e9a7d5568470ff298560c6f8b12222e9692fb55fee1ed82da06a4b0421322435

Analysis

max time kernel
149s
max time network
124s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 05:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e9a7d5568470ff298560c6f8b12222e9692fb55fee1ed82da06a4b0421322435.exe
Size

468KB
MD5

47e2470157cf5e42d230ac634626c0a2
SHA1

80fbb12b5ac0524535de2f51057e386334e82b32
SHA256

e9a7d5568470ff298560c6f8b12222e9692fb55fee1ed82da06a4b0421322435
SHA512

021f95a96c2533a7f66fc8a7933d807575fc8ceae8fa4d5dcab8ac7ce934543e946e2c064fd957bab72308db5d795bbf03b96daf2b3656d354d90602eb4833ce
SSDEEP

3072:9belogxaId57tbY6PzcfmbfD/n2mnsIH/QmyeQVq6L+/kCiauxDlq:9b4oCb7txP4fmbfAa1qL+M5aux

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2468	Unicorn-5888.exe
3056	Unicorn-52370.exe
2088	Unicorn-32312.exe
2924	Unicorn-46239.exe
2820	Unicorn-9653.exe
2888	Unicorn-9164.exe
2704	Unicorn-15294.exe
2696	Unicorn-40313.exe
2156	Unicorn-25958.exe
1268	Unicorn-44407.exe
2140	Unicorn-11999.exe
2000	Unicorn-44672.exe
1184	Unicorn-28336.exe
304	Unicorn-43638.exe
1740	Unicorn-57374.exe
2072	Unicorn-31538.exe
2220	Unicorn-4080.exe
564	Unicorn-56426.exe
832	Unicorn-8303.exe
1128	Unicorn-14241.exe
680	Unicorn-48155.exe
960	Unicorn-40557.exe
3012	Unicorn-64101.exe
976	Unicorn-14635.exe
1656	Unicorn-8770.exe
2660	Unicorn-14900.exe
1664	Unicorn-55741.exe
2224	Unicorn-61148.exe
2624	Unicorn-20115.exe
1956	Unicorn-31621.exe
296	Unicorn-28091.exe
2500	Unicorn-22140.exe
2364	Unicorn-22148.exe
2452	Unicorn-3966.exe
2208	Unicorn-34366.exe
2176	Unicorn-34631.exe
2764	Unicorn-26847.exe
2872	Unicorn-6981.exe
2824	Unicorn-6981.exe
2964	Unicorn-22357.exe
2836	Unicorn-50391.exe
2904	Unicorn-16949.exe
2728	Unicorn-64262.exe
2744	Unicorn-23230.exe
2676	Unicorn-3364.exe
2168	Unicorn-13836.exe
1796	Unicorn-63110.exe
1948	Unicorn-46774.exe
1736	Unicorn-10956.exe
348	Unicorn-27100.exe
1144	Unicorn-46966.exe
880	Unicorn-46966.exe
2748	Unicorn-46966.exe
1760	Unicorn-55415.exe
1808	Unicorn-25350.exe
2180	Unicorn-34094.exe
2528	Unicorn-60240.exe
576	Unicorn-14568.exe
1424	Unicorn-11039.exe
2980	Unicorn-78.exe
2656	Unicorn-47625.exe
1264	Unicorn-5175.exe
1540	Unicorn-35767.exe
1236	Unicorn-16166.exe

