	Unicorn-495.exe	33
PID 2064 wrote to memory of 2992	2064	Unicorn-495.exe	33
PID 2468 wrote to memory of 2956	2468	39c4a068d6c40eb145157fab54fc5af795fd89288f68a527ca51ba5aa9a29dcaN.exe	34
PID 2468 wrote to memory of 2956	2468	39c4a068d6c40eb145157fab54fc5af795fd89288f68a527ca51ba5aa9a29dcaN.exe	34
PID 2468 wrote to memory of 2956	2468	39c4a068d6c40eb145157fab54fc5af795fd89288f68a527ca51ba5aa9a29dcaN.exe	34
PID 2468 wrote to memory of 2956	2468	39c4a068d6c40eb145157fab54fc5af795fd89288f68a527ca51ba5aa9a29dcaN.exe	34
PID 2756 wrote to memory of 2696	2756	Unicorn-28529.exe	35
PID 2756 wrote to memory of 2696	2756	Unicorn-28529.exe	35
PID 2756 wrote to memory of 2696	2756	Unicorn-28529.exe	35
PID 2756 wrote to memory of 2696	2756	Unicorn-28529.exe	35
PID 1988 wrote to memory of 2572	1988	Unicorn-40843.exe	36
PID 1988 wrote to memory of 2572	1988	Unicorn-40843.exe	36
PID 1988 wrote to memory of 2572	1988	Unicorn-40843.exe	36
PID 1988 wrote to memory of 2572	1988	Unicorn-40843.exe	36
PID 2696 wrote to memory of 2232	2696	Unicorn-5067.exe	37
PID 2696 wrote to memory of 2232	2696	Unicorn-5067.exe	37
PID 2696 wrote to memory of 2232	2696	Unicorn-5067.exe	37
PID 2696 wrote to memory of 2232	2696	Unicorn-5067.exe	37
PID 2756 wrote to memory of 2628	2756	Unicorn-28529.exe	38
PID 2756 wrote to memory of 2628	2756	Unicorn-28529.exe	38
PID 2756 wrote to memory of 2628	2756	Unicorn-28529.exe	38
PID 2756 wrote to memory of 2628	2756	Unicorn-28529.exe	38
PID 2992 wrote to memory of 1572	2992	Unicorn-13235.exe	39
PID 2992 wrote to memory of 1572	2992	Unicorn-13235.exe	39
PID 2992 wrote to memory of 1572	2992	Unicorn-13235.exe	39
PID 2992 wrote to memory of 1572	2992	Unicorn-13235.exe	39
PID 2572 wrote to memory of 1824	2572	Unicorn-1730.exe	41
PID 2572 wrote to memory of 1824	2572	Unicorn-1730.exe	41
PID 2572 wrote to memory of 1824	2572	Unicorn-1730.exe	41
PID 2572 wrote to memory of 1824	2572	Unicorn-1730.exe	41
PID 2956 wrote to memory of 1736	2956	Unicorn-64474.exe	42
PID 2956 wrote to memory of 1736	2956	Unicorn-64474.exe	42
PID 2956 wrote to memory of 1736	2956	Unicorn-64474.exe	42
PID 2956 wrote to memory of 1736	2956	Unicorn-64474.exe	42
PID 2064 wrote to memory of 1600	2064	Unicorn-495.exe	40
PID 2064 wrote to memory of 1600	2064	Unicorn-495.exe	40
PID 2064 wrote to memory of 1600	2064	Unicorn-495.exe	40
PID 2064 wrote to memory of 1600	2064	Unicorn-495.exe	40
PID 2468 wrote to memory of 2952	2468	39c4a068d6c40eb145157fab54fc5af795fd89288f68a527ca51ba5aa9a29dcaN.exe	43
PID 2468 wrote to memory of 2952	2468	39c4a068d6c40eb145157fab54fc5af795fd89288f68a527ca51ba5aa9a29dcaN.exe	43
PID 2468 wrote to memory of 2952	2468	39c4a068d6c40eb145157fab54fc5af795fd89288f68a527ca51ba5aa9a29dcaN.exe	43
PID 2468 wrote to memory of 2952	2468	39c4a068d6c40eb145157fab54fc5af795fd89288f68a527ca51ba5aa9a29dcaN.exe	43
PID 1988 wrote to memory of 296	1988	Unicorn-40843.exe	44
PID 1988 wrote to memory of 296	1988	Unicorn-40843.exe	44
PID 1988 wrote to memory of 296	1988	Unicorn-40843.exe	44
PID 1988 wrote to memory of 296	1988	Unicorn-40843.exe	44
PID 2232 wrote to memory of 2252	2232	Unicorn-56907.exe	45
PID 2232 wrote to memory of 2252	2232	Unicorn-56907.exe	45
PID 2232 wrote to memory of 2252	2232	Unicorn-56907.exe	45
PID 2232 wrote to memory of 2252	2232	Unicorn-56907.exe	45

