46131b583834e4b931064a3f1ad788e7950e813dd556bb0b59f573906e40d576

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 16:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46131b583834e4b931064a3f1ad788e7950e813dd556bb0b59f573906e40d576.exe
Size

468KB
MD5

d2537c277598e62469d9ce6a4656b7b5
SHA1

369f1ff780b2d7b7735f70df95df402a3130fa2e
SHA256

46131b583834e4b931064a3f1ad788e7950e813dd556bb0b59f573906e40d576
SHA512

1993e89ca7ade6d28e33719c8dc4557fbf305df2251c3a98e893f2424a6080bf3db2db93ded3f30c2ed8ca602feb23d097e20040d273f7855c7b88ad68b978e4
SSDEEP

3072:8uACoiEZX03YtbHwPzcjffIssWhWbHpp81HCxdhPiOOc5gkNwIltM:8u1opOYt8P4jffgJVdiO32kNwN

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1452	Unicorn-32226.exe
2868	Unicorn-59719.exe
2920	Unicorn-56190.exe
1752	Unicorn-44857.exe
2704	Unicorn-40581.exe
2692	Unicorn-1778.exe
2796	Unicorn-61940.exe
2908	Unicorn-60098.exe
1500	Unicorn-20772.exe
1936	Unicorn-8842.exe
836	Unicorn-56189.exe
2364	Unicorn-62319.exe
3036	Unicorn-62054.exe
1148	Unicorn-13097.exe
2488	Unicorn-98.exe
1680	Unicorn-48552.exe
2276	Unicorn-19261.exe
1476	Unicorn-45236.exe
1328	Unicorn-25562.exe
632	Unicorn-61956.exe
960	Unicorn-16840.exe
1848	Unicorn-13715.exe
1040	Unicorn-13715.exe
772	Unicorn-59387.exe
1712	Unicorn-41519.exe
1964	Unicorn-42496.exe
1880	Unicorn-893.exe
1308	Unicorn-42724.exe
540	Unicorn-48993.exe
1668	Unicorn-22442.exe
2468	Unicorn-28573.exe
1408	Unicorn-49740.exe
1436	Unicorn-7768.exe
1988	Unicorn-33269.exe
2904	Unicorn-58998.exe
2820	Unicorn-61228.exe
2804	Unicorn-61228.exe
2872	Unicorn-34686.exe
2936	Unicorn-30772.exe
2944	Unicorn-3526.exe
1016	Unicorn-16525.exe
944	Unicorn-7802.exe
2980	Unicorn-7802.exe
2672	Unicorn-65150.exe
2228	Unicorn-19213.exe
1644	Unicorn-56427.exe
2336	Unicorn-56427.exe
2332	Unicorn-3334.exe
3008	Unicorn-36836.exe
2996	Unicorn-36836.exe
2664	Unicorn-50572.exe
3028	Unicorn-23262.exe
3016	Unicorn-34936.exe
2408	Unicorn-65373.exe
2172	Unicorn-40942.exe
1968	Unicorn-56708.exe
2420	Unicorn-60978.exe
1144	Unicorn-53002.exe
764	Unicorn-5316.exe
2440	Unicorn-5316.exe
1264	Unicorn-46541.exe
1796	Unicorn-29903.exe
1504	Unicorn-49769.exe
1996	Unicorn-49769.exe

