c3e7dcea8258286be71c08e3b7febd3ccba8104f9a79742c29ac0e15b345dc7d

Analysis

max time kernel
132s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 03:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c3e7dcea8258286be71c08e3b7febd3ccba8104f9a79742c29ac0e15b345dc7d.exe
Size

468KB
MD5

69c2c8c39f899a03d981dcb14ff5387a
SHA1

b35400673b31839c8d6a5e3587e1bce39bef68f5
SHA256

c3e7dcea8258286be71c08e3b7febd3ccba8104f9a79742c29ac0e15b345dc7d
SHA512

295ec87d5d31e0c674da2d3782a55476de80658b7cd2a5910186569f8ca23a84aee6bfc918273c09d95ce7b5e1d7328f82e66ffe4387c7f9f7a6540035105230
SSDEEP

3072:NUQzow1GD0lYtbyfPz9jNfTsDng54bpin1HCOVmZooHI4MSN4/lQ:NUgodQYtuPZjNf4lF7ooohSN4

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3040	Unicorn-36857.exe
2564	Unicorn-60619.exe
2520	Unicorn-64148.exe
2828	Unicorn-39395.exe
2728	Unicorn-32688.exe
2188	Unicorn-55155.exe
2976	Unicorn-35289.exe
2648	Unicorn-57750.exe
2228	Unicorn-49975.exe
980	Unicorn-56105.exe
1596	Unicorn-50495.exe
1392	Unicorn-56105.exe
2040	Unicorn-30894.exe
1912	Unicorn-23049.exe
316	Unicorn-56885.exe
1672	Unicorn-29767.exe
2896	Unicorn-28157.exe
2276	Unicorn-47831.exe
2192	Unicorn-30461.exe
444	Unicorn-1126.exe
2304	Unicorn-1126.exe
1176	Unicorn-11355.exe
2980	Unicorn-3492.exe
1280	Unicorn-3757.exe
612	Unicorn-47020.exe
1792	Unicorn-53150.exe
1632	Unicorn-36.exe
1684	Unicorn-52574.exe
1988	Unicorn-32900.exe
1668	Unicorn-22803.exe
2248	Unicorn-28506.exe
1700	Unicorn-28241.exe
544	Unicorn-24400.exe
2052	Unicorn-59834.exe
1520	Unicorn-26698.exe
2128	Unicorn-1417.exe
3064	Unicorn-46705.exe
2236	Unicorn-45356.exe
2692	Unicorn-25298.exe
2752	Unicorn-45164.exe
2872	Unicorn-45164.exe
2800	Unicorn-45164.exe
2804	Unicorn-45164.exe
2764	Unicorn-38650.exe
2768	Unicorn-51987.exe
2612	Unicorn-10690.exe
2596	Unicorn-10690.exe
2264	Unicorn-63228.exe
2160	Unicorn-63228.exe
2724	Unicorn-63228.exe
2620	Unicorn-30172.exe
2892	Unicorn-26834.exe
1916	Unicorn-7321.exe
1476	Unicorn-13186.exe
112	Unicorn-44406.exe
2588	Unicorn-14686.exe
1260	Unicorn-14686.exe
2124	Unicorn-54573.exe
2368	Unicorn-57373.exe
1192	Unicorn-57001.exe
2912	Unicorn-36943.exe
2224	Unicorn-23369.exe
2216	Unicorn-63447.exe
2220	Unicorn-6840.exe