Loads dropped DLL 64 IoCs

pid	Process
684	e9a7d5568470ff298560c6f8b12222e9692fb55fee1ed82da06a4b0421322435.exe
684	e9a7d5568470ff298560c6f8b12222e9692fb55fee1ed82da06a4b0421322435.exe
2468	Unicorn-5888.exe
2468	Unicorn-5888.exe
684	e9a7d5568470ff298560c6f8b12222e9692fb55fee1ed82da06a4b0421322435.exe
684	e9a7d5568470ff298560c6f8b12222e9692fb55fee1ed82da06a4b0421322435.exe
3056	Unicorn-52370.exe
3056	Unicorn-52370.exe
2468	Unicorn-5888.exe
2468	Unicorn-5888.exe
684	e9a7d5568470ff298560c6f8b12222e9692fb55fee1ed82da06a4b0421322435.exe
684	e9a7d5568470ff298560c6f8b12222e9692fb55fee1ed82da06a4b0421322435.exe
2088	Unicorn-32312.exe
2088	Unicorn-32312.exe
2924	Unicorn-46239.exe
2924	Unicorn-46239.exe
3056	Unicorn-52370.exe
3056	Unicorn-52370.exe
2888	Unicorn-9164.exe
2888	Unicorn-9164.exe
684	e9a7d5568470ff298560c6f8b12222e9692fb55fee1ed82da06a4b0421322435.exe
2704	Unicorn-15294.exe
684	e9a7d5568470ff298560c6f8b12222e9692fb55fee1ed82da06a4b0421322435.exe
2704	Unicorn-15294.exe
2820	Unicorn-9653.exe
2820	Unicorn-9653.exe
2468	Unicorn-5888.exe
2088	Unicorn-32312.exe
2468	Unicorn-5888.exe
2088	Unicorn-32312.exe
2696	Unicorn-40313.exe
2696	Unicorn-40313.exe
2924	Unicorn-46239.exe
2924	Unicorn-46239.exe
2156	Unicorn-25958.exe
2156	Unicorn-25958.exe
3056	Unicorn-52370.exe
3056	Unicorn-52370.exe
1268	Unicorn-44407.exe
1268	Unicorn-44407.exe
684	e9a7d5568470ff298560c6f8b12222e9692fb55fee1ed82da06a4b0421322435.exe
684	e9a7d5568470ff298560c6f8b12222e9692fb55fee1ed82da06a4b0421322435.exe
1740	Unicorn-57374.exe
1740	Unicorn-57374.exe
304	Unicorn-43638.exe
304	Unicorn-43638.exe
2468	Unicorn-5888.exe
2088	Unicorn-32312.exe
2000	Unicorn-44672.exe
2468	Unicorn-5888.exe
2088	Unicorn-32312.exe
2000	Unicorn-44672.exe
1184	Unicorn-28336.exe
1184	Unicorn-28336.exe
2704	Unicorn-15294.exe
2704	Unicorn-15294.exe
2820	Unicorn-9653.exe
2820	Unicorn-9653.exe
2140	Unicorn-11999.exe
2140	Unicorn-11999.exe
2888	Unicorn-9164.exe
2888	Unicorn-9164.exe
2220	Unicorn-4080.exe
2220	Unicorn-4080.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35199.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24936.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65006.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2226.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38597.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34631.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22082.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33574.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54800.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29402.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35782.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-607.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63774.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36078.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57970.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-607.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40435.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56477.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64125.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42311.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16270.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31980.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59070.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52168.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45446.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65285.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52370.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11999.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25405.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25405.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4919.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27168.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14183.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47565.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36608.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54800.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10807.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21665.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9369.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61751.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55323.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11631.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35199.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33251.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-607.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53832.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50055.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48935.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42978.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62917.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43247.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61405.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55041.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40110.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
684	e9a7d5568470ff298560c6f8b12222e9692fb55fee1ed82da06a4b0421322435.exe
2468	Unicorn-5888.exe
3056	Unicorn-52370.exe
2088	Unicorn-32312.exe
2924	Unicorn-46239.exe
2820	Unicorn-9653.exe
2888	Unicorn-9164.exe
2704	Unicorn-15294.exe
2696	Unicorn-40313.exe
2156	Unicorn-25958.exe
1268	Unicorn-44407.exe
1184	Unicorn-28336.exe
2140	Unicorn-11999.exe
2000	Unicorn-44672.exe
1740	Unicorn-57374.exe
304	Unicorn-43638.exe
2072	Unicorn-31538.exe
2220	Unicorn-4080.exe
564	Unicorn-56426.exe
832	Unicorn-8303.exe
1128	Unicorn-14241.exe
680	Unicorn-48155.exe
3012	Unicorn-64101.exe
2660	Unicorn-14900.exe
960	Unicorn-40557.exe
976	Unicorn-14635.exe
1656	Unicorn-8770.exe
1664	Unicorn-55741.exe
2624	Unicorn-20115.exe
2224	Unicorn-61148.exe
1956	Unicorn-31621.exe
296	Unicorn-28091.exe
2500	Unicorn-22140.exe
2208	Unicorn-34366.exe
2452	Unicorn-3966.exe
2176	Unicorn-34631.exe
2764	Unicorn-26847.exe
2964	Unicorn-22357.exe
2872	Unicorn-6981.exe
2824	Unicorn-6981.exe
2836	Unicorn-50391.exe
2904	Unicorn-16949.exe
2728	Unicorn-64262.exe
2744	Unicorn-23230.exe
2676	Unicorn-3364.exe
2168	Unicorn-13836.exe
1796	Unicorn-63110.exe
1948	Unicorn-46774.exe
1736	Unicorn-10956.exe
880	Unicorn-46966.exe
2748	Unicorn-46966.exe
1144	Unicorn-46966.exe
348	Unicorn-27100.exe
2180	Unicorn-34094.exe
1424	Unicorn-11039.exe
1760	Unicorn-55415.exe
1808	Unicorn-25350.exe
576	Unicorn-14568.exe
2528	Unicorn-60240.exe
2980	Unicorn-78.exe
2656	Unicorn-47625.exe
1264	Unicorn-5175.exe
1540	Unicorn-35767.exe
1236	Unicorn-16166.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 684 wrote to memory of 2468	684	e9a7d5568470ff298560c6f8b12222e9692fb55fee1ed82da06a4b0421322435.exe	30
PID 684 wrote to memory of 2468	684	e9a7d5568470ff298560c6f8b12222e9692fb55fee1ed82da06a4b0421322435.exe	30
PID 684 wrote to memory of 2468	684	e9a7d5568470ff298560c6f8b12222e9692fb55fee1ed82da06a4b0421322435.exe	30
PID 684 wrote to memory of 2468	684	e9a7d5568470ff298560c6f8b12222e9692fb55fee1ed82da06a4b0421322435.exe	30
PID 2468 wrote to memory of 3056	2468	Unicorn-5888.exe	31
PID 2468 wrote to memory of 3056	2468	Unicorn-5888.exe	31
PID 2468 wrote to memory of 3056	2468	Unicorn-5888.exe	31
PID 2468 wrote to memory of 3056	2468	Unicorn-5888.exe	31
PID 684 wrote to memory of 2088	684	e9a7d5568470ff298560c6f8b12222e9692fb55fee1ed82da06a4b0421322435.exe	32
PID 684 wrote to memory of 2088	684	e9a7d5568470ff298560c6f8b12222e9692fb55fee1ed82da06a4b0421322435.exe	32
PID 684 wrote to memory of 2088	684	e9a7d5568470ff298560c6f8b12222e9692fb55fee1ed82da06a4b0421322435.exe	32
PID 684 wrote to memory of 2088	684	e9a7d5568470ff298560c6f8b12222e9692fb55fee1ed82da06a4b0421322435.exe	32
PID 3056 wrote to memory of 2924	3056	Unicorn-52370.exe	34
PID 3056 wrote to memory of 2924	3056	Unicorn-52370.exe	34
PID 3056 wrote to memory of 2924	3056	Unicorn-52370.exe	34
PID 3056 wrote to memory of 2924	3056	Unicorn-52370.exe	34
PID 2468 wrote to memory of 2820	2468	Unicorn-5888.exe	35
PID 2468 wrote to memory of 2820	2468	Unicorn-5888.exe	35
PID 2468 wrote to memory of 2820	2468	Unicorn-5888.exe	35
PID 2468 wrote to memory of 2820	2468	Unicorn-5888.exe	35
PID 684 wrote to memory of 2888	684	e9a7d5568470ff298560c6f8b12222e9692fb55fee1ed82da06a4b0421322435.exe	36
PID 684 wrote to memory of 2888	684	e9a7d5568470ff298560c6f8b12222e9692fb55fee1ed82da06a4b0421322435.exe	36
PID 684 wrote to memory of 2888	684	e9a7d5568470ff298560c6f8b12222e9692fb55fee1ed82da06a4b0421322435.exe	36
PID 684 wrote to memory of 2888	684	e9a7d5568470ff298560c6f8b12222e9692fb55fee1ed82da06a4b0421322435.exe	36
PID 2088 wrote to memory of 2704	2088	Unicorn-32312.exe	37
PID 2088 wrote to memory of 2704	2088	Unicorn-32312.exe	37
PID 2088 wrote to memory of 2704	2088	Unicorn-32312.exe	37
PID 2088 wrote to memory of 2704	2088	Unicorn-32312.exe	37
PID 2924 wrote to memory of 2696	2924	Unicorn-46239.exe	38
PID 2924 wrote to memory of 2696	2924	Unicorn-46239.exe	38
PID 2924 wrote to memory of 2696	2924	Unicorn-46239.exe	38
PID 2924 wrote to memory of 2696	2924	Unicorn-46239.exe	38
PID 3056 wrote to memory of 2156	3056	Unicorn-52370.exe	39
PID 3056 wrote to memory of 2156	3056	Unicorn-52370.exe	39
PID 3056 wrote to memory of 2156	3056	Unicorn-52370.exe	39
PID 3056 wrote to memory of 2156	3056	Unicorn-52370.exe	39
PID 2888 wrote to memory of 2140	2888	Unicorn-9164.exe	40
PID 2888 wrote to memory of 2140	2888	Unicorn-9164.exe	40
PID 2888 wrote to memory of 2140	2888	Unicorn-9164.exe	40
PID 2888 wrote to memory of 2140	2888	Unicorn-9164.exe	40
PID 684 wrote to memory of 1268	684	e9a7d5568470ff298560c6f8b12222e9692fb55fee1ed82da06a4b0421322435.exe	41
PID 684 wrote to memory of 1268	684	e9a7d5568470ff298560c6f8b12222e9692fb55fee1ed82da06a4b0421322435.exe	41
PID 684 wrote to memory of 1268	684	e9a7d5568470ff298560c6f8b12222e9692fb55fee1ed82da06a4b0421322435.exe	41
PID 684 wrote to memory of 1268	684	e9a7d5568470ff298560c6f8b12222e9692fb55fee1ed82da06a4b0421322435.exe	41
PID 2704 wrote to memory of 2000	2704	Unicorn-15294.exe	42
PID 2704 wrote to memory of 2000	2704	Unicorn-15294.exe	42
PID 2704 wrote to memory of 2000	2704	Unicorn-15294.exe	42
PID 2704 wrote to memory of 2000	2704	Unicorn-15294.exe	42
PID 2820 wrote to memory of 1184	2820	Unicorn-9653.exe	43
PID 2820 wrote to memory of 1184	2820	Unicorn-9653.exe	43
PID 2820 wrote to memory of 1184	2820	Unicorn-9653.exe	43
PID 2820 wrote to memory of 1184	2820	Unicorn-9653.exe	43
PID 2088 wrote to memory of 304	2088	Unicorn-32312.exe	45
PID 2088 wrote to memory of 304	2088	Unicorn-32312.exe	45
PID 2088 wrote to memory of 304	2088	Unicorn-32312.exe	45
PID 2088 wrote to memory of 304	2088	Unicorn-32312.exe	45
PID 2468 wrote to memory of 1740	2468	Unicorn-5888.exe	44
PID 2468 wrote to memory of 1740	2468	Unicorn-5888.exe	44
PID 2468 wrote to memory of 1740	2468	Unicorn-5888.exe	44
PID 2468 wrote to memory of 1740	2468	Unicorn-5888.exe	44
PID 2696 wrote to memory of 2072	2696	Unicorn-40313.exe	46
PID 2696 wrote to memory of 2072	2696	Unicorn-40313.exe	46
PID 2696 wrote to memory of 2072	2696	Unicorn-40313.exe	46
PID 2696 wrote to memory of 2072	2696	Unicorn-40313.exe	46