Loads dropped DLL 64 IoCs

pid	Process
564	46131b583834e4b931064a3f1ad788e7950e813dd556bb0b59f573906e40d576.exe
564	46131b583834e4b931064a3f1ad788e7950e813dd556bb0b59f573906e40d576.exe
1452	Unicorn-32226.exe
564	46131b583834e4b931064a3f1ad788e7950e813dd556bb0b59f573906e40d576.exe
1452	Unicorn-32226.exe
564	46131b583834e4b931064a3f1ad788e7950e813dd556bb0b59f573906e40d576.exe
2920	Unicorn-56190.exe
2868	Unicorn-59719.exe
2920	Unicorn-56190.exe
2868	Unicorn-59719.exe
564	46131b583834e4b931064a3f1ad788e7950e813dd556bb0b59f573906e40d576.exe
564	46131b583834e4b931064a3f1ad788e7950e813dd556bb0b59f573906e40d576.exe
1452	Unicorn-32226.exe
1452	Unicorn-32226.exe
1752	Unicorn-44857.exe
1752	Unicorn-44857.exe
2868	Unicorn-59719.exe
2868	Unicorn-59719.exe
2796	Unicorn-61940.exe
2796	Unicorn-61940.exe
1452	Unicorn-32226.exe
1452	Unicorn-32226.exe
564	46131b583834e4b931064a3f1ad788e7950e813dd556bb0b59f573906e40d576.exe
2692	Unicorn-1778.exe
564	46131b583834e4b931064a3f1ad788e7950e813dd556bb0b59f573906e40d576.exe
2692	Unicorn-1778.exe
2920	Unicorn-56190.exe
2920	Unicorn-56190.exe
2704	Unicorn-40581.exe
2704	Unicorn-40581.exe
1500	Unicorn-20772.exe
1500	Unicorn-20772.exe
2868	Unicorn-59719.exe
2868	Unicorn-59719.exe
2908	Unicorn-60098.exe
2908	Unicorn-60098.exe
1752	Unicorn-44857.exe
1752	Unicorn-44857.exe
1936	Unicorn-8842.exe
1936	Unicorn-8842.exe
2364	Unicorn-62319.exe
2364	Unicorn-62319.exe
3036	Unicorn-62054.exe
1148	Unicorn-13097.exe
2692	Unicorn-1778.exe
3036	Unicorn-62054.exe
1148	Unicorn-13097.exe
2692	Unicorn-1778.exe
2920	Unicorn-56190.exe
2920	Unicorn-56190.exe
836	Unicorn-56189.exe
836	Unicorn-56189.exe
564	46131b583834e4b931064a3f1ad788e7950e813dd556bb0b59f573906e40d576.exe
564	46131b583834e4b931064a3f1ad788e7950e813dd556bb0b59f573906e40d576.exe
1452	Unicorn-32226.exe
1452	Unicorn-32226.exe
2488	Unicorn-98.exe
2488	Unicorn-98.exe
2704	Unicorn-40581.exe
2704	Unicorn-40581.exe
1680	Unicorn-48552.exe
1680	Unicorn-48552.exe
1500	Unicorn-20772.exe
1500	Unicorn-20772.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26245.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64353.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6759.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30772.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5316.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25944.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16401.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3639.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34554.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3329.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31960.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13097.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59387.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50257.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61722.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64154.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45431.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4882.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36872.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23294.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56190.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19261.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49775.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63001.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-798.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4268.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6775.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20340.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62673.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48993.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62673.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44857.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42724.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11067.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38681.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12197.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32892.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3884.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28862.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29062.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48316.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38347.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54144.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50983.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7585.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35696.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40735.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39942.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43147.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14997.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16126.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65373.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9127.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38627.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52904.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41481.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13991.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
564	46131b583834e4b931064a3f1ad788e7950e813dd556bb0b59f573906e40d576.exe
1452	Unicorn-32226.exe
2868	Unicorn-59719.exe
2920	Unicorn-56190.exe
1752	Unicorn-44857.exe
2796	Unicorn-61940.exe
2704	Unicorn-40581.exe
2692	Unicorn-1778.exe
2908	Unicorn-60098.exe
1500	Unicorn-20772.exe
2364	Unicorn-62319.exe
836	Unicorn-56189.exe
3036	Unicorn-62054.exe
