8714fc24e97da69ba7d23217e042e169b95b3455dae5da20fdc5a3fc825dae76

Analysis

max time kernel
120s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 03:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c2074445fecfe7431929399c4ff2790N.exe
Size

468KB
MD5

8c2074445fecfe7431929399c4ff2790
SHA1

5fba41d4f5a973c0507565eb18390d4bae29cd9f
SHA256

8714fc24e97da69ba7d23217e042e169b95b3455dae5da20fdc5a3fc825dae76
SHA512

79a5dc591ab842fbd8c7f8b3ecc85c208509810fd986352de43d2c2223172036045f4d785f1d19c3e6673dfa321aacf00c59874f84604e730b84c18cdbd63066
SSDEEP

3072:iErCogIdI35YbbYUPzcTff8/gCY/POphJEHhxVIWhDSLcOpVHFl4:iE+owJYbDP4Tff5egfhD0TpVH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2044	Unicorn-44617.exe
1128	Unicorn-59412.exe
2956	Unicorn-23210.exe
2596	Unicorn-13449.exe
2164	Unicorn-34424.exe
2888	Unicorn-59443.exe
2736	Unicorn-36785.exe
1460	Unicorn-16857.exe
1560	Unicorn-37831.exe
2364	Unicorn-59809.exe
1820	Unicorn-56088.exe
1600	Unicorn-2248.exe
2776	Unicorn-35689.exe
1872	Unicorn-29558.exe
2900	Unicorn-10535.exe
1252	Unicorn-26556.exe
2436	Unicorn-6498.exe
2176	Unicorn-26364.exe
2192	Unicorn-52330.exe
2392	Unicorn-25596.exe
2484	Unicorn-42508.exe
1880	Unicorn-22642.exe
1712	Unicorn-42316.exe
372	Unicorn-42316.exe
1588	Unicorn-42316.exe
648	Unicorn-22450.exe
624	Unicorn-46466.exe
1732	Unicorn-8226.exe
2488	Unicorn-33053.exe
2688	Unicorn-32788.exe
968	Unicorn-40459.exe
1764	Unicorn-16546.exe
1048	Unicorn-54625.exe
2656	Unicorn-33458.exe
2012	Unicorn-42704.exe
1540	Unicorn-48834.exe
2664	Unicorn-28776.exe
2420	Unicorn-4594.exe
2820	Unicorn-7920.exe
2068	Unicorn-5170.exe
3048	Unicorn-11729.exe
2720	Unicorn-6898.exe
2732	Unicorn-31979.exe
2836	Unicorn-42185.exe
2040	Unicorn-55258.exe
2816	Unicorn-63499.exe
888	Unicorn-2601.exe
2172	Unicorn-14298.exe
3064	Unicorn-64952.exe
2704	Unicorn-58822.exe
1664	Unicorn-64952.exe
1904	Unicorn-42176.exe
2636	Unicorn-33245.exe
3016	Unicorn-22310.exe
3068	Unicorn-34584.exe
2972	Unicorn-14718.exe
1920	Unicorn-59088.exe
972	Unicorn-50728.exe
2100	Unicorn-42560.exe
2092	Unicorn-2797.exe
2188	Unicorn-30286.exe
1908	Unicorn-24686.exe
2548	Unicorn-62959.exe
1492	Unicorn-4480.exe