C:\Users\Admin\AppData\Local\Temp\e9a7d5568470ff298560c6f8b12222e9692fb55fee1ed82da06a4b0421322435.exe
"C:\Users\Admin\AppData\Local\Temp\e9a7d5568470ff298560c6f8b12222e9692fb55fee1ed82da06a4b0421322435.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:684
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5888.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5888.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52370.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52370.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46239.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40313.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31538.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16166.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45565.exe
        8⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4919.exe
        8⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32505.exe
        8⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40416.exe
        8⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25578.exe
        8⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6034.exe
        8⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52900.exe
        8⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53832.exe
        8⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15890.exe
        7⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49745.exe
        8⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47605.exe
        8⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58061.exe
        8⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23297.exe
        8⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24520.exe
        7⤵
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16270.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12867.exe
        7⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49046.exe
        7⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54067.exe
        7⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52168.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23310.exe
        7⤵
        
        PID:2568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6981.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6369.exe
        7⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4919.exe
        7⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57970.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40416.exe
        7⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10901.exe
        7⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10061.exe
        7⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7431.exe
        7⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58033.exe
        7⤵
        
        PID:6436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-239.exe
        6⤵
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42311.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7930.exe
        6⤵
        
        PID:1644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48743.exe
        6⤵
        
        PID:3376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54022.exe
        6⤵
        
        PID:1480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55164.exe
        6⤵
        
        PID:4328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58789.exe
        6⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22212.exe
        6⤵
        
        PID:5132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49046.exe
        6⤵
        
        PID:6744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4080.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22140.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47625.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55287.exe
        8⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53936.exe
        8⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58123.exe
        8⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65285.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1922.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45251.exe
        7⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56477.exe
        7⤵
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8007.exe
        7⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40359.exe
        7⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11852.exe
        7⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25405.exe
        7⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5175.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61405.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62168.exe
        7⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42015.exe
        7⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5104.exe
        7⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24821.exe
        7⤵
        
        PID:2332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49757.exe
        6⤵
        
        PID:1772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51116.exe
        6⤵
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47812.exe
        6⤵
        
        PID:4084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57009.exe
        6⤵
        
        PID:4592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57425.exe
        6⤵
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34322.exe
        6⤵
        
        PID:5900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19221.exe
        6⤵
        
        PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22148.exe
        5⤵
        Executes dropped EXE
        
        PID:2364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31289.exe
        6⤵
        