Loads dropped DLL 64 IoCs

pid	Process
1620	c3e7dcea8258286be71c08e3b7febd3ccba8104f9a79742c29ac0e15b345dc7d.exe
1620	c3e7dcea8258286be71c08e3b7febd3ccba8104f9a79742c29ac0e15b345dc7d.exe
3040	Unicorn-36857.exe
1620	c3e7dcea8258286be71c08e3b7febd3ccba8104f9a79742c29ac0e15b345dc7d.exe
3040	Unicorn-36857.exe
1620	c3e7dcea8258286be71c08e3b7febd3ccba8104f9a79742c29ac0e15b345dc7d.exe
2564	Unicorn-60619.exe
2564	Unicorn-60619.exe
1620	c3e7dcea8258286be71c08e3b7febd3ccba8104f9a79742c29ac0e15b345dc7d.exe
1620	c3e7dcea8258286be71c08e3b7febd3ccba8104f9a79742c29ac0e15b345dc7d.exe
2520	Unicorn-64148.exe
2520	Unicorn-64148.exe
3040	Unicorn-36857.exe
3040	Unicorn-36857.exe
2976	Unicorn-35289.exe
2976	Unicorn-35289.exe
3040	Unicorn-36857.exe
3040	Unicorn-36857.exe
2728	Unicorn-32688.exe
2828	Unicorn-39395.exe
2728	Unicorn-32688.exe
2828	Unicorn-39395.exe
1620	c3e7dcea8258286be71c08e3b7febd3ccba8104f9a79742c29ac0e15b345dc7d.exe
1620	c3e7dcea8258286be71c08e3b7febd3ccba8104f9a79742c29ac0e15b345dc7d.exe
2520	Unicorn-64148.exe
2188	Unicorn-55155.exe
2188	Unicorn-55155.exe
2520	Unicorn-64148.exe
2564	Unicorn-60619.exe
2564	Unicorn-60619.exe
2648	Unicorn-57750.exe
2648	Unicorn-57750.exe
2976	Unicorn-35289.exe
2976	Unicorn-35289.exe
1912	Unicorn-23049.exe
1912	Unicorn-23049.exe
2188	Unicorn-55155.exe
2188	Unicorn-55155.exe
2228	Unicorn-49975.exe
1596	Unicorn-50495.exe
2228	Unicorn-49975.exe
1596	Unicorn-50495.exe
1620	c3e7dcea8258286be71c08e3b7febd3ccba8104f9a79742c29ac0e15b345dc7d.exe
1620	c3e7dcea8258286be71c08e3b7febd3ccba8104f9a79742c29ac0e15b345dc7d.exe
3040	Unicorn-36857.exe
3040	Unicorn-36857.exe
2040	Unicorn-30894.exe
2040	Unicorn-30894.exe
2520	Unicorn-64148.exe
2520	Unicorn-64148.exe
1392	Unicorn-56105.exe
1392	Unicorn-56105.exe
2828	Unicorn-39395.exe
2828	Unicorn-39395.exe
980	Unicorn-56105.exe
980	Unicorn-56105.exe
2728	Unicorn-32688.exe
2728	Unicorn-32688.exe
316	Unicorn-56885.exe
316	Unicorn-56885.exe
2564	Unicorn-60619.exe
1672	Unicorn-29767.exe
1672	Unicorn-29767.exe
2564	Unicorn-60619.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23049.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6376.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38908.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1990.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10610.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33957.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40832.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49957.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30026.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6368.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62198.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40832.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45164.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26038.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58813.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31672.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55155.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37606.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32861.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6043.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7293.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37538.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32166.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41292.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c3e7dcea8258286be71c08e3b7febd3ccba8104f9a79742c29ac0e15b345dc7d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39823.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5637.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37606.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39977.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3492.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41527.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58813.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39311.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27676.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22911.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41527.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14178.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18129.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60579.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51451.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-772.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24648.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32166.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49957.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42247.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6877.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39977.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22911.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15631.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23110.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30172.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22897.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55891.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53302.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-630.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10338.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10690.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1620	c3e7dcea8258286be71c08e3b7febd3ccba8104f9a79742c29ac0e15b345dc7d.exe
3040	Unicorn-36857.exe
2564	Unicorn-60619.exe
2520	Unicorn-64148.exe
2828	Unicorn-39395.exe
2976	Unicorn-35289.exe
2728	Unicorn-32688.exe
2188	Unicorn-55155.exe
2648	Unicorn-57750.exe
1392	Unicorn-56105.exe
2228	Unicorn-49975.exe
980	Unicorn-56105.exe
1596	Unicorn-50495.exe
1912	Unicorn-23049.exe
2040	Unicorn-30894.exe
316	Unicorn-56885.exe
1672	Unicorn-29767.exe
2896	Unicorn-28157.exe
2276	Unicorn-47831.exe
1176	Unicorn-11355.exe
2304	Unicorn-1126.exe
444	Unicorn-1126.exe
2192	Unicorn-30461.exe
1280	Unicorn-3757.exe
2980	Unicorn-3492.exe
612	Unicorn-47020.exe
1632	Unicorn-36.exe
1792	Unicorn-53150.exe
1684	Unicorn-52574.exe
1988	Unicorn-32900.exe
1668	Unicorn-22803.exe
2248	Unicorn-28506.exe
1700	Unicorn-28241.exe
544	Unicorn-24400.exe
2052	Unicorn-59834.exe
1520	Unicorn-26698.exe
3064	Unicorn-46705.exe
2128	Unicorn-1417.exe
2872	Unicorn-45164.exe
2236	Unicorn-45356.exe
2752	Unicorn-45164.exe
2804	Unicorn-45164.exe
2692	Unicorn-25298.exe
2800	Unicorn-45164.exe
2764	Unicorn-38650.exe
2768	Unicorn-51987.exe
2612	Unicorn-10690.exe
2596	Unicorn-10690.exe
2264	Unicorn-63228.exe
2160	Unicorn-63228.exe
2724	Unicorn-63228.exe
2620	Unicorn-30172.exe
2892	Unicorn-26834.exe
1916	Unicorn-7321.exe
1476	Unicorn-13186.exe
112	Unicorn-44406.exe
2588	Unicorn-14686.exe
1260	Unicorn-14686.exe
2124	Unicorn-54573.exe
2368	Unicorn-57373.exe
1192	Unicorn-57001.exe
2912	Unicorn-36943.exe
2224	Unicorn-23369.exe
2216	Unicorn-63447.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 3040	1620	c3e7dcea8258286be71c08e3b7febd3ccba8104f9a79742c29ac0e15b345dc7d.exe	30
PID 1620 wrote to memory of 3040	1620	c3e7dcea8258286be71c08e3b7febd3ccba8104f9a79742c29ac0e15b345dc7d.exe	30
PID 1620 wrote to memory of 3040	1620	c3e7dcea8258286be71c08e3b7febd3ccba8104f9a79742c29ac0e15b345dc7d.exe	30
PID 1620 wrote to memory of 3040	1620	c3e7dcea8258286be71c08e3b7febd3ccba8104f9a79742c29ac0e15b345dc7d.exe	30
PID 3040 wrote to memory of 2520	3040	Unicorn-36857.exe	32
PID 3040 wrote to memory of 2520	3040	Unicorn-36857.exe	32
PID 3040 wrote to memory of 2520	3040	Unicorn-36857.exe	32
PID 3040 wrote to memory of 2520	3040	Unicorn-36857.exe	32
PID 1620 wrote to memory of 2564	1620	c3e7dcea8258286be71c08e3b7febd3ccba8104f9a79742c29ac0e15b345dc7d.exe	33
PID 1620 wrote to memory of 2564	1620	c3e7dcea8258286be71c08e3b7febd3ccba8104f9a79742c29ac0e15b345dc7d.exe	33
PID 1620 wrote to memory of 2564	1620	c3e7dcea8258286be71c08e3b7febd3ccba8104f9a79742c29ac0e15b345dc7d.exe	33
PID 1620 wrote to memory of 2564	1620	c3e7dcea8258286be71c08e3b7febd3ccba8104f9a79742c29ac0e15b345dc7d.exe	33
PID 2564 wrote to memory of 2828	2564	Unicorn-60619.exe	34
PID 2564 wrote to memory of 2828	2564	Unicorn-60619.exe	34
PID 2564 wrote to memory of 2828	2564	Unicorn-60619.exe	34
PID 2564 wrote to memory of 2828	2564	Unicorn-60619.exe	34
PID 1620 wrote to memory of 2728	1620	c3e7dcea8258286be71c08e3b7febd3ccba8104f9a79742c29ac0e15b345dc7d.exe	35
PID 1620 wrote to memory of 2728	1620	c3e7dcea8258286be71c08e3b7febd3ccba8104f9a79742c29ac0e15b345dc7d.exe	35
PID 1620 wrote to memory of 2728	1620	c3e7dcea8258286be71c08e3b7febd3ccba8104f9a79742c29ac0e15b345dc7d.exe	35
PID 1620 wrote to memory of 2728	1620	c3e7dcea8258286be71c08e3b7febd3ccba8104f9a79742c29ac0e15b345dc7d.exe	35
PID 2520 wrote to memory of 2188	2520	Unicorn-64148.exe	36
PID 2520 wrote to memory of 2188	2520	Unicorn-64148.exe	36
PID 2520 wrote to memory of 2188	2520	Unicorn-64148.exe	36
PID 2520 wrote to memory of 2188	2520	Unicorn-64148.exe	36
PID 3040 wrote to memory of 2976	3040	Unicorn-36857.exe	37
PID 3040 wrote to memory of 2976	3040	Unicorn-36857.exe	37
PID 3040 wrote to memory of 2976	3040	Unicorn-36857.exe	37
PID 3040 wrote to memory of 2976	3040	Unicorn-36857.exe	37
PID 2976 wrote to memory of 2648	2976	Unicorn-35289.exe	38
PID 2976 wrote to memory of 2648	2976	Unicorn-35289.exe	38
PID 2976 wrote to memory of 2648	2976	Unicorn-35289.exe	38
PID 2976 wrote to memory of 2648	2976	Unicorn-35289.exe	38
PID 3040 wrote to memory of 2228	3040	Unicorn-36857.exe	39
PID 3040 wrote to memory of 2228	3040	Unicorn-36857.exe	39
PID 3040 wrote to memory of 2228	3040	Unicorn-36857.exe	39
PID 3040 wrote to memory of 2228	3040	Unicorn-36857.exe	39
PID 2728 wrote to memory of 980	2728	Unicorn-32688.exe	40
PID 2728 wrote to memory of 980	2728	Unicorn-32688.exe	40
PID 2728 wrote to memory of 980	2728	Unicorn-32688.exe	40
PID 2728 wrote to memory of 980	2728	Unicorn-32688.exe	40
PID 1620 wrote to memory of 1596	1620	c3e7dcea8258286be71c08e3b7febd3ccba8104f9a79742c29ac0e15b345dc7d.exe	42
PID 1620 wrote to memory of 1596	1620	c3e7dcea8258286be71c08e3b7febd3ccba8104f9a79742c29ac0e15b345dc7d.exe	42
PID 1620 wrote to memory of 1596	1620	c3e7dcea8258286be71c08e3b7febd3ccba8104f9a79742c29ac0e15b345dc7d.exe	42
PID 1620 wrote to memory of 1596	1620	c3e7dcea8258286be71c08e3b7febd3ccba8104f9a79742c29ac0e15b345dc7d.exe	42
PID 2828 wrote to memory of 1392	2828	Unicorn-39395.exe	41
PID 2828 wrote to memory of 1392	2828	Unicorn-39395.exe	41
PID 2828 wrote to memory of 1392	2828	Unicorn-39395.exe	41
PID 2828 wrote to memory of 1392	2828	Unicorn-39395.exe	41
PID 2188 wrote to memory of 1912	2188	Unicorn-55155.exe	44
PID 2188 wrote to memory of 1912	2188	Unicorn-55155.exe	44
PID 2188 wrote to memory of 1912	2188	Unicorn-55155.exe	44
PID 2188 wrote to memory of 1912	2188	Unicorn-55155.exe	44
PID 2520 wrote to memory of 2040	2520	Unicorn-64148.exe	43
PID 2520 wrote to memory of 2040	2520	Unicorn-64148.exe	43
PID 2520 wrote to memory of 2040	2520	Unicorn-64148.exe	43
PID 2520 wrote to memory of 2040	2520	Unicorn-64148.exe	43
PID 2564 wrote to memory of 316	2564	Unicorn-60619.exe	45
PID 2564 wrote to memory of 316	2564	Unicorn-60619.exe	45
PID 2564 wrote to memory of 316	2564	Unicorn-60619.exe	45
PID 2564 wrote to memory of 316	2564	Unicorn-60619.exe	45
PID 2648 wrote to memory of 1672	2648	Unicorn-57750.exe	46
PID 2648 wrote to memory of 1672	2648	Unicorn-57750.exe	46
PID 2648 wrote to memory of 1672	2648	Unicorn-57750.exe	46
PID 2648 wrote to memory of 1672	2648	Unicorn-57750.exe	46