C:\Users\Admin\AppData\Local\Temp\39c4a068d6c40eb145157fab54fc5af795fd89288f68a527ca51ba5aa9a29dcaN.exe
"C:\Users\Admin\AppData\Local\Temp\39c4a068d6c40eb145157fab54fc5af795fd89288f68a527ca51ba5aa9a29dcaN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40843.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40843.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28529.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28529.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5067.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56907.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56881.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27197.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63472.exe
        8⤵
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20689.exe
        8⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7551.exe
        8⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47099.exe
        8⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63610.exe
        8⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16838.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55942.exe
        7⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48035.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23155.exe
        7⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21765.exe
        7⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13362.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40405.exe
        7⤵
        
        PID:236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28335.exe
        8⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11038.exe
        8⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26034.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38022.exe
        8⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64430.exe
        8⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8469.exe
        7⤵
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64654.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7551.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26761.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15561.exe
        7⤵
        
        PID:6332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10045.exe
        6⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54790.exe
        7⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6435.exe
        7⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56508.exe
        7⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61800.exe
        7⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29463.exe
        7⤵
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49865.exe
        6⤵
        
        PID:1920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51361.exe
        6⤵
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31499.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62330.exe
        6⤵
        
        PID:4172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17022.exe
        6⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36565.exe
        6⤵
        
        PID:7144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53544.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12999.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63207.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe
        8⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54161.exe
        8⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36633.exe
        8⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34740.exe
        8⤵
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38553.exe
        8⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59964.exe
        8⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35033.exe
        7⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16470.exe
        7⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35782.exe
        7⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23155.exe
        7⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21765.exe
        7⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31089.exe
        6⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34479.exe
        7⤵
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43767.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13720.exe
        7⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8654.exe
        7⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58443.exe
        7⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25561.exe
        7⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60912.exe
        6⤵
        
        PID:1728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50732.exe
        6⤵
        
        PID:3364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19247.exe
        6⤵
        
        PID:4656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62330.exe
        6⤵
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29082.exe
        6⤵
        
        PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31181.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64551.exe
        6⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        7⤵
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2735.exe
        7⤵
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44448.exe
        7⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61800.exe
        7⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21487.exe
        7⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19274.exe
        7⤵
        
        PID:6240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47177.exe
        6⤵
        
        PID:1632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24254.exe
        6⤵
        
        PID:3248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56534.exe
        6⤵
        
        PID:3996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60147.exe
        6⤵
        
        PID:824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60016.exe
        6⤵
        
        PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30545.exe
        5⤵
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28335.exe
        6⤵
        
        PID:1432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6954.exe
        6⤵
        
        PID:3356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26034.exe
        6⤵
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50083.exe
        6⤵
        
        PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42435.exe
        5⤵
        
        PID:1788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53212.exe
        5⤵
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35431.exe
        5⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1625.exe
        5⤵
        
        PID:2444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16430.exe
        5⤵
        
        PID:5460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8261.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60773.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37312.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14120.exe
        7⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54161.exe
        7⤵
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56700.exe
        7⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61800.exe
        7⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33547.exe
        7⤵
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18121.exe
        6⤵
        
        PID:1504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4210.exe
        6⤵
        
        PID:3452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18365.exe
        6⤵
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23155.exe
        6⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21765.exe
        6⤵
        
        PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54395.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
        6⤵
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26716.exe
        7⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61338.exe
        7⤵
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7551.exe
        7⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47099.exe
        7⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63610.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8469.exe
        6⤵
        
        PID:1768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32448.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7551.exe
        6⤵
        
        PID:4736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47099.exe
        6⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63610.exe
        6⤵
        
        PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29614.exe
        5⤵
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1505.exe
        6⤵
        
        PID:2492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54161.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56700.exe
        6⤵
        
        PID:4680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61800.exe
        6⤵
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21487.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19274.exe
        6⤵
        
        PID:6232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5516.exe
        5⤵
        
        PID:1580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17370.exe
        5⤵
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59922.exe
        5⤵
        
        PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56593.exe
        5⤵
        
        PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37442.exe
        5⤵
        
        PID:5952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41910.exe
        5⤵
        
        PID:6892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58727.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34572.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43446.exe
        6⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13103.exe
        7⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36633.exe
        7⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34740.exe
        7⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54697.exe
        7⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23208.exe
        7⤵
        