1936	Unicorn-8842.exe
1148	Unicorn-13097.exe
1680	Unicorn-48552.exe
2488	Unicorn-98.exe
2276	Unicorn-19261.exe
1476	Unicorn-45236.exe
1328	Unicorn-25562.exe
960	Unicorn-16840.exe
772	Unicorn-59387.exe
1040	Unicorn-13715.exe
1848	Unicorn-13715.exe
1712	Unicorn-41519.exe
632	Unicorn-61956.exe
1964	Unicorn-42496.exe
1308	Unicorn-42724.exe
1880	Unicorn-893.exe
540	Unicorn-48993.exe
2468	Unicorn-28573.exe
1668	Unicorn-22442.exe
1408	Unicorn-49740.exe
1436	Unicorn-7768.exe
1988	Unicorn-33269.exe
2904	Unicorn-58998.exe
2804	Unicorn-61228.exe
2872	Unicorn-34686.exe
2936	Unicorn-30772.exe
944	Unicorn-7802.exe
2980	Unicorn-7802.exe
2944	Unicorn-3526.exe
1016	Unicorn-16525.exe
2672	Unicorn-65150.exe
1644	Unicorn-56427.exe
2336	Unicorn-56427.exe
2332	Unicorn-3334.exe
2228	Unicorn-19213.exe
2664	Unicorn-50572.exe
3008	Unicorn-36836.exe
2996	Unicorn-36836.exe
3028	Unicorn-23262.exe
3016	Unicorn-34936.exe
1144	Unicorn-53002.exe
1968	Unicorn-56708.exe
2172	Unicorn-40942.exe
2420	Unicorn-60978.exe
2408	Unicorn-65373.exe
764	Unicorn-5316.exe
2440	Unicorn-5316.exe
1264	Unicorn-46541.exe
1796	Unicorn-29903.exe
1996	Unicorn-49769.exe
1700	Unicorn-4268.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 1452	564	46131b583834e4b931064a3f1ad788e7950e813dd556bb0b59f573906e40d576.exe	30
PID 564 wrote to memory of 1452	564	46131b583834e4b931064a3f1ad788e7950e813dd556bb0b59f573906e40d576.exe	30
PID 564 wrote to memory of 1452	564	46131b583834e4b931064a3f1ad788e7950e813dd556bb0b59f573906e40d576.exe	30
PID 564 wrote to memory of 1452	564	46131b583834e4b931064a3f1ad788e7950e813dd556bb0b59f573906e40d576.exe	30
PID 1452 wrote to memory of 2868	1452	Unicorn-32226.exe	31
PID 1452 wrote to memory of 2868	1452	Unicorn-32226.exe	31
PID 1452 wrote to memory of 2868	1452	Unicorn-32226.exe	31
PID 1452 wrote to memory of 2868	1452	Unicorn-32226.exe	31
PID 564 wrote to memory of 2920	564	46131b583834e4b931064a3f1ad788e7950e813dd556bb0b59f573906e40d576.exe	32
PID 564 wrote to memory of 2920	564	46131b583834e4b931064a3f1ad788e7950e813dd556bb0b59f573906e40d576.exe	32
PID 564 wrote to memory of 2920	564	46131b583834e4b931064a3f1ad788e7950e813dd556bb0b59f573906e40d576.exe	32
PID 564 wrote to memory of 2920	564	46131b583834e4b931064a3f1ad788e7950e813dd556bb0b59f573906e40d576.exe	32
PID 2920 wrote to memory of 2704	2920	Unicorn-56190.exe	33
PID 2920 wrote to memory of 2704	2920	Unicorn-56190.exe	33
PID 2920 wrote to memory of 2704	2920	Unicorn-56190.exe	33
PID 2920 wrote to memory of 2704	2920	Unicorn-56190.exe	33
PID 2868 wrote to memory of 1752	2868	Unicorn-59719.exe	34
PID 2868 wrote to memory of 1752	2868	Unicorn-59719.exe	34
PID 2868 wrote to memory of 1752	2868	Unicorn-59719.exe	34
PID 2868 wrote to memory of 1752	2868	Unicorn-59719.exe	34
PID 564 wrote to memory of 2692	564	46131b583834e4b931064a3f1ad788e7950e813dd556bb0b59f573906e40d576.exe	35
PID 564 wrote to memory of 2692	564	46131b583834e4b931064a3f1ad788e7950e813dd556bb0b59f573906e40d576.exe	35
PID 564 wrote to memory of 2692	564	46131b583834e4b931064a3f1ad788e7950e813dd556bb0b59f573906e40d576.exe	35
PID 564 wrote to memory of 2692	564	46131b583834e4b931064a3f1ad788e7950e813dd556bb0b59f573906e40d576.exe	35
PID 1452 wrote to memory of 2796	1452	Unicorn-32226.exe	36
PID 1452 wrote to memory of 2796	1452	Unicorn-32226.exe	36
PID 1452 wrote to memory of 2796	1452	Unicorn-32226.exe	36
PID 1452 wrote to memory of 2796	1452	Unicorn-32226.exe	36
PID 1752 wrote to memory of 2908	1752	Unicorn-44857.exe	37
PID 1752 wrote to memory of 2908	1752	Unicorn-44857.exe	37
PID 1752 wrote to memory of 2908	1752	Unicorn-44857.exe	37
PID 1752 wrote to memory of 2908	1752	Unicorn-44857.exe	37
PID 2868 wrote to memory of 1500	2868	Unicorn-59719.exe	38
PID 2868 wrote to memory of 1500	2868	Unicorn-59719.exe	38
PID 2868 wrote to memory of 1500	2868	Unicorn-59719.exe	38
PID 2868 wrote to memory of 1500	2868	Unicorn-59719.exe	38
PID 2796 wrote to memory of 1936	2796	Unicorn-61940.exe	39
PID 2796 wrote to memory of 1936	2796	Unicorn-61940.exe	39
PID 2796 wrote to memory of 1936	2796	Unicorn-61940.exe	39
PID 2796 wrote to memory of 1936	2796	Unicorn-61940.exe	39
PID 1452 wrote to memory of 836	1452	Unicorn-32226.exe	40
PID 1452 wrote to memory of 836	1452	Unicorn-32226.exe	40
PID 1452 wrote to memory of 836	1452	Unicorn-32226.exe	40
PID 1452 wrote to memory of 836	1452	Unicorn-32226.exe	40
PID 564 wrote to memory of 3036	564	46131b583834e4b931064a3f1ad788e7950e813dd556bb0b59f573906e40d576.exe	41
PID 564 wrote to memory of 3036	564	46131b583834e4b931064a3f1ad788e7950e813dd556bb0b59f573906e40d576.exe	41
PID 564 wrote to memory of 3036	564	46131b583834e4b931064a3f1ad788e7950e813dd556bb0b59f573906e40d576.exe	41
PID 564 wrote to memory of 3036	564	46131b583834e4b931064a3f1ad788e7950e813dd556bb0b59f573906e40d576.exe	41
PID 2692 wrote to memory of 2364	2692	Unicorn-1778.exe	42
PID 2692 wrote to memory of 2364	2692	Unicorn-1778.exe	42
PID 2692 wrote to memory of 2364	2692	Unicorn-1778.exe	42
PID 2692 wrote to memory of 2364	2692	Unicorn-1778.exe	42
PID 2920 wrote to memory of 1148	2920	Unicorn-56190.exe	43
PID 2920 wrote to memory of 1148	2920	Unicorn-56190.exe	43
PID 2920 wrote to memory of 1148	2920	Unicorn-56190.exe	43
PID 2920 wrote to memory of 1148	2920	Unicorn-56190.exe	43
PID 2704 wrote to memory of 2488	2704	Unicorn-40581.exe	44
PID 2704 wrote to memory of 2488	2704	Unicorn-40581.exe	44
PID 2704 wrote to memory of 2488	2704	Unicorn-40581.exe	44
PID 2704 wrote to memory of 2488	2704	Unicorn-40581.exe	44
PID 1500 wrote to memory of 1680	1500	Unicorn-20772.exe	45
PID 1500 wrote to memory of 1680	1500	Unicorn-20772.exe	45
PID 1500 wrote to memory of 1680	1500	Unicorn-20772.exe	45
PID 1500 wrote to memory of 1680	1500	Unicorn-20772.exe	45