C:\Users\Admin\AppData\Local\Temp\c3e7dcea8258286be71c08e3b7febd3ccba8104f9a79742c29ac0e15b345dc7d.exe
"C:\Users\Admin\AppData\Local\Temp\c3e7dcea8258286be71c08e3b7febd3ccba8104f9a79742c29ac0e15b345dc7d.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36857.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36857.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64148.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64148.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55155.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23049.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47831.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1417.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52040.exe
        8⤵
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19880.exe
        9⤵
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53302.exe
        9⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40832.exe
        9⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45576.exe
        9⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39977.exe
        9⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32773.exe
        8⤵
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        8⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47937.exe
        8⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8420.exe
        8⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39977.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-161.exe
        7⤵
        
        PID:700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31333.exe
        8⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45078.exe
        8⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19517.exe
        8⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49957.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23110.exe
        8⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57207.exe
        7⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28872.exe
        7⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15631.exe
        7⤵
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60156.exe
        7⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50049.exe
        7⤵
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46705.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29477.exe
        7⤵
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39017.exe
        8⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52944.exe
        8⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61741.exe
        8⤵
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48112.exe
        8⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22313.exe
        7⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34331.exe
        7⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32166.exe
        7⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10610.exe
        7⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39977.exe
        7⤵
        
        PID:6204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24223.exe
        6⤵
        
        PID:876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-539.exe
        7⤵
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15192.exe
        7⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34966.exe
        7⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35811.exe
        7⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21849.exe
        7⤵
        