        PID:1280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18559.exe
        7⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4150.exe
        7⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46872.exe
        7⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31669.exe
        7⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18258.exe
        6⤵
        
        PID:1028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50518.exe
        6⤵
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14183.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60486.exe
        6⤵
        
        PID:4288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49464.exe
        6⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47565.exe
        6⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58033.exe
        6⤵
        
        PID:6388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35767.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24026.exe
        6⤵
        
        PID:3940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57342.exe
        6⤵
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
        6⤵
        
        PID:4784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33574.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63633.exe
        6⤵
        
        PID:6636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15854.exe
        5⤵
        
        PID:2796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13170.exe
        5⤵
        
        PID:3824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32281.exe
        5⤵
        
        PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4578.exe
        5⤵
        
        PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53994.exe
        5⤵
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33187.exe
        5⤵
        
        PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46990.exe
        5⤵
        
        PID:6228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25958.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56426.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34631.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19120.exe
        7⤵
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17587.exe
        8⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7916.exe
        8⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58061.exe
        8⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23297.exe
        8⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4919.exe
        7⤵
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35194.exe
        7⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50263.exe
        7⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2226.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63795.exe
        7⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55853.exe
        7⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38949.exe
        7⤵
        
        PID:7032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46639.exe
        6⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9369.exe
        7⤵
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35199.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43247.exe
        7⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23689.exe
        7⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40359.exe
        7⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55853.exe
        7⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25405.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3239.exe
        6⤵
        
        PID:2404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54800.exe
        6⤵
        
        PID:3196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13027.exe
        6⤵
        
        PID:3572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49608.exe
        6⤵
        
        PID:4484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41296.exe
        6⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47565.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58033.exe
        6⤵
        
        PID:6460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6981.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15466.exe
        6⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45041.exe
        7⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
        7⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21692.exe
        7⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-607.exe
        7⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40359.exe
        7⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12766.exe
        7⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53832.exe
        7⤵
        
        PID:6564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49727.exe
        6⤵
        
        PID:2880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
        6⤵
        
        PID:3244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46389.exe
        6⤵
        
        PID:1780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-607.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6034.exe
        6⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52900.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53832.exe
        6⤵
        
        PID:6528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36721.exe
        5⤵
        
        PID:2736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8217.exe
        6⤵
        
        PID:1316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35199.exe
        6⤵
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43247.exe
        6⤵
        
        PID:3744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23689.exe
        6⤵
        
        PID:4116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40359.exe
        6⤵
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4327.exe
        6⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12766.exe
        6⤵
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53832.exe
        6⤵
        
        PID:6580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40132.exe
        5⤵
        
        PID:1340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46135.exe
        5⤵
        
        PID:3096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41168.exe
        5⤵
        
        PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8553.exe
        5⤵
        
        PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40161.exe
        5⤵
        
        PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16431.exe
        5⤵
        
        PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27497.exe
        5⤵
        
        PID:6604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8303.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3966.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56499.exe
        6⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9784.exe
        7⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35199.exe
        7⤵
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40524.exe
        7⤵
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9272.exe
        7⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56895.exe
        7⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38787.exe
        7⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44284.exe
        7⤵
        
        PID:7012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36078.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
        6⤵
        
        PID:3188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62917.exe
        6⤵
        
        PID:2420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8152.exe
        6⤵
        
        PID:4280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63774.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43928.exe
        6⤵
        
        PID:5700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25405.exe
        6⤵
        
        PID:6340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30961.exe
        5⤵
        
        PID:2800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46135.exe
        5⤵
        
        PID:3104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41168.exe
        5⤵
        
        PID:2508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8553.exe
        5⤵
        
        PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30559.exe
        5⤵
        
        PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33187.exe
        5⤵
        
        PID:5908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62071.exe
        5⤵
        
        PID:6104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34366.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-845.exe
        6⤵
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8684.exe
        6⤵
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58061.exe
        6⤵
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23297.exe
        6⤵
        
        PID:6596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4919.exe
        5⤵
        
        PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42978.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49879.exe
        5⤵
        
        PID:4060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51427.exe
        5⤵
        
        PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40359.exe
        5⤵
        
        PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11852.exe
        5⤵
        
        PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15021.exe
        5⤵
        
        PID:7112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10189.exe
      4⤵
      PID:1852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61751.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31515.exe
        5⤵
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50612.exe
        5⤵
        
        PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16672.exe
        5⤵
        
        PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53930.exe
        5⤵
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8894.exe
        5⤵
        
        PID:5552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59167.exe
        5⤵
        
        PID:6408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64856.exe
      4⤵
      PID:2816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55700.exe
      4⤵
      PID:3796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10750.exe
      4⤵
      PID:3724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64780.exe
      4⤵
      PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34759.exe
      4⤵
      PID:4952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5451.exe
      4⤵
      PID:5964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54222.exe
      4⤵
      PID:2632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9653.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9653.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28336.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55741.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63110.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
        7⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4919.exe
        7⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32505.exe
        7⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40416.exe
        7⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25578.exe
        7⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6034.exe
        7⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52900.exe
        7⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53832.exe
        7⤵
        
        PID:6556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61107.exe
        6⤵
        
        PID:1108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16595.exe
        6⤵
        
        PID:2236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10581.exe
        6⤵
        
        PID:3892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15615.exe
        6⤵
        
        PID:3492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23071.exe
        6⤵
        
        PID:4656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49432.exe
        6⤵
        
        PID:5812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12096.exe
        6⤵
        
        PID:6644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10956.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59015.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29530.exe
        6⤵
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16359.exe
        6⤵
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55323.exe
        6⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41887.exe
        6⤵
        
        PID:7160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3239.exe
        5⤵
        
        PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54800.exe
        5⤵
        
        PID:3172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54252.exe
        5⤵
        
        PID:3144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37868.exe
        5⤵
        
        PID:4996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35894.exe
        5⤵
        
        PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28987.exe
        5⤵
        
        PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40110.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20115.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46966.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17223.exe
        6⤵
        
        PID:3932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64327.exe
        6⤵
        
        PID:5032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1174.exe
        6⤵
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12395.exe
        6⤵
        
        PID:4944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46406.exe
        6⤵
        
        PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55041.exe
        5⤵
        
        PID:1848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
        5⤵
        
        PID:3252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46389.exe
        5⤵
        
        PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-607.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40359.exe
        5⤵
        
        PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11852.exe
        5⤵
        
        PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25405.exe
        5⤵
        
        PID:6292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34094.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9369.exe
        5⤵
        
        PID:1532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35199.exe
        5⤵
        
        PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15827.exe
        5⤵
        
        PID:3564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9272.exe
        5⤵
        
        PID:4468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45761.exe
        5⤵
        
        PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8894.exe
        5⤵
        
        PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59167.exe
        5⤵
        
        PID:6424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9104.exe
      4⤵
      PID:1904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46135.exe
      4⤵
      PID:3120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41168.exe
      4⤵
      PID:624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8553.exe
      4⤵
      PID:5064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48329.exe
      4⤵
      PID:5352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24030.exe
      4⤵
      PID:5740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12096.exe
      4⤵
      PID:6628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57374.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57374.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40557.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14568.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63182.exe
        6⤵
        
        PID:3504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54010.exe
        6⤵
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17593.exe
        6⤵
        
        PID:4956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63988.exe
        6⤵
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32989.exe
        6⤵
        
        PID:6356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28699.exe
        5⤵
        
        PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
        5⤵
        
        PID:3220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46389.exe
        5⤵
        
        PID:3668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-607.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40359.exe
        5⤵
        
        PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11852.exe
        5⤵
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25405.exe
        5⤵
        
        PID:6332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11039.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65006.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13428.exe
        5⤵
        
        PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28254.exe
        5⤵
        
        PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44348.exe
        5⤵
        
        PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16845.exe
        5⤵
        
        PID:6760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19850.exe
      4⤵
      PID:2292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29912.exe
      4⤵
      PID:3388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5518.exe
      4⤵
      PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57009.exe
      4⤵
      PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15323.exe
      4⤵
      PID:4176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34322.exe
      4⤵
      PID:6064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20070.exe
      4⤵
      PID:6252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14635.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14635.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44994.exe
      4⤵
      PID:2912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18654.exe
      4⤵
      PID:1380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24936.exe
      4⤵
      PID:4020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29402.exe
      4⤵
      PID:3472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31980.exe
      4⤵
      PID:4768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1893.exe
      4⤵
      PID:4628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57503.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61103.exe
      4⤵
      PID:6032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38597.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43555.exe
      4⤵
      PID:6212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49440.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49440.exe
    3⤵
    PID:2956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46665.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46665.exe
    3⤵
    PID:3080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33251.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33251.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47353.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47353.exe
    3⤵
    PID:4256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58174.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58174.exe
    3⤵
    PID:5100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59063.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59063.exe
    3⤵
    PID:5668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43871.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43871.exe
    3⤵
    PID:6028
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32312.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32312.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15294.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15294.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44672.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14900.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64262.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9369.exe
        7⤵
        
        PID:1472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35199.exe
        7⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43247.exe
        7⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23689.exe
        7⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40359.exe
        7⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11852.exe
        7⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25405.exe
        7⤵
        
        PID:6300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55041.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
        6⤵
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62917.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28970.exe
        6⤵
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50040.exe
        6⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47565.exe
        6⤵
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58033.exe
        6⤵
        
        PID:6444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3364.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50528.exe
        6⤵
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56828.exe
        6⤵
        
        PID:4864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59695.exe
        6⤵
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63988.exe
        6⤵
        
        PID:6084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3239.exe
        5⤵
        
        PID:2988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54800.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37723.exe
        5⤵
        
        PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49608.exe
        5⤵
        
        PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57425.exe
        5⤵
        
        PID:5084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34322.exe
        5⤵
        
        PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20070.exe
        5⤵
        
        PID:6268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61148.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46966.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46302.exe
        6⤵
        
        PID:1652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28645.exe
        6⤵
        
        PID:744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33699.exe
        6⤵
        
        PID:3988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16817.exe
        6⤵
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14772.exe
        6⤵
        
        PID:2124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26862.exe
        6⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46936.exe
        6⤵
        
        PID:5868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1164.exe
        5⤵
        
        PID:2444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46226.exe
        5⤵
        
        PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35782.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15085.exe
        5⤵
        
        PID:3516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27536.exe
        5⤵
        
        PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23533.exe
        5⤵
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55396.exe
        5⤵
        
        PID:7000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25350.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21222.exe
        5⤵
        
        PID:2592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61764.exe
        5⤵
        
        PID:1984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60861.exe
        5⤵
        
        PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23751.exe
        5⤵
        
        PID:3520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44072.exe
        5⤵
        
        PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22612.exe
        5⤵
        
        PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48005.exe
        5⤵
        
        PID:5152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50936.exe
      4⤵
      PID:1792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18153.exe
      4⤵
      PID:2596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40435.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54536.exe
      4⤵
      PID:3548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53714.exe
      4⤵
      PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
      4⤵
      PID:5468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21665.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43638.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43638.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64101.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46774.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63546.exe
        6⤵
        
        PID:1632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4919.exe
        6⤵
        
        PID:2360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19070.exe
        6⤵
        
        PID:4036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38068.exe
        6⤵
        
        PID:3440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48516.exe
        6⤵
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50365.exe
        6⤵
        
        PID:4832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13497.exe
        6⤵
        
        PID:5596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25405.exe
        6⤵
        
        PID:6308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25699.exe
        5⤵
        
        PID:2720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50247.exe
        6⤵
        
        PID:6092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16552.exe
        6⤵
        
        PID:5784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18654.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24936.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29402.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31980.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39745.exe
        5⤵
        
        PID:5016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40975.exe
        5⤵
        
        PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20070.exe
        5⤵
        
        PID:6200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27100.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65295.exe
        5⤵
        
        PID:3040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62532.exe
        5⤵
        
        PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59911.exe
        5⤵
        
        PID:3380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62157.exe
        5⤵
        
        PID:3608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13643.exe
        5⤵
        
        PID:4208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62887.exe
        5⤵
        
        PID:5884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34297.exe
        5⤵
        
        PID:5952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59167.exe
        5⤵
        