Loads dropped DLL 64 IoCs

pid	Process
1892	8c2074445fecfe7431929399c4ff2790N.exe
1892	8c2074445fecfe7431929399c4ff2790N.exe
2044	Unicorn-44617.exe
2044	Unicorn-44617.exe
1892	8c2074445fecfe7431929399c4ff2790N.exe
1892	8c2074445fecfe7431929399c4ff2790N.exe
1128	Unicorn-59412.exe
1128	Unicorn-59412.exe
2044	Unicorn-44617.exe
2044	Unicorn-44617.exe
2956	Unicorn-23210.exe
2956	Unicorn-23210.exe
1892	8c2074445fecfe7431929399c4ff2790N.exe
1892	8c2074445fecfe7431929399c4ff2790N.exe
2596	Unicorn-13449.exe
2596	Unicorn-13449.exe
1128	Unicorn-59412.exe
1128	Unicorn-59412.exe
2888	Unicorn-59443.exe
2888	Unicorn-59443.exe
2956	Unicorn-23210.exe
2956	Unicorn-23210.exe
2164	Unicorn-34424.exe
2164	Unicorn-34424.exe
2736	Unicorn-36785.exe
2736	Unicorn-36785.exe
2044	Unicorn-44617.exe
2044	Unicorn-44617.exe
1892	8c2074445fecfe7431929399c4ff2790N.exe
1892	8c2074445fecfe7431929399c4ff2790N.exe
1460	Unicorn-16857.exe
1460	Unicorn-16857.exe
2596	Unicorn-13449.exe
2596	Unicorn-13449.exe
1560	Unicorn-37831.exe
1560	Unicorn-37831.exe
1128	Unicorn-59412.exe
1128	Unicorn-59412.exe
2776	Unicorn-35689.exe
2776	Unicorn-35689.exe
2364	Unicorn-59809.exe
2364	Unicorn-59809.exe
2736	Unicorn-36785.exe
2736	Unicorn-36785.exe
1872	Unicorn-29558.exe
1820	Unicorn-56088.exe
1600	Unicorn-2248.exe
2888	Unicorn-59443.exe
1820	Unicorn-56088.exe
1872	Unicorn-29558.exe
1600	Unicorn-2248.exe
2888	Unicorn-59443.exe
2956	Unicorn-23210.exe
2956	Unicorn-23210.exe
2164	Unicorn-34424.exe
2164	Unicorn-34424.exe
2900	Unicorn-10535.exe
2900	Unicorn-10535.exe
2044	Unicorn-44617.exe
2044	Unicorn-44617.exe
1892	8c2074445fecfe7431929399c4ff2790N.exe
1892	8c2074445fecfe7431929399c4ff2790N.exe
1252	Unicorn-26556.exe
1252	Unicorn-26556.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2652	2548	WerFault.exe	92