        PID:6780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58634.exe
        6⤵
        
        PID:2316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29064.exe
        6⤵
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15631.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27676.exe
        6⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40428.exe
        6⤵
        
        PID:7164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30461.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14686.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31333.exe
        7⤵
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45078.exe
        7⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19517.exe
        7⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8853.exe
        7⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21842.exe
        7⤵
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11467.exe
        6⤵
        
        PID:2448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58813.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32166.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10610.exe
        6⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39977.exe
        6⤵
        
        PID:5952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57373.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37606.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31672.exe
        6⤵
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40832.exe
        6⤵
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59626.exe
        6⤵
        
        PID:4720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1757.exe
        6⤵
        
        PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31068.exe
        5⤵
        
        PID:1196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56013.exe
        5⤵
        
        PID:3832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14824.exe
        5⤵
        
        PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6145.exe
        5⤵
        
        PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12042.exe
        5⤵
        
        PID:6556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30894.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3757.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63228.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55891.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23750.exe
        8⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49114.exe
        8⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20222.exe
        7⤵
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55258.exe
        7⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24955.exe
        7⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6575.exe
        7⤵
        
        PID:6128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38137.exe
        6⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10705.exe
        7⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52432.exe
        7⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39311.exe
        7⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43891.exe
        7⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38378.exe
        7⤵
        
        PID:6476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33957.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6495.exe
        6⤵
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36510.exe
        6⤵
        
        PID:2416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18690.exe
        6⤵
        
        PID:5700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6043.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26834.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26185.exe
        6⤵
        
        PID:768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53302.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40832.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43482.exe
        6⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5314.exe
        6⤵
        
        PID:6904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52535.exe
        5⤵
        
        PID:2840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        5⤵
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32861.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10610.exe
        5⤵
        
        PID:5324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38908.exe
        5⤵
        
        PID:6540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47020.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63228.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49516.exe
        6⤵
        
        PID:2524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36535.exe
        6⤵
        
        PID:3340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49393.exe
        6⤵
        
        PID:4032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33621.exe
        6⤵
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23110.exe
        6⤵
        
        PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11093.exe
        5⤵
        
        PID:1572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6877.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25383.exe
        5⤵
        
        PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50145.exe
        5⤵
        
        PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22911.exe
        5⤵
        
        PID:5252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13186.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6698.exe
        5⤵
        
        PID:1236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24648.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32166.exe
        5⤵
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13106.exe
        5⤵
        
        PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45763.exe
        5⤵
        
        PID:7128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63113.exe
      4⤵
      PID:1856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40088.exe
        5⤵
        
        PID:3092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52432.exe
        5⤵
        
        PID:3640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39311.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43891.exe
        5⤵
        
        PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39447.exe
        5⤵
        
        PID:6332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50777.exe
      4⤵
      PID:3244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63897.exe
      4⤵
      PID:3888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16195.exe
      4⤵
      PID:4836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41510.exe
      4⤵
      PID:5876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48914.exe
      4⤵
      PID:6684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35289.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35289.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57750.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29767.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28506.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6840.exe
        7⤵
        Executes dropped EXE
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6368.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49496.exe
        9⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26674.exe
        9⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20222.exe
        8⤵
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-630.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50200.exe
        8⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41499.exe
        8⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39048.exe
        8⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53047.exe
        7⤵
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58737.exe
        8⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21231.exe
        8⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46355.exe
        8⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30515.exe
        8⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33957.exe
        7⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47343.exe
        7⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27676.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17377.exe
        7⤵
        
        PID:6404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16414.exe
        6⤵
        
        PID:844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22376.exe
        7⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6437.exe
        7⤵
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35662.exe
        7⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35811.exe
        7⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37142.exe
        7⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64678.exe
        6⤵
        
        PID:2072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50502.exe
        6⤵
        
        PID:3352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15631.exe
        6⤵
        
        PID:5044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27676.exe
        6⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50049.exe
        6⤵
        
        PID:6816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24400.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36664.exe
        6⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-388.exe
        7⤵
        
        PID:952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5637.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40832.exe
        7⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27145.exe
        7⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22911.exe
        7⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26682.exe
        6⤵
        
        PID:2492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58813.exe
        6⤵
        
        PID:3808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41527.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27145.exe
        6⤵
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22911.exe
        6⤵
        
        PID:6324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62822.exe
        5⤵
        
        PID:1180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37606.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31672.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13054.exe
        6⤵
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18690.exe
        6⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38908.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31068.exe
        5⤵
        
        PID:2876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56013.exe
        5⤵
        
        PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        5⤵
        
        PID:4108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25486.exe
        5⤵
        
        PID:4192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18446.exe
        5⤵
        
        PID:6276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28157.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59834.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19944.exe
        6⤵
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20638.exe
        7⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5637.exe
        7⤵
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40832.exe
        7⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27145.exe
        7⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54515.exe
        7⤵
        
        PID:6740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37606.exe
        6⤵
        
        PID:2092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31672.exe
        6⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40832.exe
        6⤵
        
        PID:3488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27145.exe
        6⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54515.exe
        6⤵
        
        PID:6748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-929.exe
        5⤵
        
        PID:1584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9122.exe
        6⤵
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18129.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21719.exe
        6⤵
        
        PID:4712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35225.exe
        6⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22911.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51342.exe
        5⤵
        
        PID:2784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25665.exe
        5⤵
        
        PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15631.exe
        5⤵
        
        PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27676.exe
        5⤵
        
        PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18446.exe
        5⤵
        
        PID:6300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26698.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20795.exe
        5⤵
        
        PID:1208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        6⤵
        
        PID:1592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45078.exe
        6⤵
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13054.exe
        6⤵
        
        PID:4676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18690.exe
        6⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22379.exe
        6⤵
        
        PID:6868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25229.exe
        5⤵
        
        PID:1248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58813.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32166.exe
        5⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59653.exe
        5⤵
        
        PID:5128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17377.exe
        5⤵
        
        PID:6412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3425.exe
      4⤵
      PID:792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23987.exe
        5⤵
        