        PID:6552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8194.exe
        6⤵
        
        PID:2420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7010.exe
        6⤵
        
        PID:3796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43566.exe
        6⤵
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22625.exe
        6⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26230.exe
        6⤵
        
        PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35090.exe
        5⤵
        
        PID:604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29517.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5423.exe
        5⤵
        
        PID:3580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
        5⤵
        
        PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62330.exe
        5⤵
        
        PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29082.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9802.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42486.exe
        5⤵
        
        PID:1956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11640.exe
        6⤵
        
        PID:344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3969.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7551.exe
        6⤵
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47099.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63610.exe
        6⤵
        
        PID:6116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43606.exe
        5⤵
        
        PID:1304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22471.exe
        5⤵
        
        PID:3448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29421.exe
        5⤵
        
        PID:4664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38553.exe
        5⤵
        
        PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41900.exe
        5⤵
        
        PID:7120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47152.exe
      4⤵
      PID:1700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24303.exe
        5⤵
        
        PID:4028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33591.exe
        5⤵
        
        PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15399.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38765.exe
        5⤵
        
        PID:6140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe
      4⤵
      PID:940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4740.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13900.exe
      4⤵
      PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61827.exe
      4⤵
      PID:5184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20630.exe
      4⤵
      PID:5836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1730.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1730.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18698.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16809.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16783.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-654.exe
        7⤵
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38723.exe
        7⤵
        
        PID:3812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36633.exe
        7⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34740.exe
        7⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17764.exe
        7⤵
        
        PID:4112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5293.exe
        6⤵
        
        PID:1092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60026.exe
        6⤵
        
        PID:3648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48035.exe
        6⤵
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23155.exe
        6⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21765.exe
        6⤵
        
        PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33865.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47997.exe
        6⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9118.exe
        7⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38827.exe
        7⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54076.exe
        7⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58748.exe
        7⤵
        
        PID:1348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45693.exe
        6⤵
        
        PID:3204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37301.exe
        6⤵
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7551.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47099.exe
        6⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63610.exe
        6⤵
        
        PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6262.exe
        5⤵
        
        PID:1144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28335.exe
        6⤵
        
        PID:3088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47795.exe
        6⤵
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26034.exe
        6⤵
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38022.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64430.exe
        6⤵
        
        PID:6340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25714.exe
        5⤵
        
        PID:3124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13312.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47887.exe
        5⤵
        
        PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37442.exe
        5⤵
        
        PID:5960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37591.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20675.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28667.exe
        6⤵
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63420.exe
        6⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13553.exe
        7⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43423.exe
        7⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61617.exe
        7⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36633.exe
        6⤵
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34740.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46529.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22205.exe
        5⤵
        
        PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52459.exe
        5⤵
        
        PID:3800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20098.exe
        5⤵
        
        PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51806.exe
        5⤵
        
        PID:4108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17022.exe
        5⤵
        
        PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57945.exe
        5⤵
        
        PID:6204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47409.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19134.exe
        5⤵
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8246.exe
        6⤵
        
        PID:2652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54161.exe
        6⤵
        
        PID:3768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56700.exe
        6⤵
        
        PID:4712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61800.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21487.exe
        6⤵
        
        PID:4856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63431.exe
        6⤵
        
        PID:7104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57810.exe
        5⤵
        
        PID:2220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52843.exe
        5⤵
        
        PID:3684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34998.exe
        5⤵
        
        PID:3336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25337.exe
        5⤵
        
        PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38553.exe
        5⤵
        
        PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41900.exe
        5⤵
        
        PID:7128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14400.exe
      4⤵
      PID:2636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15725.exe
        5⤵
        
        PID:764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58812.exe
        5⤵
        
        PID:3484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37701.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31291.exe
        5⤵
        
        PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42766.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17785.exe
      4⤵
      PID:888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53212.exe
      4⤵
      PID:3532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47776.exe
      4⤵
      PID:3296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43422.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20763.exe
      4⤵
      PID:5552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58010.exe
      4⤵
      PID:5032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16459.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16459.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45013.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27027.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1505.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21895.exe
        7⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7722.exe
        7⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28858.exe
        8⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17865.exe
        7⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34481.exe
        7⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51360.exe
        6⤵
        
        PID:3592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36005.exe
        6⤵
        
        PID:4328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61800.exe
        6⤵
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39295.exe
        6⤵
        
        PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59429.exe
        5⤵
        
        PID:2676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42127.exe
        5⤵
        
        PID:3232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19585.exe
        5⤵
        