C:\Users\Admin\AppData\Local\Temp\46131b583834e4b931064a3f1ad788e7950e813dd556bb0b59f573906e40d576.exe
"C:\Users\Admin\AppData\Local\Temp\46131b583834e4b931064a3f1ad788e7950e813dd556bb0b59f573906e40d576.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:564
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32226.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32226.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59719.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59719.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44857.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60098.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45236.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34686.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35374.exe
        8⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45431.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3598.exe
        8⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26641.exe
        8⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1227.exe
        8⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23484.exe
        7⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59166.exe
        7⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9463.exe
        7⤵
        
        PID:868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18468.exe
        7⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33570.exe
        7⤵
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30772.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55519.exe
        7⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48316.exe
        7⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39942.exe
        7⤵
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
        7⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39225.exe
        7⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40645.exe
        6⤵
        
        PID:1400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59728.exe
        7⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33713.exe
        7⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23196.exe
        7⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1859.exe
        7⤵
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56366.exe
        6⤵
        
        PID:3088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49799.exe
        6⤵
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14914.exe
        6⤵
        
        PID:4780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29105.exe
        6⤵
        
        PID:5348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25562.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58998.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60978.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27699.exe
        8⤵
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21927.exe
        9⤵
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53324.exe
        8⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9463.exe
        8⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64353.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28993.exe
        8⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31761.exe
        7⤵
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1522.exe
        7⤵
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44362.exe
        7⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40347.exe
        7⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48946.exe
        7⤵
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5316.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47927.exe
        7⤵
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
        8⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54355.exe
        8⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36987.exe
        7⤵
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63001.exe
        7⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49012.exe
        7⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50312.exe
        7⤵
        
        PID:5988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33820.exe
        6⤵
        
        PID:2232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7387.exe
        6⤵
        
        PID:1508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35696.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6554.exe
        6⤵
        
        PID:4716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32613.exe
        6⤵
        
        PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61228.exe
        5⤵
        Executes dropped EXE
        
        PID:2820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65373.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17419.exe
        6⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38073.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15493.exe
        7⤵
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        7⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43084.exe
        7⤵
        
        PID:5244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48316.exe
        6⤵
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9463.exe
        6⤵
        
        PID:4084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56185.exe
        6⤵
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57595.exe
        6⤵
        
        PID:6052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33184.exe
        5⤵
        
        PID:2932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42715.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7446.exe
        5⤵
        
        PID:3192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53663.exe
        5⤵
        
        PID:4840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21658.exe
        5⤵
        
        PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20772.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48552.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28573.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50620.exe
        7⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15176.exe
        7⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63027.exe
        7⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11980.exe
        7⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32892.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11258.exe
        6⤵
        
        PID:2120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62051.exe
        6⤵
        
        PID:2164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-798.exe
        6⤵
        
        PID:3596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63386.exe
        6⤵
        
        PID:4784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50636.exe
        6⤵
        
        PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49740.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40501.exe
        6⤵
        
        PID:2280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26245.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48607.exe
        6⤵
        
        PID:3160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23294.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26243.exe
        6⤵
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53748.exe
        5⤵
        
        PID:1564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65031.exe
        5⤵
        
        PID:1792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-798.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10101.exe
        5⤵
        
        PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54144.exe
        5⤵
        
        PID:5412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19261.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7768.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49769.exe
        6⤵
        Executes dropped EXE
        
        PID:1504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50983.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63272.exe
        7⤵
        
        PID:1280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
        7⤵
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62879.exe
        7⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48946.exe
        7⤵
        
        PID:4904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64817.exe
        6⤵
        
        PID:3032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6287.exe
        6⤵
        
        PID:3532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3884.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5052.exe
        6⤵
        
        PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29903.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31565.exe
        6⤵
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26682.exe
        7⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3215.exe
        7⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14584.exe
        7⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29062.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50371.exe
        7⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48316.exe
        6⤵
        
        PID:524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63001.exe
        6⤵
        
        PID:3600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12255.exe
        6⤵
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12197.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47199.exe
        5⤵
        
        PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49930.exe
        5⤵
        
        PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4882.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42773.exe
        5⤵
        
        PID:4680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50636.exe
        5⤵
        
        PID:5336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33269.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40942.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55135.exe
        6⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50901.exe
        7⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27745.exe
        7⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38347.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47360.exe
        7⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56676.exe
        6⤵
        
        PID:1444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63001.exe
        6⤵
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12255.exe
        6⤵
        
        PID:4244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50312.exe
        6⤵
        
        PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59966.exe
        5⤵
        
        PID:2392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20826.exe
        5⤵
        
        PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3329.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59302.exe
        5⤵
        
        PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16126.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56708.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58643.exe
        5⤵
        
        PID:2888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7585.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16555.exe
        6⤵
        
        PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48316.exe
        5⤵
        
        PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63001.exe
        5⤵
        
        PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12255.exe
        5⤵
        
        PID:4240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4029.exe
        5⤵
        
        PID:5016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30245.exe
      4⤵
      PID:2988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10580.exe
      4⤵
      PID:2328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39200.exe
      4⤵
      PID:3884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42791.exe
      4⤵
      PID:4100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31094.exe
      4⤵
      PID:676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61940.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61940.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8842.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61956.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56427.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9909.exe
        7⤵
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20651.exe
        7⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38497.exe
        7⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52904.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7153.exe
        7⤵
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56541.exe
        6⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2644.exe
        7⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16401.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47039.exe
        7⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24947.exe
        7⤵
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8958.exe
        6⤵
        
        PID:980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3329.exe
        6⤵
        
        PID:3640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3590.exe
        6⤵
        
        PID:3216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
        6⤵
        
        PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36836.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17471.exe
        6⤵
        
        PID:824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43973.exe
        6⤵
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41481.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31960.exe
        6⤵
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30526.exe
        6⤵
        
        PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55943.exe
        5⤵
        
        PID:1580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34554.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46683.exe
        5⤵
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42472.exe
        5⤵
        
        PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1757.exe
        5⤵
        
        PID:5816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61228.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38031.exe
        5⤵
        
        PID:2740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48316.exe
        5⤵
        
        PID:2604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9463.exe
        5⤵
        
        PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39465.exe
        5⤵
        
        PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62673.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63422.exe
      4⤵
      PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3639.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59251.exe
      4⤵
      PID:2284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39114.exe
      4⤵
      PID:1404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28542.exe
      4⤵
      PID:4484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50298.exe
      4⤵
      PID:4400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50013.exe
      4⤵
      PID:4552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56189.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56189.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42496.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3334.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18846.exe
        6⤵
        