        PID:1412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25702.exe
        6⤵
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25108.exe
        6⤵
        
        PID:4924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59480.exe
        6⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7293.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20222.exe
        5⤵
        
        PID:3168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-630.exe
        5⤵
        
        PID:3916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45861.exe
        5⤵
        
        PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2309.exe
        5⤵
        
        PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5314.exe
        5⤵
        
        PID:6928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16400.exe
      4⤵
      PID:2056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60622.exe
        5⤵
        
        PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61895.exe
        5⤵
        
        PID:7092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14622.exe
      4⤵
      PID:2456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63897.exe
      4⤵
      PID:3748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15510.exe
      4⤵
      PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8890.exe
      4⤵
      PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17311.exe
      4⤵
      PID:5800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49975.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49975.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1126.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45356.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47925.exe
        6⤵
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40299.exe
        7⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21231.exe
        7⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16105.exe
        7⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47043.exe
        7⤵
        
        PID:6492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54794.exe
        6⤵
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31864.exe
        6⤵
        
        PID:3752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40832.exe
        6⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27145.exe
        6⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5314.exe
        6⤵
        
        PID:6912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57499.exe
        5⤵
        
        PID:2864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40088.exe
        6⤵
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52432.exe
        6⤵
        
        PID:3728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39996.exe
        6⤵
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10974.exe
        6⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21849.exe
        6⤵
        
        PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24455.exe
        5⤵
        
        PID:1012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11502.exe
        5⤵
        
        PID:3580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32166.exe
        5⤵
        
        PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10610.exe
        5⤵
        
        PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45763.exe
        5⤵
        
        PID:7148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25298.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6368.exe
        5⤵
        
        PID:2956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34605.exe
        6⤵
        
        PID:4500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32546.exe
        6⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42247.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20222.exe
        5⤵
        
        PID:3156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62056.exe
        5⤵
        
        PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35756.exe
        5⤵
        
        PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17377.exe
        5⤵
        
        PID:6396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-238.exe
      4⤵
      PID:2900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11005.exe
        5⤵
        
        PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62322.exe
        5⤵
        
        PID:5380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62849.exe
        5⤵
        
        PID:7060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39823.exe
      4⤵
      PID:3108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63367.exe
      4⤵
      PID:4060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19975.exe
      4⤵
      PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35756.exe
      4⤵
      PID:5756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17377.exe
      4⤵
      PID:6380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3492.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3492.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14686.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32402.exe
        5⤵
        
        PID:2676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45078.exe
        5⤵
        
        PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35854.exe
        5⤵
        
        PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33621.exe
        5⤵
        
        PID:4980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39447.exe
        5⤵
        
        PID:6256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11467.exe
      4⤵
      PID:2916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58813.exe
      4⤵
      PID:3788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41527.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27145.exe
      4⤵
      PID:4604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53472.exe
      4⤵
      PID:5932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54573.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54573.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-772.exe
      4⤵
      PID:2212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45078.exe
      4⤵
      PID:3972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19517.exe
      4⤵
      PID:4240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8853.exe
      4⤵
      PID:6088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22911.exe
      4⤵
      PID:6236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51451.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51451.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56543.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56543.exe
    3⤵
    PID:3732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11176.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11176.exe
    3⤵
    PID:4128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64157.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64157.exe
    3⤵
    PID:4940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-975.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-975.exe
    3⤵
    PID:6032
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60619.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60619.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39395.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39395.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56105.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53150.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30172.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29057.exe
        7⤵
        
        PID:832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5505.exe
        8⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10338.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20222.exe
        7⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63879.exe
        7⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43090.exe
        7⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39977.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36793.exe
        6⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64464.exe
        7⤵
        
        PID:6660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33957.exe
        6⤵
        
        PID:1556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46593.exe
        6⤵
        
        PID:2544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8420.exe
        6⤵
        
        PID:4136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39977.exe
        6⤵
        
        PID:6212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44406.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36278.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6437.exe
        6⤵
        
        PID:3704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19517.exe
        6⤵
        
        PID:4256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33621.exe
        6⤵
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23110.exe
        6⤵
        
        PID:6068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1990.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
        5⤵
        
        PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24756.exe
        5⤵
        
        PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39977.exe
        5⤵
        
        PID:4696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63228.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14430.exe
        6⤵
        
        PID:2608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24916.exe
        6⤵
        
        PID:3432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14489.exe
        6⤵
        
        PID:4596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35811.exe
        6⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21849.exe
        6⤵
        
        PID:6756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31980.exe
        5⤵
        
        PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20172.exe
        5⤵
        
        PID:3688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25383.exe
        5⤵
        
        PID:4284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41292.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6575.exe
        5⤵
        
        PID:4636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7321.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6506.exe
        5⤵
        
        PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45078.exe
        5⤵
        
        PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19517.exe
        5⤵
        
        PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49957.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23110.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31068.exe
      4⤵
      PID:2808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56013.exe
      4⤵
      PID:3868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31401.exe
      4⤵
      PID:4392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25486.exe
      4⤵
      PID:5016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18446.exe
      4⤵
      PID:6176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56885.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56885.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22803.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57001.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19366.exe
        6⤵
        
        PID:1660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6437.exe
        6⤵
        
        PID:3664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34976.exe
        6⤵
        
        PID:4100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33621.exe
        6⤵
        
        PID:5000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22278.exe
        6⤵
        
        PID:6984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5084.exe
        5⤵
        
        PID:2932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20172.exe
        5⤵
        
        PID:3696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56602.exe
        5⤵
        
        PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24955.exe
        5⤵
        
        PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22911.exe
        5⤵
        
        PID:5732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36943.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57472.exe
        5⤵
        
        PID:852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17937.exe
        5⤵
        
        PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57427.exe
        5⤵
        
        PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18690.exe
        5⤵
        
        PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38908.exe
        5⤵
        
        PID:6532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14507.exe
      4⤵
      PID:2464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64678.exe
      4⤵
      PID:3720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
      4⤵
      PID:4200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9383.exe
      4⤵
      PID:6056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17377.exe
      4⤵
      PID:6432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28241.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28241.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23369.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11379.exe
        5⤵
        
        PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45078.exe
        5⤵
        
        PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50737.exe
        5⤵
        
        PID:4384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33621.exe
        5⤵
        
        PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39447.exe
        5⤵
        
        PID:6148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64062.exe
      4⤵
      PID:2340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58813.exe
      4⤵
      PID:3816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41527.exe
      4⤵
      PID:2468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24955.exe
      4⤵
      PID:5080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6575.exe
      4⤵
      PID:6020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63447.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63447.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20119.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45078.exe
      4⤵
      PID:3948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19517.exe
      4⤵
      PID:4264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33621.exe
      4⤵
      PID:4776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23110.exe
      4⤵
      PID:6096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14004.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14004.exe
    3⤵
    PID:2384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4296.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4296.exe
    3⤵
    PID:3380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42878.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42878.exe
    3⤵
    PID:4852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33290.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33290.exe
    3⤵
    PID:4180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16242.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16242.exe
    3⤵
    PID:6500
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32688.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32688.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56105.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56105.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52574.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45164.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15444.exe
        6⤵
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25992.exe
        7⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21231.exe
        7⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29945.exe
        7⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48112.exe
        7⤵
        
        PID:6220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39033.exe
        6⤵
        
        PID:1968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31864.exe
        6⤵
        
        PID:3848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40832.exe
        6⤵
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59626.exe
        6⤵
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22911.exe
        6⤵
        
        PID:6316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27483.exe
        5⤵
        
        PID:2088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31333.exe
        6⤵
        
        PID:1720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5637.exe
        6⤵
        
        PID:3612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40832.exe
        6⤵
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27145.exe
        6⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5314.exe
        6⤵
        
        PID:6920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25202.exe
        5⤵
        
        PID:2328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64678.exe
        5⤵
        
        PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47937.exe
        5⤵
        
        PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8420.exe
        5⤵
        
        PID:4768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39977.exe
        5⤵
        
        PID:6228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10690.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22897.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38795.exe
        6⤵
        
        PID:2336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45078.exe
        6⤵
        
        PID:3964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19517.exe
        6⤵
        
        PID:4316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49957.exe
        6⤵
        
        PID:4568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23110.exe
        6⤵
        
        PID:6116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11467.exe
        5⤵
        
        PID:2716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58813.exe
        5⤵
        
        PID:3876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56602.exe
        5⤵
        
        PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32166.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29970.exe
        5⤵
        
        PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50049.exe
        5⤵
        
        PID:6840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33533.exe
      4⤵
      PID:1640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43339.exe
        5⤵
        
        PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48192.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30515.exe
        5⤵
        
        PID:6772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39823.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63367.exe
      4⤵
      PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19975.exe
      4⤵
      PID:4948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2839.exe
      4⤵
      PID:5868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-849.exe
      4⤵
      PID:6952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32900.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32900.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45164.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15060.exe
        5⤵
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6728.exe
        6⤵
        
        PID:3276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19778.exe
        6⤵
        
        PID:4576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62426.exe
        6⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47043.exe
        6⤵
        
        PID:6484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54794.exe
        5⤵
        
        PID:996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31864.exe
        5⤵
        
        PID:3780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40832.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58941.exe
        5⤵
        
        PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22911.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56923.exe
      4⤵
      PID:1112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6376.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25191.exe
        5⤵
        
        PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38026.exe
        5⤵
        
        PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30515.exe
        5⤵
        
        PID:6708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57211.exe
      4⤵
      PID:2772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11502.exe
      4⤵
      PID:3588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32166.exe
      4⤵
      PID:4324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10610.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38908.exe
      4⤵
      PID:6508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38650.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38650.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6368.exe
      4⤵
      PID:2984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37148.exe
        5⤵
        
        PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18322.exe
        5⤵
        
        PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58910.exe
        5⤵
        
        PID:6456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20222.exe
      4⤵
      PID:3144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-630.exe
      4⤵
      PID:3900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25336.exe
      4⤵
      PID:6100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50049.exe
      4⤵
      PID:6824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6103.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6103.exe
    3⤵
    PID:1272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63450.exe
      4⤵
      PID:568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57439.exe
      4⤵
      PID:3524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21719.exe
      4⤵
      PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35225.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60579.exe
      4⤵
      PID:7016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55371.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55371.exe
    3⤵
    PID:880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51839.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51839.exe
    3⤵
    PID:3492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32697.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32697.exe
    3⤵
    PID:5084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38625.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38625.exe
    3⤵
    PID:916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13111.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13111.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6248
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50495.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50495.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1126.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1126.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45164.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11827.exe
        5⤵
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39033.exe
        6⤵
        
        PID:1516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-698.exe
        6⤵
        
        PID:3464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62056.exe
        6⤵
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57957.exe
        6⤵
        
        PID:5052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14225.exe
        6⤵
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13111.exe
        6⤵
        
        PID:6308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47726.exe
        5⤵
        
        PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58813.exe
        5⤵
        
        PID:3860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56602.exe
        5⤵
        
        PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24955.exe
        5⤵
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22911.exe
        5⤵
        
        PID:5936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52040.exe
      4⤵
      PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62198.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3359.exe
        5⤵
        
        PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46282.exe
        5⤵
        
        PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14178.exe
        5⤵
        
        PID:6788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33957.exe
      4⤵
      PID:2920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47343.exe
      4⤵
      PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27676.exe
      4⤵
      PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17377.exe
      4⤵
      PID:6444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10690.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10690.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48439.exe
      4⤵
      PID:2380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49973.exe
        5⤵
        
        PID:2884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45078.exe
        5⤵
        
        PID:4004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35662.exe
        5⤵
        
        PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33621.exe
        5⤵
        
        PID:4972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23110.exe
        5⤵
        