        PID:6468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33700.exe
      4⤵
      PID:2396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47156.exe
      4⤵
      PID:3016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16078.exe
      4⤵
      PID:3344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36956.exe
      4⤵
      PID:4008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11158.exe
      4⤵
      PID:4348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64125.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18012.exe
      4⤵
      PID:6140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11245.exe
      4⤵
      PID:6768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8770.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8770.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23230.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55560.exe
        5⤵
        
        PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45251.exe
        5⤵
        
        PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56477.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27168.exe
        5⤵
        
        PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4867.exe
        5⤵
        
        PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11631.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30297.exe
        5⤵
        
        PID:6612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55041.exe
      4⤵
      PID:816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
      4⤵
      PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62917.exe
      4⤵
      PID:2772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65521.exe
      4⤵
      PID:4160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63774.exe
      4⤵
      PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28396.exe
      4⤵
      PID:300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53832.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13836.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13836.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12438.exe
      4⤵
      PID:4320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11943.exe
      4⤵
      PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15767.exe
      4⤵
      PID:5380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55071.exe
      4⤵
      PID:5816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-439.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-439.exe
    3⤵
    PID:1860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29599.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29599.exe
    3⤵
    PID:3088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54782.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54782.exe
    3⤵
    PID:3400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52688.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52688.exe
    3⤵
    PID:4228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53973.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53973.exe
    3⤵
    PID:4136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21262.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21262.exe
    3⤵
    PID:5640
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9164.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9164.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11999.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11999.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31621.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46966.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9369.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35199.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43247.exe
        6⤵
        
        PID:3664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23689.exe
        6⤵
        
        PID:3864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40359.exe
        6⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11852.exe
        6⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25405.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55041.exe
        5⤵
        
        PID:836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
        5⤵
        
        PID:3212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34581.exe
        5⤵
        
        PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7154.exe
        5⤵
        
        PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41296.exe
        5⤵
        
        PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47565.exe
        5⤵
        
        PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58033.exe
        5⤵
        
        PID:6452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60240.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9369.exe
        5⤵
        
        PID:688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45251.exe
        5⤵
        
        PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56477.exe
        5⤵
        
        PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27168.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18214.exe
        5⤵
        
        PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35640.exe
        5⤵
        
        PID:5500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24270.exe
        5⤵
        
        PID:6128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3239.exe
      4⤵
      PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54800.exe
      4⤵
      PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54252.exe
      4⤵
      PID:2804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57154.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57154.exe
      4⤵
      PID:4236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15302.exe
      4⤵
      PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22397.exe
      4⤵
      PID:5676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20070.exe
      4⤵
      PID:6260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28091.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28091.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5497.exe
      4⤵
      PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18654.exe
      4⤵
      PID:2004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24936.exe
      4⤵
      PID:4012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29402.exe
      4⤵
      PID:3336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31980.exe
      4⤵
      PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39745.exe
      4⤵
      PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48266.exe
      4⤵
      PID:5404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20070.exe
      4⤵
      PID:6244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-78.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-78.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59561.exe
      4⤵
      PID:2916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36875.exe
      4⤵
      PID:2884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48562.exe
      4⤵
      PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64015.exe
      4⤵
      PID:3588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58379.exe
      4⤵
      PID:4560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39325.exe
      4⤵
      PID:5164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25405.exe
      4⤵
      PID:6316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55295.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55295.exe
    3⤵
    PID:2692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46135.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46135.exe
    3⤵
    PID:3112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37716.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37716.exe
    3⤵
    PID:3424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8682.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8682.exe
    3⤵
    PID:4212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59308.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59308.exe
    3⤵
    PID:5048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17062.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17062.exe
    3⤵
    PID:5704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40110.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40110.exe
    3⤵
    PID:6968
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44407.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44407.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14241.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14241.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26847.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25472.exe
        5⤵
        
        PID:2456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9369.exe
        6⤵
        
        PID:668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35199.exe
        6⤵
        
        PID:3300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43247.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23689.exe
        6⤵
        
        PID:4108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6034.exe
        6⤵
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52900.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53832.exe
        6⤵
        
        PID:6512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55041.exe
        5⤵
        
        PID:572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21692.exe
        5⤵
        
        PID:3632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-607.exe
        5⤵
        
        PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63795.exe
        5⤵
        
        PID:4664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55853.exe
        5⤵
        
        PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25405.exe
        5⤵
        
        PID:6348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13089.exe
      4⤵
      PID:2996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41604.exe
        5⤵
        
        PID:1484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49622.exe
        5⤵
        
        PID:3976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2784.exe
        5⤵
        
        PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23438.exe
        5⤵
        
        PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43398.exe
        5⤵
        
        PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29870.exe
        5⤵
        
        PID:5232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18654.exe
      4⤵
      PID:580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24936.exe
      4⤵
      PID:4028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29402.exe
      4⤵
      PID:3320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31980.exe
      4⤵
      PID:4752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59070.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34260.exe
      4⤵
      PID:5212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53832.exe
      4⤵
      PID:6588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22357.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22357.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53237.exe
      4⤵
      PID:4076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62168.exe
      4⤵
      PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4163.exe
      4⤵
      PID:4660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21632.exe
      4⤵
      PID:5556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45446.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3239.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3239.exe
    3⤵
    PID:1248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54800.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54800.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54252.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54252.exe
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48985.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48985.exe
    3⤵
    PID:4152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15302.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15302.exe
    3⤵
    PID:4960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64094.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64094.exe
    3⤵
    PID:2316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58033.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58033.exe
    3⤵
    PID:6396
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48155.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48155.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50391.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50391.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-967.exe
      4⤵
      PID:1432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22021.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63251.exe
        6⤵
        
        PID:5300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62966.exe
        6⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17431.exe
        6⤵
        
        PID:6544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4919.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30258.exe
        5⤵
        
        PID:3780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40416.exe
        5⤵
        
        PID:3760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25578.exe
        5⤵
        
        PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2700.exe
        5⤵
        
        PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55983.exe
        5⤵
        
        PID:5252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59167.exe
        5⤵
        