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43840.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55226.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49990.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48188.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34815.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59313.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23210.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46466.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15419.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60032.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2911.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48848.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50191.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43701.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55086.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48188.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22045.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16546.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11710.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33458.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42560.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57246.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10641.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7262.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33774.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8117.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-718.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48188.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25989.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42632.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44469.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33652.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27124.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44827.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7245.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50191.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50728.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62927.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3424.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10311.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53062.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-817.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3829.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16857.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10975.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64724.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56088.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48848.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3424.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1951.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28842.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64952.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43840.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8294.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1892	8c2074445fecfe7431929399c4ff2790N.exe
2044	Unicorn-44617.exe
1128	Unicorn-59412.exe
2956	Unicorn-23210.exe
2596	Unicorn-13449.exe
2888	Unicorn-59443.exe
2164	Unicorn-34424.exe
2736	Unicorn-36785.exe
1460	Unicorn-16857.exe
1560	Unicorn-37831.exe
2364	Unicorn-59809.exe
1872	Unicorn-29558.exe
1600	Unicorn-2248.exe
2776	Unicorn-35689.exe
1820	Unicorn-56088.exe
2900	Unicorn-10535.exe
1252	Unicorn-26556.exe
2436	Unicorn-6498.exe
2176	Unicorn-26364.exe
2192	Unicorn-52330.exe
2392	Unicorn-25596.exe
2484	Unicorn-42508.exe
1880	Unicorn-22642.exe
648	Unicorn-22450.exe
1588	Unicorn-42316.exe
1712	Unicorn-42316.exe
372	Unicorn-42316.exe
624	Unicorn-46466.exe
1732	Unicorn-8226.exe
2488	Unicorn-33053.exe
2688	Unicorn-32788.exe
968	Unicorn-40459.exe
1764	Unicorn-16546.exe
1048	Unicorn-54625.exe
2656	Unicorn-33458.exe
2012	Unicorn-42704.exe
1540	Unicorn-48834.exe
2664	Unicorn-28776.exe
2420	Unicorn-4594.exe
2820	Unicorn-7920.exe
2068	Unicorn-5170.exe
3048	Unicorn-11729.exe
2720	Unicorn-6898.exe
2732	Unicorn-31979.exe
2836	Unicorn-42185.exe
2040	Unicorn-55258.exe
2816	Unicorn-63499.exe
2172	Unicorn-14298.exe
888	Unicorn-2601.exe
2704	Unicorn-58822.exe
1664	Unicorn-64952.exe