        PID:6000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57051.exe
      4⤵
      PID:1364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58813.exe
      4⤵
      PID:3764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25383.exe
      4⤵
      PID:4292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57855.exe
      4⤵
      PID:6048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38908.exe
      4⤵
      PID:6548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-238.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-238.exe
    3⤵
    PID:1644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41846.exe
      4⤵
      PID:3456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40951.exe
      4⤵
      PID:4664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5109.exe
      4⤵
      PID:5844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14178.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39823.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39823.exe
    3⤵
    PID:3128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63367.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63367.exe
    3⤵
    PID:4048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19975.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19975.exe
    3⤵
    PID:4956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35756.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35756.exe
    3⤵
    PID:5720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50049.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50049.exe
    3⤵
    PID:6832
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11355.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11355.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45164.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45164.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47349.exe
      4⤵
      PID:2016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16533.exe
        5⤵
        
        PID:752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45078.exe
        5⤵
        
        PID:3932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35662.exe
        5⤵
        
        PID:2452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35811.exe
        5⤵
        
        PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39447.exe
        5⤵
        
        PID:6292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-772.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58813.exe
      4⤵
      PID:3772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56602.exe
      4⤵
      PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24955.exe
      4⤵
      PID:4176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22911.exe
      4⤵
      PID:6196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30026.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30026.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20119.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45078.exe
      4⤵
      PID:3956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19517.exe
      4⤵
      PID:4208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8853.exe
      4⤵
      PID:6080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60579.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51342.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51342.exe
    3⤵
    PID:236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37538.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37538.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32166.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32166.exe
    3⤵
    PID:4340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10610.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10610.exe
    3⤵
    PID:5300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45763.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45763.exe
    3⤵
    PID:7144
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51987.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51987.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6368.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6368.exe
    3⤵
    PID:1756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34565.exe
      4⤵
      PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21231.exe
      4⤵
      PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29945.exe
      4⤵
      PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30515.exe
      4⤵
      PID:6764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20222.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20222.exe
    3⤵
    PID:3188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63879.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63879.exe
    3⤵
    PID:4784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42405.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42405.exe
    3⤵
    PID:4692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39977.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39977.exe
    3⤵
    PID:6156
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63505.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63505.exe
  2⤵
  PID:2360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8000.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8000.exe
    3⤵
    PID:4040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21231.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21231.exe
    3⤵
    PID:4144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29945.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29945.exe
    3⤵
    PID:5352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14178.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14178.exe
    3⤵
    PID:6724
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10157.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10157.exe
  2⤵
  PID:3080
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37031.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37031.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1076
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14375.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14375.exe
  2⤵
  PID:4864
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50891.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50891.exe
  2⤵
  PID:5884
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35843.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35843.exe
  2⤵
  PID:6468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-29767.exe

Filesize
468KB

MD5
13d0c4b25e3126945466e1590f4e0253

SHA1
296ac209c6be528ce539a7afbbc1e02f449d2424

SHA256
2c3356849516f12b9e1e1380e652b1da6bbc5840ca29787312ffca27ae394a7c

SHA512
053d74bb3f9d787d1229f00546698139b3b1188945826c84e35c95955ff082b0b54cc4b32639f9942c53c0fd3ed78e7fad2967bb056f1138c98d8a357713dc75

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32688.exe

Filesize
468KB

MD5
f098e9a6d8c54f8f79735953ca2eb859

SHA1
9c8c8ecf66b6371b0774c02415e5e5b2635fb540

SHA256
d0ffd31158e7ca3bcb7703917a836b865e8d68d4223531e4d98f7b70bb21a5b7

SHA512
370a4403ab04dcce199b3a43d50ebe6ad249c53da191d7672f0e7833607ce8f2d516ed4ad2de6a2f855aa71948bcf6fad59f47ea443134e07cb04c3c34be23f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34605.exe

Filesize
468KB

MD5
90f4de55299cc1c51ef96700a1f81bd2

SHA1
3104f556ce22a568cefd2a68a5c59b03c0c92336

SHA256
9b5f73c13cf75c953b9041304e08dba1e1f47bdfc7c337b751da266ecd4ce2d1

SHA512
21a2382dee640836271fc475972bdf74ed86f2f9cd377dcc7b60f228ae7a0d74922960b38c8eeddce66acdec40efc278895ea5955a3c3b5e1792bf847cd0d275

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35289.exe

Filesize
468KB

MD5
7dbcb96f24a99a4c5f3d5b37caaa2c08

SHA1
f0a09f4b31ceae67ce87dcaa4b93ed94b6cf6e3e

SHA256
02cf2d33fac2352abd8d1f5b48b2b672d884368c556a23c59347d7e8ab73cb8a

SHA512
0af9aa599ba8b54f7ab06e54da752ec754c392f8d94130e3082f0fb3338b2dec1c3e11d78e9388902807239951bb489398749876a71cf6e54bd28602c5a46e11

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39395.exe

Filesize
468KB

MD5
a03dbdf41051ea6d955ff4cb0e3c47d9

SHA1
f2ee9d0d2424487b5cbb5e05c7aed93671c113ea

SHA256
63ba3dd3417a2a82e2d932ef52863cc03e85bd4a4034efba0688018177785776

SHA512
47de9a129c21374ed57d7b58117a6ca533bbbf7dc1874518e1a3b9f45d9f7f50496d8ea62581ffdff3fd0704e08d63a4bb16736a4c2e7ddecef01f94116e9f75

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49975.exe

Filesize
468KB

MD5
827731039984f6c3c7dd2b4cd5544ebf

SHA1
c5c7eab01d7556216145cca7fb28aa7dec0f4b11

SHA256
d538d5e7f28cad7cf4f3c6ae0c9f624ce6cada7ebb9a694186ecff570e0543ee

SHA512
0ded4e09e9f07bfce7146d4df2a092986c41dbeb8536890c530a18a8edd03323a3f1ad3fdfcece56df242ac4b64c77d01d6baa75ea04cea05dfc44a84dce04c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50495.exe

Filesize
468KB

MD5
80b2ff93f49605f9392bd4c38b5ea4e6

SHA1
db4b7e6f7875f7c32446b095b483f7e986e05dd9

SHA256
bd27ac33dc5c533e27eaaee2b3a56a33f1ad94eef987d72ccd386b7f036af17b

SHA512
c91fb91ea0fa0ac895af2f49e3c839795470445ba5024d9f8a5529dc0de6ff09021984901b76baf36298e5a7acd6af37c5e20807e89ca2735668274ac0b24381