        PID:1468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1710.exe
        7⤵
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38627.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37253.exe
        7⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48570.exe
        7⤵
        
        PID:5084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11201.exe
        6⤵
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65383.exe
        6⤵
        
        PID:3604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47346.exe
        6⤵
        
        PID:4156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23294.exe
        6⤵
        
        PID:4340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13991.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29488.exe
        5⤵
        
        PID:2384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62949.exe
        5⤵
        
        PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9463.exe
        5⤵
        
        PID:3992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38889.exe
        5⤵
        
        PID:4972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33570.exe
        5⤵
        
        PID:5368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36836.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56536.exe
        5⤵
        
        PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50257.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46167.exe
        5⤵
        
        PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38627.exe
        5⤵
        
        PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55943.exe
      4⤵
      PID:896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34554.exe
      4⤵
      PID:3800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9893.exe
      4⤵
      PID:3392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23824.exe
      4⤵
      PID:4196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58534.exe
      4⤵
      PID:5288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42724.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42724.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49769.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25748.exe
        5⤵
        
        PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25944.exe
        5⤵
        
        PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8917.exe
        5⤵
        
        PID:3644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31960.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63142.exe
      4⤵
      PID:920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40448.exe
      4⤵
      PID:2588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47346.exe
      4⤵
      PID:4132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23294.exe
      4⤵
      PID:4320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13991.exe
      4⤵
      PID:5500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49775.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49775.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-812.exe
      4⤵
      PID:2540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50257.exe
      4⤵
      PID:3864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37039.exe
      4⤵
      PID:3724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51803.exe
      4⤵
      PID:4732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39430.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39430.exe
    3⤵
    PID:2852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61722.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61722.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34317.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34317.exe
    3⤵
    PID:3380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9211.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9211.exe
    3⤵
    PID:4504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8391.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8391.exe
    3⤵
    PID:5564
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56190.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56190.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-98.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-98.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48993.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8798.exe
        6⤵
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7008.exe
        7⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8974.exe
        7⤵
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20449.exe
        7⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20396.exe
        7⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42195.exe
        7⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31952.exe
        6⤵
        
        PID:2556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63464.exe
        6⤵
        
        PID:3504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26428.exe
        6⤵
        
        PID:3396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6759.exe
        6⤵
        
        PID:4148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14528.exe
        6⤵
        
        PID:5280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5316.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43075.exe
        6⤵
        
        PID:2720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48316.exe
        6⤵
        
        PID:2608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9463.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35764.exe
        6⤵
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24525.exe
        6⤵
        
        PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20224.exe
        5⤵
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58446.exe
        6⤵
        
        PID:3832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6775.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26203.exe
        6⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22337.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64024.exe
        5⤵
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40735.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58192.exe
        6⤵
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14997.exe
        6⤵
        
        PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35696.exe
        5⤵
        
        PID:3564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23811.exe
        5⤵
        
        PID:5036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4751.exe
        5⤵
        
        PID:4264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22442.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38991.exe
        5⤵
        
        PID:1788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38068.exe
        6⤵
        
        PID:4632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63374.exe
        6⤵
        
        PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48316.exe
        5⤵
        
        PID:588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63001.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10300.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37078.exe
        5⤵
        
        PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22005.exe
      4⤵
      PID:580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33626.exe
        5⤵
        
        PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49311.exe
        5⤵
        
        PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55359.exe
      4⤵
      PID:1292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1328.exe
      4⤵
      PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50259.exe
      4⤵
      PID:4404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40428.exe
      4⤵
      PID:5792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13097.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13097.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13715.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53002.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6811.exe
        6⤵
        
        PID:1396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48316.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63001.exe
        6⤵
        
        PID:3624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12255.exe
        6⤵
        
        PID:4184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4029.exe
        6⤵
        
        PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55991.exe
        5⤵
        
        PID:2712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37407.exe
        6⤵
        
        PID:6068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62051.exe
        5⤵
        
        PID:2168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27834.exe
        5⤵
        
        PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9127.exe
        5⤵
        
        PID:4864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35542.exe
        5⤵
        
        PID:4688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13495.exe
        5⤵
        
        PID:2436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25944.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20340.exe
        5⤵
        
        PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5762.exe
        5⤵
        
        PID:4260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40038.exe
      4⤵
      PID:2620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45545.exe
      4⤵
      PID:3960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2033.exe
      4⤵
      PID:3656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6759.exe
      4⤵
      PID:4992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35141.exe
      4⤵
      PID:5420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41519.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41519.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7802.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38192.exe
        5⤵
        
        PID:1972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25944.exe
        5⤵
        
        PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20340.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65290.exe
        5⤵
        
        PID:5256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36395.exe
      4⤵
      PID:2104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
      4⤵
      PID:3328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39942.exe
      4⤵
      PID:2144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6759.exe
      4⤵
      PID:4188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18612.exe
      4⤵
      PID:5212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19213.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19213.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64154.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64154.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18347.exe
      4⤵
      PID:3472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38681.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
      4⤵
      PID:4560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43309.exe
      4⤵
      PID:5640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11067.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11067.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39830.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39830.exe
    3⤵
    PID:3096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1328.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1328.exe
    3⤵
    PID:3920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43352.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43352.exe
    3⤵
    PID:5108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27278.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27278.exe
    3⤵
    PID:5488
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1778.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1778.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62319.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62319.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16840.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3526.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38192.exe
        6⤵
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25944.exe
        6⤵
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4833.exe
        6⤵
        
        PID:3672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59971.exe
        6⤵
        
        PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3531.exe
        5⤵
        
        PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39405.exe
        5⤵
        
        PID:3360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39942.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6759.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18612.exe
        5⤵
        
        PID:5216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16525.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4268.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9826.exe
        6⤵
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24830.exe
        7⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58659.exe
        7⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14997.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48316.exe
        6⤵
        
        PID:1884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9463.exe
        6⤵
        
        PID:4088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39465.exe
        6⤵
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62673.exe
        6⤵
        
        PID:5856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55991.exe
        5⤵
        
        PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62051.exe
        5⤵
        
        PID:1536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15581.exe
        5⤵
        
        PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9127.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31458.exe
        5⤵
        
        PID:4664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6965.exe
      4⤵
      PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4559.exe
        5⤵
        
        PID:2424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50257.exe
        5⤵
        
        PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18045.exe
        5⤵
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64247.exe
        5⤵
        
        PID:4856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40667.exe
      4⤵
      PID:1548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61192.exe
      4⤵
      PID:3840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38123.exe
      4⤵
      PID:3108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23824.exe
      4⤵
      PID:4252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59387.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59387.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56427.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55135.exe
        5⤵
        
        PID:320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52592.exe
        5⤵
        
        PID:332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63001.exe
        5⤵
        
        PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52904.exe
        5⤵
        
        PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20365.exe
        5⤵
        
        PID:3988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59966.exe
      4⤵
      PID:2220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32580.exe
        5⤵
        
        PID:3756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55348.exe
        5⤵
        
        PID:3324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51909.exe
        5⤵
        
        PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62673.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20826.exe
      4⤵
      PID:2244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-798.exe
      4⤵
      PID:3940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1440.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1757.exe
      4⤵
      PID:5784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50572.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50572.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14294.exe
      4⤵
      PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52956.exe
        5⤵
        
        PID:3356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12359.exe
        5⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33326.exe
        5⤵
        
        PID:5484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7091.exe
      4⤵
      PID:2708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39942.exe
      4⤵
      PID:3732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6759.exe
      4⤵
      PID:3944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26973.exe
      4⤵
      PID:5316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14989.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14989.exe
    3⤵
    PID:2460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45343.exe
      4⤵
      PID:3544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55400.exe
      4⤵
      PID:3824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29436.exe
      4⤵
      PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58195.exe
      4⤵
      PID:5504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64259.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64259.exe
    3⤵
    PID:2564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43665.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43665.exe
    3⤵
    PID:3780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4120.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4120.exe
    3⤵
    PID:4120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48565.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48565.exe
    3⤵
    PID:4892
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62054.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62054.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:3036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13715.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13715.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7802.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7278.exe
        5⤵
        
        PID:1068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53324.exe
        5⤵
        
        PID:1028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13547.exe
        5⤵
        
        PID:3736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48017.exe
        5⤵
        
        PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32994.exe
        5⤵
        
        PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43136.exe
      4⤵
      PID:2548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35151.exe
        5⤵
        
        PID:2884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39395.exe
        5⤵
        
        PID:3648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55026.exe
        5⤵
        
        PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54144.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12876.exe
      4⤵
      PID:2020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43620.exe
      4⤵
      PID:3728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27544.exe
      4⤵
      PID:4220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25158.exe
      4⤵
      PID:4792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31057.exe
      4⤵
      PID:5552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65150.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65150.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47818.exe
      4⤵
      PID:2916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13495.exe
        5⤵
        
        PID:2388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13692.exe
        5⤵
        
        PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28862.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61199.exe
        5⤵
        
        PID:4696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21533.exe
      4⤵
      PID:2544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8699.exe
      4⤵
      PID:3220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20419.exe
      4⤵
      PID:4640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44286.exe
      4⤵
      PID:5112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12523.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12523.exe
    3⤵
    PID:1120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65031.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65031.exe
    3⤵
    PID:2252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-798.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-798.exe
    3⤵
    PID:4040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54725.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54725.exe
    3⤵
    PID:4420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5841.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5841.exe
    3⤵
    PID:5836
- C:\Users\Admin\AppData\Local\Temp\Unicorn-893.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-893.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23262.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23262.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62872.exe
      4⤵
      PID:1568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59821.exe
        5⤵
        
        PID:1048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24761.exe
        5⤵
        
        PID:3188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43147.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20862.exe
        5⤵
        
        PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2348.exe
      4⤵
      PID:1724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6042.exe
      4⤵
      PID:3996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20449.exe
      4⤵
      PID:4324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41886.exe
      4⤵
      PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22159.exe
      4⤵
      PID:5728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27786.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27786.exe
    3⤵
    PID:2152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33864.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33864.exe
    3⤵
    PID:3748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30147.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30147.exe
    3⤵
    PID:3336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64499.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64499.exe
    3⤵
    PID:4368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33511.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33511.exe
    3⤵
    PID:5740
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34936.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34936.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48093.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48093.exe
    3⤵
    PID:1800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1165.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1165.exe
    3⤵
    PID:3412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3598.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3598.exe
    3⤵
    PID:3900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7481.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7481.exe
    3⤵
    PID:3952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12856.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12856.exe
    3⤵
    PID:5628
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11488.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11488.exe
  2⤵
  PID:2236
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16180.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16180.exe
  2⤵
  PID:3688
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39999.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39999.exe
  2⤵
  PID:3152
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36872.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36872.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4596
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12808.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12808.exe
  2⤵
  PID:5800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1778.exe