3064	Unicorn-64952.exe
2636	Unicorn-33245.exe
1904	Unicorn-42176.exe
3016	Unicorn-22310.exe
2972	Unicorn-14718.exe
3068	Unicorn-34584.exe
1920	Unicorn-59088.exe
972	Unicorn-50728.exe
2100	Unicorn-42560.exe
2092	Unicorn-2797.exe
2188	Unicorn-30286.exe
1908	Unicorn-24686.exe
2548	Unicorn-62959.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 2044	1892	8c2074445fecfe7431929399c4ff2790N.exe	30
PID 1892 wrote to memory of 2044	1892	8c2074445fecfe7431929399c4ff2790N.exe	30
PID 1892 wrote to memory of 2044	1892	8c2074445fecfe7431929399c4ff2790N.exe	30
PID 1892 wrote to memory of 2044	1892	8c2074445fecfe7431929399c4ff2790N.exe	30
PID 2044 wrote to memory of 1128	2044	Unicorn-44617.exe	31
PID 2044 wrote to memory of 1128	2044	Unicorn-44617.exe	31
PID 2044 wrote to memory of 1128	2044	Unicorn-44617.exe	31
PID 2044 wrote to memory of 1128	2044	Unicorn-44617.exe	31
PID 1892 wrote to memory of 2956	1892	8c2074445fecfe7431929399c4ff2790N.exe	32
PID 1892 wrote to memory of 2956	1892	8c2074445fecfe7431929399c4ff2790N.exe	32
PID 1892 wrote to memory of 2956	1892	8c2074445fecfe7431929399c4ff2790N.exe	32
PID 1892 wrote to memory of 2956	1892	8c2074445fecfe7431929399c4ff2790N.exe	32
PID 1128 wrote to memory of 2596	1128	Unicorn-59412.exe	33
PID 1128 wrote to memory of 2596	1128	Unicorn-59412.exe	33
PID 1128 wrote to memory of 2596	1128	Unicorn-59412.exe	33
PID 1128 wrote to memory of 2596	1128	Unicorn-59412.exe	33
PID 2044 wrote to memory of 2164	2044	Unicorn-44617.exe	34
PID 2044 wrote to memory of 2164	2044	Unicorn-44617.exe	34
PID 2044 wrote to memory of 2164	2044	Unicorn-44617.exe	34
PID 2044 wrote to memory of 2164	2044	Unicorn-44617.exe	34
PID 2956 wrote to memory of 2888	2956	Unicorn-23210.exe	35
PID 2956 wrote to memory of 2888	2956	Unicorn-23210.exe	35
PID 2956 wrote to memory of 2888	2956	Unicorn-23210.exe	35
PID 2956 wrote to memory of 2888	2956	Unicorn-23210.exe	35
PID 1892 wrote to memory of 2736	1892	8c2074445fecfe7431929399c4ff2790N.exe	36
PID 1892 wrote to memory of 2736	1892	8c2074445fecfe7431929399c4ff2790N.exe	36
PID 1892 wrote to memory of 2736	1892	8c2074445fecfe7431929399c4ff2790N.exe	36
PID 1892 wrote to memory of 2736	1892	8c2074445fecfe7431929399c4ff2790N.exe	36
PID 2596 wrote to memory of 1460	2596	Unicorn-13449.exe	37
PID 2596 wrote to memory of 1460	2596	Unicorn-13449.exe	37
PID 2596 wrote to memory of 1460	2596	Unicorn-13449.exe	37
PID 2596 wrote to memory of 1460	2596	Unicorn-13449.exe	37
PID 1128 wrote to memory of 1560	1128	Unicorn-59412.exe	38
PID 1128 wrote to memory of 1560	1128	Unicorn-59412.exe	38
PID 1128 wrote to memory of 1560	1128	Unicorn-59412.exe	38
PID 1128 wrote to memory of 1560	1128	Unicorn-59412.exe	38
PID 2888 wrote to memory of 2364	2888	Unicorn-59443.exe	39
PID 2888 wrote to memory of 2364	2888	Unicorn-59443.exe	39
PID 2888 wrote to memory of 2364	2888	Unicorn-59443.exe	39
PID 2888 wrote to memory of 2364	2888	Unicorn-59443.exe	39
PID 2956 wrote to memory of 1820	2956	Unicorn-23210.exe	40
PID 2956 wrote to memory of 1820	2956	Unicorn-23210.exe	40
PID 2956 wrote to memory of 1820	2956	Unicorn-23210.exe	40
PID 2956 wrote to memory of 1820	2956	Unicorn-23210.exe	40
PID 2164 wrote to memory of 1600	2164	Unicorn-34424.exe	41
PID 2164 wrote to memory of 1600	2164	Unicorn-34424.exe	41
PID 2164 wrote to memory of 1600	2164	Unicorn-34424.exe	41
PID 2164 wrote to memory of 1600	2164	Unicorn-34424.exe	41
PID 2736 wrote to memory of 2776	2736	Unicorn-36785.exe	42
PID 2736 wrote to memory of 2776	2736	Unicorn-36785.exe	42
PID 2736 wrote to memory of 2776	2736	Unicorn-36785.exe	42
PID 2736 wrote to memory of 2776	2736	Unicorn-36785.exe	42
PID 2044 wrote to memory of 1872	2044	Unicorn-44617.exe	43
PID 2044 wrote to memory of 1872	2044	Unicorn-44617.exe	43
PID 2044 wrote to memory of 1872	2044	Unicorn-44617.exe	43
PID 2044 wrote to memory of 1872	2044	Unicorn-44617.exe	43
PID 1892 wrote to memory of 2900	1892	8c2074445fecfe7431929399c4ff2790N.exe	44
PID 1892 wrote to memory of 2900	1892	8c2074445fecfe7431929399c4ff2790N.exe	44
PID 1892 wrote to memory of 2900	1892	8c2074445fecfe7431929399c4ff2790N.exe	44
PID 1892 wrote to memory of 2900	1892	8c2074445fecfe7431929399c4ff2790N.exe	44
PID 1460 wrote to memory of 1252	1460	Unicorn-16857.exe	45
PID 1460 wrote to memory of 1252	1460	Unicorn-16857.exe	45
PID 1460 wrote to memory of 1252	1460	Unicorn-16857.exe	45
PID 1460 wrote to memory of 1252	1460	Unicorn-16857.exe	45