        PID:3184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65526.exe
        5⤵
        
        PID:4256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41907.exe
        5⤵
        
        PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3239.exe
        5⤵
        
        PID:6900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51894.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25159.exe
        5⤵
        
        PID:2096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54161.exe
        5⤵
        
        PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56700.exe
        5⤵
        
        PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61800.exe
        5⤵
        
        PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21487.exe
        5⤵
        
        PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19274.exe
        5⤵
        
        PID:6216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44685.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22336.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10920.exe
      4⤵
      PID:1276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25382.exe
      4⤵
      PID:5080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29082.exe
      4⤵
      PID:5688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24328.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24328.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58739.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe
        5⤵
        
        PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31101.exe
        5⤵
        
        PID:3144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47887.exe
        5⤵
        
        PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47629.exe
        5⤵
        
        PID:5560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59144.exe
        5⤵
        
        PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35033.exe
      4⤵
      PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60026.exe
      4⤵
      PID:3656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48035.exe
      4⤵
      PID:4520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45264.exe
      4⤵
      PID:4988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46529.exe
      4⤵
      PID:5880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57785.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57785.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30945.exe
      4⤵
      PID:2536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58812.exe
      4⤵
      PID:3472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37701.exe
      4⤵
      PID:4376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31291.exe
      4⤵
      PID:5176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42766.exe
      4⤵
      PID:5784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39028.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39028.exe
    3⤵
    PID:2784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51891.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51891.exe
    3⤵
    PID:3628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27034.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27034.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35464.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35464.exe
    3⤵
    PID:4228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23863.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23863.exe
    3⤵
    PID:5640
- C:\Users\Admin\AppData\Local\Temp\Unicorn-495.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-495.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13235.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13235.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55454.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10067.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1645.exe
        7⤵
        
        PID:324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14608.exe
        8⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58812.exe
        8⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37701.exe
        8⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31291.exe
        8⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42766.exe
        8⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53420.exe
        7⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26555.exe
        7⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25337.exe
        7⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50613.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22620.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54458.exe
        7⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23565.exe
        7⤵
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1686.exe
        7⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55764.exe
        7⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14608.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61426.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17889.exe
        6⤵
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47887.exe
        6⤵
        
        PID:4956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37442.exe
        6⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20421.exe
        6⤵
        
        PID:6932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2262.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56082.exe
        6⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1505.exe
        7⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10519.exe
        7⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50669.exe
        7⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64728.exe
        7⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42950.exe
        7⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47177.exe
        6⤵
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60026.exe
        6⤵
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48035.exe
        6⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45264.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38553.exe
        6⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41900.exe
        6⤵
        
        PID:7136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41592.exe
        5⤵
        
        PID:1032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28335.exe
        6⤵
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6954.exe
        6⤵
        
        PID:3308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1686.exe
        6⤵
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55764.exe
        6⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14608.exe
        6⤵
        
        PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42787.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1354.exe
        5⤵
        
        PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20872.exe
        5⤵
        
        PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        5⤵
        
        PID:6084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40765.exe
        5⤵
        
        PID:7080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21447.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25143.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21354.exe
        6⤵
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33997.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44425.exe
        7⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61243.exe
        7⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11374.exe
        7⤵
        
        PID:6876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26838.exe
        6⤵
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43166.exe
        6⤵
        
        PID:4008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64423.exe
        6⤵
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10226.exe
        6⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32627.exe
        6⤵
        
        PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32953.exe
        5⤵
        
        PID:2160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62487.exe
        5⤵
        
        PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31333.exe
        5⤵
        
        PID:1268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32281.exe
        5⤵
        
        PID:5044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5761.exe
        5⤵
        
        PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5761.exe
        5⤵
        
        PID:6272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44778.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32983.exe
        5⤵
        
        PID:1272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5621.exe
        6⤵
        
        PID:4548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11690.exe
        6⤵
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45566.exe
        6⤵
        
        PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51836.exe
        5⤵
        
        PID:3264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27339.exe
        5⤵
        
        PID:4316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23155.exe
        5⤵
        
        PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21765.exe
        5⤵
        
        PID:4164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10591.exe
      4⤵
      PID:2552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40354.exe
        5⤵
        
        PID:4296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25425.exe
        5⤵
        
        PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51431.exe
        5⤵
        
        PID:5468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19404.exe
      4⤵
      PID:2672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33066.exe
      4⤵
      PID:920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24956.exe
      4⤵
      PID:4632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
      4⤵
      PID:6092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2916.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2916.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24785.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38127.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
        6⤵
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56866.exe
        7⤵
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38827.exe
        7⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54076.exe
        7⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54664.exe
        7⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8469.exe
        6⤵
        