        PID:6504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22082.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18654.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53738.exe
      4⤵
      PID:3612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7486.exe
      4⤵
      PID:3468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3569.exe
      4⤵
      PID:4624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18147.exe
      4⤵
      PID:5448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19110.exe
      4⤵
      PID:6232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14158.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14158.exe
    3⤵
    PID:2304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-431.exe
      4⤵
      PID:3600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60120.exe
      4⤵
      PID:3904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10807.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23.exe
      4⤵
      PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55323.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50055.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16595.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16595.exe
    3⤵
    PID:2268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57111.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57111.exe
    3⤵
    PID:3324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36956.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36956.exe
    3⤵
    PID:3512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11158.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11158.exe
    3⤵
    PID:4332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16659.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16659.exe
    3⤵
    PID:5144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62750.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62750.exe
    3⤵
    PID:7040
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16949.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16949.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38333.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38333.exe
    3⤵
    PID:924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37580.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37580.exe
    3⤵
    PID:4804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
    3⤵
    PID:4708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63926.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63926.exe
    3⤵
    PID:5196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14631.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14631.exe
    3⤵
    PID:6620
- C:\Users\Admin\AppData\Local\Temp\Unicorn-969.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-969.exe
  2⤵
  PID:1812
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25134.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25134.exe
  2⤵
  PID:3128
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27916.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27916.exe
  2⤵
  PID:3364
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43385.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43385.exe
  2⤵
  PID:4144
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14101.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14101.exe
  2⤵
  PID:4132
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40863.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40863.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5660
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59271.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59271.exe
  2⤵
  PID:5224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11999.exe

Filesize
468KB

MD5
617a723ef49c9a654c07637a0bb7d3f3

SHA1
30a503e3327512457cb2e6afdb690324cbdc5f18

SHA256
8a950b6ccb9fa8eea6dfe25f8ac8b88dd130051c76440b2ba97a44b08b573d3b

SHA512
91e789eb4c954ea4b9bb340399ab01f770619c322887d3089d53d9f86d62ca4cdfccc721a8bd8f3cbf5670167c02e56304bc251e991c0a62c949bb1f8dd50abc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28336.exe

Filesize
468KB

MD5
a39b8f85305c13a548dae03131246e57

SHA1
f0ffdf690687ee4ac78ee06c1e068a7f80ccf5c2

SHA256
334f63ef91344baa58963178f7fd848281aae2ab55fda212fb9c131be8dc69f1

SHA512
024f8bb691b6ab5ff0a57b2966bd97834c187647a15068532c5c3dd5b69b24eb6d502a01e7215396bf74865630b5d88050e8c3bdff5930c129ac86fbafdf6b79

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4163.exe

Filesize
468KB

MD5
f800c2c706fcb180534ee9833b6b8490

SHA1
e3c789409eff13b366c193c5884fac8212125031

SHA256
3769252c93d1e17e504c6606e54a7d0ed9799e8f2893c7769a6c219f593cffee

SHA512
96e7172707108638f4babf320e72dce5a9402123097ab26fa782e246e359cc994f8955c1efa9b60c11ac7d305dae938f767ed872381b56f99ea35324cf1ce3e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45565.exe

Filesize
468KB

MD5
905ec26d8277db882ecb2ea20a083822

SHA1
88753168808f26f6f29989a1b9bab42ec693243c

SHA256
fbfc9519b9d7a5fae935cfaf77f75fc57ee02b80e8568c7b24a151504dc906b5

SHA512
c75603c74ba3a1b2465f82d90129d1b51c0cd90cd0b846e77c53918141839ed54e9775b19fbd6932cd4d552a3f94d04f90a643dc29afd388fca547964f557a96

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5888.exe

Filesize
468KB

MD5
9a7ea2cd707dfba26238963caf16f202

SHA1
9875c473c65b55e9fd4b87fbad82bf1595e8346c

SHA256
bf2a8398795b983af4031c8787c0126d78fccb83c89a2326406e14dd28816128

SHA512
c044a2fa72ae879286b59ddc37dcbbf6aa1ec4cbf08a93044d85373a403638113c4f304dad37ffd3018032bda20036d27952aced56a4d90c2b52df918a70ed51

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9653.exe

Filesize
468KB

MD5
a3a6b4acd6dcc854169c1ea8de9a2c14

SHA1
fcf789f6239d2af76f9b349ea7ccfe04ac939f4a

SHA256
b85a5e74c57f0fb9d44ae57d1d8a92a2737b3663a14ae21a9b16d38c60cb4163

SHA512
a046d60ce58229fb29666b105dbc09a927df96c4f913602aab6f2d5149b99b16180dec0dd88ac7bd4720d058b27ec18abf05ed6f5fc165477e5fb19d37f68d63

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15294.exe

Filesize
468KB

MD5
9653343fc267ab5855b5fecfb7488814

SHA1
5e1d3e5703017efeff388586db3afa7fbe449a06

SHA256
e56549207eb96f044a2bff761f5267828dfad0210a57b64deef687fa4c2c9ebf

SHA512
4173ae1a4f8391c5afada2bba830bef779f63a3fb50af3008aff6a7fbe9858d595994d4bc3733506bfb05ec1908e21133d56645da1197adaceac2f9860215f66

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25958.exe

Filesize
468KB

MD5
ecd91ee658d3d596ef278ec1f1cccec7

SHA1
cf41ec3bdfd7a7ecd67d81813db4c3342d09156f

SHA256
41f19ab21a6ccf69737cbf28972c4fb7b800f058ec9ad11e255955132bc4e299

SHA512
e218442e3ff215e858d56be300b09c032003d0f9a33d1c73de0665719a44da408057856e78b813c2fb56def9f4d4dfabc8be04c45c66fa1a06310b30e49dd152

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31538.exe

Filesize
468KB

MD5
e6feb4f3bfe15a4f5693cfd69923ae48

SHA1
8e4c9fbae140102a21f9053f1360af53469335f4

SHA256
db38774f9c75c4d92b421caf43dbf88bbe44243d13f049e3192f8d102ff490e3

SHA512
78ee823788839063038bac94c7f8220a4946946e11711d134061a939460cf877528cafaacdcb380a8bff1778cf58e288300d1692c7fbb0b60cdbcd75328f0ec1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32312.exe