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57750.exe

Filesize
468KB

MD5
ea1fb9db1e4a3b843e290d414976f2d1

SHA1
f859e4c29c2fb6a4faff90c2817d8f2d590ed9c2

SHA256
04d3948feefdd474335e3f7606285b8cac77dbf916a26f38080a34630cea5ce7

SHA512
47725a727cdd8719578ebd5f13d2739e5c2cf36c3115b152d36faa06e83046f981def6f29700bab6fa134f99456478701490214368ad24039355d510e14197e7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23049.exe

Filesize
468KB

MD5
7fd7d626606632eb268c525843ba018f

SHA1
759dbe1d4d7060ae53a29c694f0d454b1aadfda6

SHA256
2038dd21883361556e20d920d3cf8a601cfdf8b1349caee349e0b623ea51d167

SHA512
8dfe0de8035225942efc4dc8564ad6803dfd0ba5491b26360661c8ee5d224399092544837dfd2f6dd487802172c3f3868e54efbfdb884fd45e070f9b17ad3330

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28157.exe

Filesize
468KB

MD5
d8aff37a139fb7e0c4b06e8d3ff64dc2

SHA1
f65feee530ff8e28e907ce6a741678ebd4e6f042

SHA256
85d66e690b74a48ef4d5210dd2c077152a1dd11fc5243668409ed797bfbf5c4d

SHA512
0d618991053a9481ba47c022725788d58fd5d4accd2f908f64460dd3ecfdd636bc56ae8b7e7d10a1cdf8005a8b7cb67efac02e311780dc8ba1f21119db72f6ef

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-30894.exe

Filesize
468KB

MD5
d2dd3282f15f7053e76ad70945c3fb3b

SHA1
8012b06902a843d18cb793f42e16d95cdb8086b8

SHA256
8f64e3744aebaeaa67dc7bb6d2e8d27e6dbe346478a255f4c211e439603a834b

SHA512
961f3bd953640c4d894eb1636eec75f2f456c2525bc53a7283d4c6d5929ece382fc3042cce13f000a5dfe24b5d63a18202d476212a1909ecd4fe2226addc1bf5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36857.exe

Filesize
468KB

MD5
4b6a368e4229244bc78bd34089b98866

SHA1
0b63bba5212239c7e21c25d3ad3984ffec236df9

SHA256
ad9efcb9bf1f41f22d6dbbd3aebfd6b219995a897c6d1dac3fc584c085d2b6ef

SHA512
e8ec809c9d80135b6197d3236c40f1529d4c3ea854a272d7700e9857bb605d272ad2c6272dae32a2454ad1f83a9fe4f92b5a8f0bf68112c6f32382b804681e4e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47831.exe

Filesize
468KB

MD5
ffa46deead9a8e39239698a4a2756fca

SHA1
435c9949dd903851f32c8385612048f684e8f05c

SHA256
0700a3c56366dbd1719be25896ca2f3d9af139a207040df27c30f85738aa9ebe

SHA512
4ca254de7f1dc8fd09015f0f31070719208f4f66b5fc10ebd6ab0d3526255a2a0c35bf561a5df03c9e9723f41cb6cf6d9d9c1b4ae1dbee1c87b670471e3ccfe3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55155.exe

Filesize
468KB

MD5
f411de0b8eb651a94777877b96b707e9

SHA1
ef8b944476ac98d02d088856c0ffad18ab0df2a2

SHA256
6407cf054c8c49d855fca8f772ce72a11ba3eff86cdfd2c22d5fd9ea7ac86a35

SHA512
1c8103fd2def9fec24fcf59fdbbb0a29312b74a675adf95fd26fde42027ecbb77706e9aa0f4941cb10b1ce5d401f292dc90b61d4a060141f94b1764e64813d3d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56105.exe

Filesize
468KB

MD5
1a3877b7d2677ddae691268390a49804

SHA1
051ee533c04d67998a70888f4c96d3c68cec081d

SHA256
2aab0f6ce1c47aea13e86c4ead3a84ced06b0a8ef9b606f2164f7bc8d7096d0d

SHA512
786a1f9f6e7fc68aeeb12a48bfc5886d71e068ec28fbb87df3cec951bde79fe060e024d8a0314f3121564d8b3be633e0b0f25564b6317489721d9ae8e5151906

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56885.exe

Filesize
468KB

MD5
94e7871b80852e8ff988eb165a6b42cb

SHA1
8e780fd0522bf70321c6010183d8b42ecc4af212

SHA256
048d09c41324998496f6e9df4e2ea231e377bb495a4cb4ec7e54995d250cf125

SHA512
e873598f4f4231fa4b813abe764f41ca13fa47cc088796e3a339dccfc10bcae3ab0662aa32a02a1e87e3fa4b62e04aafd0113ffca593d5c7b76e433605525d6a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60619.exe

Filesize
468KB

MD5
f4110795347bed8e39d16cbf6cdc0599

SHA1
d6829e47fc0dd348a598eede0c08a114dece7fe6

SHA256
81ec887c7411b3a2daf504bb3ee764a424ddc35db1d8b4c2c170da9433ca3f1d

SHA512
08c326b453510aa4c00030808654d710fc07752be59ade389571460501bfbf3100fe53ac8d31c23b466d4b7875c59b65b8d7e29fbc639a6047036c04c5fe81db

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64148.exe

Filesize
468KB

MD5
4eb62c0c7627a1b22dbe824247cc23cb

SHA1
b785044d2646aee45c11619383c479d9d9ffe46e

SHA256
b4a849bc56d979b9a6a95d81f9d14afacf3ca1df40c7d1112f843a46404c0b8b

SHA512
a19caeba91412a424192cdbb88db149c7a0e5ef4c65085c169dd2e004d3b1ecc716ed9a8086bfe1ca237193e8715b7aae15cb554cf2e4aa5667a6013f6bd45a5

Download Submit