        PID:2540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48318.exe
        6⤵
        
        PID:932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7551.exe
        6⤵
        
        PID:4808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47099.exe
        6⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63610.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44660.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7748.exe
        6⤵
        
        PID:2944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58812.exe
        6⤵
        
        PID:3556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37701.exe
        6⤵
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31291.exe
        6⤵
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42766.exe
        6⤵
        
        PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57342.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12875.exe
        5⤵
        
        PID:3500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34900.exe
        5⤵
        
        PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6090.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43296.exe
        5⤵
        
        PID:5736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50742.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33986.exe
        5⤵
        
        PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40425.exe
        5⤵
        
        PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50835.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4928.exe
        5⤵
        
        PID:4828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38022.exe
        5⤵
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64430.exe
        5⤵
        
        PID:6352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16563.exe
      4⤵
      PID:1336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60026.exe
      4⤵
      PID:3620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48035.exe
      4⤵
      PID:4536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45264.exe
      4⤵
      PID:4728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50613.exe
      4⤵
      PID:5728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10486.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10486.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33851.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27087.exe
        5⤵
        
        PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5615.exe
        5⤵
        
        PID:3136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47869.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39527.exe
        5⤵
        
        PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58973.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25756.exe
        5⤵
        
        PID:6916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15879.exe
      4⤵
      PID:556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15273.exe
        5⤵
        
        PID:4140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
        5⤵
        
        PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48799.exe
        5⤵
        
        PID:5820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22204.exe
      4⤵
      PID:2744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4982.exe
      4⤵
      PID:3112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12701.exe
      4⤵
      PID:4100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50613.exe
      4⤵
      PID:5704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26762.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26762.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28667.exe
      4⤵
      PID:2592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63420.exe
      4⤵
      PID:3736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8712.exe
      4⤵
      PID:1400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7551.exe
      4⤵
      PID:4780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47099.exe
      4⤵
      PID:5616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63610.exe
      4⤵
      PID:5920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29056.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29056.exe
    3⤵
    PID:3052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33123.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33123.exe
    3⤵
    PID:3828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48399.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48399.exe
    3⤵
    PID:4064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35062.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35062.exe
    3⤵
    PID:3388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32107.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32107.exe
    3⤵
    PID:6056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62146.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62146.exe
    3⤵
    PID:6196
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64474.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64474.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22782.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22782.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16617.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33851.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63233.exe
        6⤵
        
        PID:820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40425.exe
        6⤵
        
        PID:3608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50835.exe
        6⤵
        
        PID:4472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4928.exe
        6⤵
        
        PID:4832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50083.exe
        6⤵
        
        PID:5516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55812.exe
        5⤵
        
        PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54161.exe
        5⤵
        
        PID:3716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56700.exe
        5⤵
        
        PID:4688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61800.exe
        5⤵
        
        PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21487.exe
        5⤵
        
        PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63431.exe
        5⤵
        
        PID:7112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7161.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57208.exe
        5⤵
        
        PID:2388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10156.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36933.exe
        6⤵
        
        PID:3616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58863.exe
        6⤵
        
        PID:1292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1571.exe
        6⤵
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46757.exe
        6⤵
        
        PID:6884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13103.exe
        5⤵
        
        PID:3516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36633.exe
        5⤵
        
        PID:3180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34740.exe
        5⤵
        
        PID:2888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38553.exe
        5⤵
        
        PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59964.exe
        5⤵
        
        PID:6320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34897.exe
      4⤵
      PID:1548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-929.exe
        5⤵
        
        PID:264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40425.exe
        5⤵
        
        PID:3696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50835.exe
        5⤵
        
        PID:4464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45962.exe
        6⤵
        
        PID:6656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4928.exe
        5⤵
        
        PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50083.exe
        5⤵
        
        PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30597.exe
      4⤵
      PID:1344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51361.exe
      4⤵
      PID:3568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31499.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62330.exe
      4⤵
      PID:4416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24998.exe
      4⤵
      PID:5536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53928.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53928.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34427.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19570.exe
        5⤵
        
        PID:1112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40425.exe
        5⤵
        
        PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50835.exe
        5⤵
        
        PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4928.exe
        5⤵
        
        PID:4864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45999.exe
        5⤵
        
        PID:5780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14888.exe
      4⤵
      PID:2112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18849.exe
      4⤵
      PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42403.exe
      4⤵
      PID:4984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17022.exe
      4⤵
      PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57945.exe
      4⤵
      PID:6224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56693.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56693.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60441.exe
      4⤵
      PID:2376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62382.exe
        5⤵
        