Filesize
468KB

MD5
af513ecbae972823a9aafbfdf0199a88

SHA1
89ccf9fe8c5c82fecde5cb240f0dda1210843195

SHA256
b50941aea4b7bf8209b4f7cb034edd7d173eceffac18e5c959cbc5e0052acf7b

SHA512
323301883679d453448ddd6f5468313e7be02237d3c557caaee0552da1363b3db6a52d37a06ee62b342090c9e408957536de1bf164f50af11ee6e05b129d7f93

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40313.exe

Filesize
468KB

MD5
5bca638296013b616022fbb6ef215a77

SHA1
3670bcddf558793aad8588ec629563a4c5fb5685

SHA256
e02630ec587d1bf73c92a60310e76d36c829fc288ee4c2034ccf90c9a1239b35

SHA512
8d3881a518702d51901efb1251c7a123a471509c8ed11a87a7781cba7e7a485427b91866af2fb013b51a727c5783f15e0810e1ce8966370fea5c1a3ea9a7842a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4080.exe

Filesize
468KB

MD5
aba34b6d6e294b22c355541517fcd954

SHA1
6973f0cc9adf536986d6ac77f8b4a36e4a8ed124

SHA256
4cbc36ad8dcb20da78f59097ab79ea9a706088d3770fa6e210bc82206736e404

SHA512
8bd189359c8b6f80dae214996405ee550eea72ab3fefdd1b8d35ef0b8923ab5df595e6d455a4ab85ac7513edee78f9a668a1078c29c05ed88e282a159eae3ff7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43638.exe

Filesize
468KB

MD5
e57082d7ba1eaf8d8a006c7f6e346a0d

SHA1
dff687cf1a4aa24b0b7412204d9cd080a6e3a62a

SHA256
96cd55560732ac1c4de64e06c05b1c942f94216d1e476730f12431607841c963

SHA512
a9c86bba8f7b87381c34ef8e31b16a3583e18c3ebcca3e31dc25269e4520f9ff5fff204e6ac05b9be208d155d72580b1446046f251aa7e69d49f8ea73bc88123

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-44407.exe

Filesize
468KB

MD5
314793609170b9884978d8b01cc1bc44

SHA1
18b32d6bc6cfcb57a0af115e58c695be20784cd6

SHA256
87fd63025b1c83d5d3e09d06945614613394894538e8c9cae778df4edc982f74

SHA512
d3b6198f53ff4a5094fed2c482c9e71f9b9940ff41861eb1aa1552d2a11f2cdcbd665e628efba6a8762796fe6676a29f9a87b5cb68c98d8631266a4ec9c1abbe

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-44672.exe

Filesize
468KB

MD5
14a02266ff5610c45aa51376a7fe4be5

SHA1
dcb7bd9bb82549cddb6d251584204bf94a352fe5

SHA256
9d72ba88e357f30c25ae81b9cf393295d82a9705f949494276ee4fb653c399c1

SHA512
79573a89f08b49118808af6b14f207acb71d6300ef2c2129d7627b75e5f01529f481a0eb6d4648eb316d5014093cb36f4acaced4fd918fa500eb6cf6b6c1410c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46239.exe

Filesize
468KB

MD5
24194b3a2b42f4b0548dc5bb181932eb

SHA1
39768f06336a4f122565ee4cca1a9b59204c0506

SHA256
96aa6cd330c19f517c41ac635b3596d4069090918aa47160d169e4d506a363f6

SHA512
985dd34ee00b32b094556836fb3e1ae08eb72498627b5bd2811123a68d82161543aa4cb0941cf577609e31a115cead368529c957f50daba3b0936f2fc24e7033

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52370.exe

Filesize
468KB

MD5
6276fbb77627bb12aa7bce4bb5e80d16

SHA1
bf6b73162d873b4d1985ceb2dcd073f2c8c9796c

SHA256
4d57b90ebe0b69102af88f9d5bd37590d02c46e075e210b1165468ce81252c20

SHA512
3cc703a5cd082070c22ae366b3dfdf5979b10bc6ca4eb6f3dcaa5d40b57f1a8cee1feb675ea16cf6799abfd12e7d7b433d420b4470ab0b1626d67d816a10ac25

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56426.exe

Filesize
468KB

MD5
7319b2db63409dcc8c0848df74e92420

SHA1
47567695f76361a07e929c206c0fc065b1e3cab5

SHA256
bfb3389193c4c8abbb019c79f656271dbe01c7b9aca1b1e8f0fcb65f1ce6eb28

SHA512
0d7b7f02cfcbb0a06374b34b04863562051a83a1f028d20ad2fe31c6f20c03252f1ca47016db18f80f977b81cd65c24342cf8547a2f01ac6c9edebfae315fc5a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57374.exe

Filesize
468KB

MD5
de7bbb232df9d027a6c54304e1beea33

SHA1
fafe9e178925c5bd9fc0b8d7cdfaee42a5065a32

SHA256
08c8632b05743ee6b2d99518b697e5daa4bc9c44db5ec5f39f1683034c2bd4b0

SHA512
68f2f7169b8a0945b6bc3f7b5199c78efacf9d46ac88af82e9f00da0529a2ba022b95c4a525f4fb96d8c3f2b0554a6c0521865f1ed66609f3c3e014dc720d7d0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8303.exe

Filesize
468KB

MD5
fb9804a54ff820ae7eaa83d52f72689d

SHA1
9eae6ce07210ff487e9a4b15db786bfefd4b0c79

SHA256
62178fef751ae8c297f95c29acf242a38c544560f294145d24d61bed38e1f204

SHA512
a6f72ad89395effa901d1d17682f534fdbb0f9704419116bd3af8d9168e60288c5ab7760810f869302ebc44885d33e98f8c892146b461e01133926111fa3e715

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9164.exe

Filesize
468KB

MD5
e0138723cce59b0b101e6c2a9e774767

SHA1
57ba0a0935fa959dfddf1b75b2fff7b760637031

SHA256
a8d8c59d8850e4a997a0236bfd6d1ba64f1f1de11d08b1589b2255086a0bb8ab

SHA512
7867f9c15ec76ff2c63dda3fa4bca99f5b09e8219eba9117426e7c19a05524d16005c2d2a5d0e5fbcedb9ffc89e20e1982e2f3f41ab4302bc6513cca4f5f946e

Download Submit