Filesize
468KB

MD5
199309a4cb3f47ab2b52f212eae17934

SHA1
b6b5a16ec6de4f85e1bfac7a4c8e7d32b11d5cf2

SHA256
c178bbe8ca33ceeccacb2a4c3a0312803964dc4da884a33f50b9d93bb6418628

SHA512
f41ae8f6677510481f28829a8f96895b5db02d48cfb1a6d7d6224d9677664633823de09641c44379682d50626b79ebb3b95dafda308bc6f340afddfd9bc5b9ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27745.exe

Filesize
468KB

MD5
deecc7e55b29568a4076930c1c3967ed

SHA1
1d14df210205f465bf593de072904d21b1658679

SHA256
bc211c532f89590d24e8ea64f021e756574620ab7e2567cecb8e5918c4004802

SHA512
ea03a7e7908132c4f0622e777116c87c0e32b1f7e76b2fcdcba64d28990df05c692f901b2abaf33e498d64fd45b2fa7a83e07f409579363d7c69e1c480459138

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4120.exe

Filesize
468KB

MD5
ce170eac7dfb4deb9e35b9a7c86befc4

SHA1
9c29415ef06fca7e59ed6cfef3f3d0da8b958314

SHA256
1db87b2a7c6765d77d6a106534a7868f95f87859c37f5cba1513addf898755b6

SHA512
decf6a89ddf27bcc68cc4bcb3f26082823968b0763109f56072034ab700a87a677002afcf8a342b1105b2f1fe993a3d24bffda663e19c77890acbdb9017ef58e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-893.exe

Filesize
468KB

MD5
b468b033e1875f7266e5d2861e74dc03

SHA1
828f489c083ec124759ead169386083992bafc74

SHA256
3a43dff64fe287254571a0f9537f82675ac0d273b05154a3314a5a6bedb342a1

SHA512
4dc2b59e863435df7700d9da79e9eb47d6a215e92285ef528fa875feb030a7f8178bbbf2eb766723d70a2e3c204aacc03fe0b7bce5c5fe869083012d6811cbd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9826.exe

Filesize
468KB

MD5
d18cacda30433ab5582a859d2e829eb0

SHA1
ce51bb7a27b48faa19600564f4587ccc9bfe7fdc

SHA256
1152a8cbb9f3c37bf2bc4a40597bb939366847e8e3888e928e8c9edbf188101d

SHA512
7316ea0bb644a29b0502258f33b22c8239c32cb55fbd175c5e23b2eff167f7439e009062b5d6969a1454fbea93df02e74a6d00622f78ee5353b6629d4299f0c3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13097.exe

Filesize
468KB

MD5
0dc87b1cf2c1b1faaa5d956c0111bf9b

SHA1
838cbe258c5bb72281b3b8f6d32ea3db7e893d36

SHA256
96b0439ac20fb462ebca10fc80973b5b50b91eccb19c59e62f6f8827e1eb848f

SHA512
a6946c7b75633b75d2be55a5c8a397f6bd5f0032b073a10d1cb0affbb933bcee7cceff53476a15870a96d907354f627e490d4409c1d2c9dd3129d588c0bdc43c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19261.exe

Filesize
468KB

MD5
71254ccca8407716e51f6152c054293f

SHA1
be6d120f211b5b84161f4147e3771bef31733123

SHA256
ef0660adefcacf9f2a233f4c3aad7d6c6eccd97ed27642e8811c1ad445120547

SHA512
3bd152a45f7f5345bdfccbd3673687b098147cb0feb1380b1c92f0795b6522329bb40af3a65298e2fbd7c796f291108f132b26ad6fd9560d43191c3aee4efdb8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20772.exe

Filesize
468KB

MD5
20ba90e94a2873ab7f586c8f48d267aa

SHA1
8d0bf54d20f47c9be0b3cb7f49a28f59765f8369

SHA256
2a318465c22ef026bd58a54831cd2f437cac0e42dc6f3c6ee90de657f38fe287

SHA512
c5ab4bb59d9c70125ff6f1e334a2ff97661361a6fe70fa06c57158fc4223c51af036bef8fc8164ea4e18fb58acfee0d3b080a77323918657b547bebde7dba254

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32226.exe

Filesize
468KB

MD5
78a42f15787f5ec10395027a6e6a7e4a

SHA1
66c74d1063fb6ab7dfe81bb16631d98a50d65158

SHA256
1dca8fd77606e0b54423dfdbb356f7f14be5d6c46dbd2def42184514e318d118

SHA512
e87989c6be9347a39e5dd4db78d4484b2d5f007d3318addf51bc764ad5107b7d7879de6e051887e5547539c69a1af0999c892fdcf10c3eec4e7ea50fa4a96cc5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe

Filesize
468KB

MD5
8321f189ab6758ebfa14cd077e621213

SHA1
99154360c9702be712d540626940e36dc3672adf

SHA256
018cb732ba5dcd9844abb32ffb56b7b0f13d7da4be3d2205c7bba03bbc817821

SHA512
924ed686693e66f246f39cb24ceb9248327a3e17df8a521c20972b22c22e1df6798c5275ddc01c8632bf62973e5f1274a885c15b8991abb0550cad46b654e74c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-44857.exe

Filesize
468KB

MD5
f0cb27a66b4206877e8b40a560a1b127

SHA1
68a16203341b39a7f74c963e5e7f106ae4eb8e5e

SHA256
01e75440ebf075b67afe8e00413b8eeff26b10a1c8bb401250bfd436fbe0e706

SHA512
ad3fcb64ff63494993dc0fb900ce5773ca3496b21a3d9d329aa0008f6371bcc8fb194f615f99a3169e0c6cddbb44811290e96baf86415bbc9e721336dca9cc76