        PID:2260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40425.exe
        5⤵
        
        PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50835.exe
        5⤵
        
        PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22625.exe
        5⤵
        
        PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26230.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14888.exe
      4⤵
      PID:864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54161.exe
      4⤵
      PID:3788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56700.exe
      4⤵
      PID:4696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61800.exe
      4⤵
      PID:4304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21487.exe
      4⤵
      PID:5368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19274.exe
      4⤵
      PID:6248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61136.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61136.exe
    3⤵
    PID:2416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8340.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50865.exe
      4⤵
      PID:4356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52883.exe
      4⤵
      PID:5492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40868.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40868.exe
    3⤵
    PID:3312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17965.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17965.exe
    3⤵
    PID:3896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64953.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64953.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26098.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26098.exe
    3⤵
    PID:5568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53809.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53809.exe
    3⤵
    PID:5440
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22325.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22325.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37037.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37037.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54463.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59533.exe
        5⤵
        
        PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43851.exe
        5⤵
        
        PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41372.exe
        5⤵
        
        PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46529.exe
        5⤵
        
        PID:5868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19055.exe
      4⤵
      PID:2896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54161.exe
      4⤵
      PID:3752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18365.exe
      4⤵
      PID:4344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23155.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21765.exe
      4⤵
      PID:6072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18261.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18261.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11240.exe
      4⤵
      PID:2016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28335.exe
        5⤵
        
        PID:2120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6954.exe
        5⤵
        
        PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50538.exe
        5⤵
        
        PID:5040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50083.exe
        5⤵
        
        PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27673.exe
        5⤵
        
        PID:6560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8469.exe
      4⤵
      PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64654.exe
      4⤵
      PID:4080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7551.exe
      4⤵
      PID:4868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47099.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63610.exe
      4⤵
      PID:1528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46719.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46719.exe
    3⤵
    PID:1284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10109.exe
      4⤵
      PID:3392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30139.exe
      4⤵
      PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22625.exe
      4⤵
      PID:3424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26230.exe
      4⤵
      PID:5444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8692.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8692.exe
    3⤵
    PID:3340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34500.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34500.exe
    3⤵
    PID:3904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47887.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47887.exe
    3⤵
    PID:4784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37442.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37442.exe
    3⤵
    PID:5976
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15854.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15854.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58739.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58739.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35138.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40425.exe
      4⤵
      PID:3668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50835.exe
      4⤵
      PID:4528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4928.exe
      4⤵
      PID:4852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50083.exe
      4⤵
      PID:5648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18780.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18780.exe
    3⤵
    PID:2524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54161.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54161.exe
    3⤵
    PID:3600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56700.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56700.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61800.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61800.exe
    3⤵
    PID:4560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21487.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21487.exe
    3⤵
    PID:5344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63431.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63431.exe
    3⤵
    PID:7096
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33081.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33081.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57063.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57063.exe
    3⤵
    PID:2864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63420.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63420.exe
    3⤵
    PID:3720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29807.exe
      4⤵
      PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39230.exe
      4⤵
      PID:5424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16788.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16788.exe
    3⤵
    PID:4848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36191.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36191.exe
    3⤵
    PID:5884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46110.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46110.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6868
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21226.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21226.exe
  2⤵
  PID:1160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2552.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2552.exe
    3⤵
    PID:5712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7757.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7757.exe
    3⤵
    PID:1288
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28658.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28658.exe
  2⤵
  PID:3836
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21533.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21533.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3876
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33927.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33927.exe
  2⤵
  PID:3212
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8571.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8571.exe
  2⤵
  PID:6016
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44222.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44222.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-13235.exe

Filesize
468KB

MD5
9f8f1cf69ceacc2c79a83b315ba81e1e

SHA1
95d08eecfd70f4ae82c8cfb7e219777e018c4c8c

SHA256
2ff9e43ab2ffd255ec81b3790bb7d283c4c270f095b41bc0369947b94f3256b1

SHA512
4a24f6803152c7593af2111392f53052070d7dcf0e64f968a808b838a27d5b4f531bb30acd5abef2d9a74627ba2f752f0d40a94984376d72f0ee91fc8ecba5db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22325.exe

Filesize
468KB

MD5
011b09143c33367096a5e698f1a16670

SHA1
ec0bf2ee6bed6bc49ba2a003d21021e911eaf7e9

SHA256
dd15d65a52384b1e1de6a478d83f6adb38b3298cf23d1c4c146e81af780aa736

SHA512
9b2fefdb47c8472463666dc18f90ddedeee6118613597d1caaa127dd294d911df4cf9d9bf0f1775cd912c7a17ff803b7058626568315fbb8ddff78da3f8e544a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5067.exe

Filesize
468KB

MD5
91c00d1a0bf444af8f3f831fb19505ec

SHA1
867e61c8905ac0c09d5d666533d35e8a49cd4a55

SHA256
fff4c015e65db3e0bb2e85ccd253a6899e805d4c6fb3098aa74e303e1880e50a

SHA512
ae1efee6c8a3386ea5b80ab9b3ad0d880c9f600432687c1213341d22e459977d3def625675710618a85ab986380a0ed3350b4a2325ea467f36367a0f8607098a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53544.exe

Filesize
468KB

MD5
3a6eea5766b2d4729bc1a82d86831aa9

SHA1
700290638669f08b51496c9af6c1278b4092509b

SHA256
ad7c0b6c460da11f80f387250b6757c09cc5992e0f86658d4c9a564ac7f1e875

SHA512
c51f3da96e5f0bfd2550a0fd9f22dcb622d75913bb059fa6f2c16e9880d1f80d7705b4c917898a645da9545194ab64f89530ab18db5f6b8b5b5047b5f711513f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56881.exe

Filesize
468KB

MD5
2e11f2ff1702bbf21c1f020e7cd0d7a6

SHA1
6a30a0b0be155a78f52a79c5abb5496a352e1be9

SHA256
9f21b3eeecec49565670c9555c2a24d43dbb217bfab081218da613debb315094

SHA512
8c68fdd62ca9efd37f001b91c70ba643a8e9c529551f78239ea91b857c1308a5951dcfc912c524127900a9147cb6eb57f7a8549b9e7fcf1b63dff2e3fb9a30a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64474.exe

Filesize
468KB

MD5
eeb4fc9c411e2feeaae0e08f6d5267b3

SHA1
ace89aa57e81ae5eecc13158226e8b0f6e6fe3fd

SHA256
c3f5034eb9d7d968fc6045c4ef4a31c13d57e3c982752ddf0e2fedeac001aae5

SHA512
726b42084886b063f3323ab274a7f586771bf30f544b54f595c40b2859d585b3bf3f7dbb364a3655e7efa3c0403ba66abcef4cac900f1305f2b9d61d191f57a9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16459.exe

Filesize
468KB

MD5
b3858b67d5e7de20dea05b058b8b3dee

SHA1
fbea40c7964bffc943e0861761596162f8c89350

SHA256
3be1baa99bfae98f28d640f7981a4585de5d9dbfbe3e25d540f9d6cd3adfb6ec

SHA512
c811669a81ec1a950e5c5c72a6a611d03d0365ac9b672650446745c2d1654660c24a8c57cb815955c1175b6bf39d8f8ff720157f26fc29f33e0bc865a6b641e8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1730.exe

Filesize
468KB

MD5
23ecd27738874c6e09c00a30e72a41db

SHA1
716b9d3c37571b88b8f0d27b2cb1df0dddabd76b

SHA256
3b7e26e28d8cbc37176a0e42432e1143caa63033e46f987013b10c334871bd86

SHA512
4aee88c2d407c843aeca286a55511c6d4268ab861e551755afb009280fac0f481f9c10767d27268409f8eab2fe3e95f951a787d72eac060937fd73c7354a1b22

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18698.exe

Filesize
468KB

MD5
b261a2dff086f1a0c0e7c16417915345

SHA1
a27c1166e8b21572ef0bfb5365bbf358bb0bbe1d

SHA256
fc7128d9b84ba8024584f86275f1778420a2ea03dc5226df4098f416326787c3

SHA512
a31389920aab535e08ae311d1c3c003c851497d4073fff8fe878a6f21d9ad27d946c0f81ad3a56ce6a1bc4c7a12090e295a981060e9ecc809d96a6591283666c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22782.exe

Filesize
468KB

MD5
b50acc05fa6fc50f7db947bc2ee49eeb

SHA1
b89acebde1364ba2a6ae6a15d6a694b394396cd6

SHA256
bddf3640c674660b7859f1ba94556cf989b57ed0c4973be19cad9c3c9a5db985

SHA512
fbf87414195757b9b0d9d498365b246a14e426a3a20714a31cb72d2ef8b72a890e480385143908aedf4fbbf95cfc1a370aa27ab2bf3d1db872b09414078cbdb9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28529.exe