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45236.exe

Filesize
468KB

MD5
60d209402a3b295b29f6b1c7105364bb

SHA1
fc4dad6f2de413a040775fd9faa8f7a44272da55

SHA256
36643bb135cb12b0f4cff690bab38ed1243d67b88fa6b7b014e1ba204c8c8a65

SHA512
0934e9b8be356f31c188d6889e316f564fbb81c432105fcb39911f4151ef90e7dc76442915937143400d36d2c09bea1778bf5c5eebe321a83cd074d317a79d87

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-48552.exe

Filesize
468KB

MD5
55959790dfb779da5b2f54b2a07e22b3

SHA1
3c5e0a530d85a1336ede9921196b5993dbf7efd6

SHA256
034be9cf4396b948a10c4bbdfeff59f9d836ae1d9386acf52187aa7a074de9b5

SHA512
68779954167ae5802caa57423454c3c409c88d1263fbacf239f7eba4ed6ec9d685ac6c7f5d7f76094028b99d49b0cb4a4ec10c948a10c460636e4effd8d80387

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56189.exe

Filesize
468KB

MD5
2de58c03bf8952a0b2ec51a9da774ec9

SHA1
474900e031501f725a203192513043d5f372b666

SHA256
a68f44772d587a4e2e1cd8b6a3298c4b3767c5790f530f05379e977f046c466b

SHA512
ae8641fcf559d73adccc021c79b767726cc30b459a471e2cd21db64f0e38659785d808f591a30801ea94203b5755a5e6d39d48d2ed09d09d5c09fe80bbfc1f11

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56190.exe

Filesize
468KB

MD5
55876e7063dc22a7fbaca96228f6e4b0

SHA1
384b4f53d0cd1c72f61a0a8594aea4f44dfac67b

SHA256
c24f807092156b1a4d96d4071b6ee41d813790ea0d3dd6d8349364c45f7b4b00

SHA512
a507331ca6a30dd0999a3d036886faec541d73466fec703e8bc096a8bb84ea8777093a4353f8538bb674063382647c39e9a054779a5bee8f557236256dbb2333

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59719.exe

Filesize
468KB

MD5
9ff0af85cbd7146e5c5270f283915989

SHA1
0f5d433e62fced228cd3c5356477ee336701c03e

SHA256
90673486420638d0aa96e4b5a660e8a91766082688526fd46b395c13a4609fb6

SHA512
67cb4965242cfc75c7c27879ed4368eed985963f47eeea2c32ff50ed7a5aa49fdca86555d4783ab8e0050a5284066be5b8d681f020b3a861d421f03ac3f8b943

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60098.exe

Filesize
468KB

MD5
1176fe3c2750982e4e89241961f18584

SHA1
5925ab2bd13d72f0fef04a3465b53d454b1b5e11

SHA256
e2027f855398b3df1f636ddc548df086735863d5ee480535b922cb13d7c00e7b

SHA512
122b8bf83b0f750106a26fab98c2de609732e157221e9034142e8d7677a9dd6ad3587c7e7504c31296c83cdbfa826dca345473ab7b5dea1e586393c4ce34ae13

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61940.exe

Filesize
468KB

MD5
5418158c71c859bda2a818c7c2c2a7e8

SHA1
636bf360e2e3e39bb20da5500080974710487029

SHA256
c9925139bbca8f4697a0b69ad962d8b5bca7b23df5e57508473d1d3f75567f87

SHA512
8e1eef7d4a4d0d1c60bd5f37c7303f6ed6fa38bf4838d5fb4b390a3d388761b13d0b99addd83794e62be0eb72a78ff8170683f116074f73c8d2ca16da32258ed

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62054.exe

Filesize
468KB

MD5
dfeabe84ef99779958216cbfab7a29ac

SHA1
975a8949f709706b05658f2b17ed2bd131c7dd72

SHA256
ab82fc54d8cbcea3c53112e61faaf4ec70f99198e7e28d48794271519133fd1c

SHA512
f4d078c22d94d72cbb5ffaaead0bdf55cc9a334f792b85e2f01c55f0965a8fc0bbb0c7340c576cd83d4fe2eff2deffce254fc03c53fbc367e3acecca7f986a7e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62319.exe

Filesize
468KB

MD5
a528f7145055fc949d0570466dabd188

SHA1
72d9079b424dfd86b95ad73215dd906c083f4f0a

SHA256
924d8e8effba49d6b9de3ca52ec949b0ca7120bf43349ad3bd551c1eb585e32f

SHA512
a35fef02dd9b58d6f422285430145169865816f39438a9757b35ddd484b321cb1659d2ad664f60fa93c3fbd779d4e4f499c509f0849ac6028f0ed03bdc02625f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8842.exe

Filesize
468KB

MD5
d8d5109e59b83797513ab1b548239d52

SHA1
b88a3a4cd468159a2b0693f6e187ba53d5f3b22e

SHA256
e1b6f763fcdc07b2b2ba1db2938aa76845a4c9dd8c0b849c3e5cf68a5ca2fcb8

SHA512
9851648659d13ce04b7715cd5eb05e715cf056eb8857ccfd0b88302816ae900e46faa8517cf20785c3e97d8a220936009f17d4f40c5816d89769bda977f0d6ae

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-98.exe

Filesize
468KB

MD5
c1bf64f8d87a582d779b1babd0638ec8

SHA1
eb96bcedde825a76b170ec51e97801c44bf404f6

SHA256
691c34a07e664fcbd302e782162e1f32d8d0204857bfb794425df7a308703b0a

SHA512
5cbb43857899ec0427bc544245647a6ae059f0d0a5459af00c00c45a3314b697c51155441c051ac43b544e829ec3e53b4df65a2f1c648580c55265a82bcfe0ba

Download Submit