Filesize
468KB

MD5
2ac3a5068a9cf79ed60c976caef4fd40

SHA1
42d462f0e9fed600122b73149919fb2663089be4

SHA256
f31835f412eea0d2a72f228d593c7189dc1283d67be73c9e43568f9176a93b7b

SHA512
70181655d06b47da2797783ed8154980f1220e1d2ecb2c3cbc5096f61337f80b78a11f6b15d8142acbfc8da2dc62e8219390471176f4f3188eb5cb2312d5d03f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-2916.exe

Filesize
468KB

MD5
db0e8e6bc2f96e41f424baa91e55f0fc

SHA1
974b2a0bee91fdb956490e1822df6756ba0ba06f

SHA256
91e77496cf2ab11ea4757c6d13f213f84ba1aaddd04593273e34f3d1fdb07ae7

SHA512
e63e8653fe957c5de06dad225da723f7614afa70ea2997beace3cbae90078ffaf9a8a4c0089b0d842403da7394fd9985be18c62c4a64dba5d57a9cbaa4535efe

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40843.exe

Filesize
468KB

MD5
aeb1c11178e2f7df3cda4e1f7aa3d804

SHA1
9b7733a881eceb053f4a2016256ba7e47de038e3

SHA256
df79c057b57898c3357b8ce2add79bf02ef892fe93adbf4ee34271d2d7a0f00f

SHA512
24cacb4329fd8ad01f4e9a587d82794dd3995e125055ea48d10b5895afa44b6e2d83b84d62a8b50d6e4b27d22fede5f0874650e050200a50b9e140a74fd6eaba

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-495.exe

Filesize
468KB

MD5
a2da14162eb0b9f08075848cd75b72e3

SHA1
3a1085f36a4ab1e94a47f4b5c81e3e14d1e64f2a

SHA256
7c47475206cc3a49f99d2493985f1ec79e849a36b6638aa0edaea69531649ecd

SHA512
71ab0ba570f2afd25bc510831aa2c9236ec4e707f188b5f419c171e67144a0bc12698538ca64beb1f41560d1b145afc6af34e0a38a366ec46e48ce9065cc0dcb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55454.exe

Filesize
468KB

MD5
9e12031f00e39436b2e21955c4560169

SHA1
f84925866bf1127137f445cf347bc8730fcfda9c

SHA256
9db031c57cdea58e82096cd38b7d597f2296dec6d5ef075de9393c658dc2ecd2

SHA512
00d0ce416932d86253705a1df0dbc13f0bbc403e7502c3d4c32df14b420718cfab15f4f1226dac36feab58e68f4d73fcba607814406ab7d42888892a28be0519

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56907.exe

Filesize
468KB

MD5
0df030ea2e184fec487c6efca33de104

SHA1
dd17017a9ad9124b21fe8837261f4ecf1fbb5d86

SHA256
f625097a0822aae93128c863fca8616449b3fc62492920582ce9604f96a47aca

SHA512
d356f2f6c4809461f2bffdc35c5a34cf411ebc9d058ea8cf106fa43e06f69f4e2b9637ad9a1a0b21da4a8b784bc63c1775b1a69ed50e9c1d4bf2dc522c2dc9ed

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58727.exe

Filesize
468KB

MD5
165f4f70e111057a26376c34cd427e75

SHA1
9a1d96ed4618c2555d831f82fe026c75695e907d

SHA256
9ff079710ca2e9d531a924eaa03b24b32549d26c465e3629df20ac4cc387f2c7

SHA512
ca546310da49468687d0817b3a22cd10f508818db034c998040a7c7389473d5bb495e5e337a06ec17fc5df7de1e87e5bafe5a61ebe3feb57fc0bdb39fdb7cc3d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60773.exe

Filesize
468KB

MD5
2b425e36470edbd902d638eaf9db29ae

SHA1
79456721ed0c79e2b5ae792c496ef20dd6b67a22

SHA256
162f8907372a0563901f4ca8ba045f17919baa06fc7c6eaf94a70d134d55ad49

SHA512
a3585c7279a5419e6262653d4058bb75b8406eba7dc4a29bc4d091a30d6a4662e2794c52d44933028ea04c0e06c8acef028ab6bfe85b417751ce656924b4d6c5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8261.exe

Filesize
468KB

MD5
0abf4a092fea5cd2181ab12129d717a8

SHA1
e3fe2267605348ed742f66c38d1f88843d21864d

SHA256
0ba6f06cb658e4eab8be3f5f9e180d42b333a54fd1b7136c1202b69434cc24de

SHA512
fb0f16ba0ca4a7903d7e811d7c9caaa647fa43bd5a740f13af7edbeb46c3b8183e13942c2b3be6818fe8be31e384e5c2e7103070b6bf5c2cace7bfe3124da6bd

Download Submit