C:\Users\Admin\AppData\Local\Temp\8c2074445fecfe7431929399c4ff2790N.exe
"C:\Users\Admin\AppData\Local\Temp\8c2074445fecfe7431929399c4ff2790N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44617.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44617.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59412.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59412.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13449.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16857.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26556.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16546.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4480.exe
        8⤵
        Executes dropped EXE
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17403.exe
        9⤵
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55226.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-817.exe
        9⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55344.exe
        9⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48317.exe
        9⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14947.exe
        8⤵
        
        PID:444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58556.exe
        8⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59497.exe
        8⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64902.exe
        8⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48655.exe
        8⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33431.exe
        7⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20101.exe
        8⤵
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43840.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39518.exe
        8⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14907.exe
        8⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25360.exe
        8⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13970.exe
        7⤵
        
        PID:1032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6263.exe
        7⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-624.exe
        7⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47018.exe
        7⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47209.exe
        7⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10596.exe
        7⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54625.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11496.exe
        7⤵
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63705.exe
        8⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55226.exe
        8⤵
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-817.exe
        8⤵
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50191.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32840.exe
        8⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28132.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48341.exe
        7⤵
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10641.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14391.exe
        7⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28842.exe
        7⤵
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62927.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20101.exe
        7⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43840.exe
        7⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39518.exe
        7⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-752.exe
        7⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31845.exe
        7⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6854.exe
        7⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61134.exe
        6⤵
        
        PID:936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2931.exe
        6⤵
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1014.exe
        6⤵
        
        PID:3376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45288.exe
        6⤵
        
        PID:4408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22045.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33955.exe
        6⤵
        
        PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6498.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33458.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60697.exe
        7⤵
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63705.exe
        8⤵
        
        PID:1004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55226.exe
        8⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-817.exe
        8⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50191.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23428.exe
        8⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13816.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22121.exe
        7⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41970.exe
        8⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7852.exe
        7⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18645.exe
        7⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31589.exe
        7⤵
        
        PID:5644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51304.exe
        6⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20101.exe
        7⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22266.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49990.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28245.exe
        7⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62863.exe
        7⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50373.exe
        7⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4262.exe
        6⤵
        
        PID:2996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19466.exe
        6⤵
        
        PID:3196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49485.exe
        6⤵
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1282.exe
        6⤵
        
        PID:4440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27380.exe
        6⤵
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23507.exe
        6⤵
        
        PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42704.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22711.exe
        6⤵
        
        PID:2892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46297.exe
        6⤵
        
        PID:3032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44597.exe
        6⤵
        
        PID:4044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30442.exe
        6⤵
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34815.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43947.exe
        6⤵
        
        PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30038.exe
        5⤵
        
        PID:572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39993.exe
        5⤵
        
        PID:1580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49625.exe
        5⤵
        
        PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64084.exe
        5⤵
        
        PID:4128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25678.exe
        5⤵
        
        PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21789.exe
        5⤵
        
        PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37831.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26364.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48834.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8237.exe
        7⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28132.exe
        7⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
        7⤵
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61295.exe
        7⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14391.exe
        7⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28842.exe
        7⤵
        
        PID:5884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2845.exe
        6⤵
        
        PID:3028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60032.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50462.exe
        6⤵
        
        PID:4012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64084.exe
        6⤵
        
        PID:340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25678.exe
        6⤵
        
        PID:4568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21789.exe
        6⤵
        
        PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28776.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55902.exe
        6⤵
        
        PID:2864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14344.exe
        6⤵
        
        PID:3672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55921.exe
        6⤵
        
        PID:3140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19009.exe
        6⤵
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56010.exe
        6⤵
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24115.exe
        5⤵
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5931.exe
        6⤵
        
        PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33417.exe
        5⤵
        
        PID:1656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41797.exe
        5⤵
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5241.exe
        5⤵
        
        PID:3500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2481.exe
        5⤵
        
        PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3829.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52330.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4594.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8403.exe
        6⤵
        
        PID:1512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57575.exe
        6⤵
        
        PID:2744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30852.exe
        6⤵
        
        PID:3296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10641.exe
        6⤵
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30920.exe
        6⤵
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28842.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2845.exe
        5⤵
        
        PID:2124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60032.exe
        5⤵
        
        PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20586.exe
        5⤵
        
        PID:3092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21776.exe
        5⤵
        
        PID:3392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50953.exe
        5⤵
        
        PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25360.exe
        5⤵
        
        PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7920.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-235.exe
        5⤵
        
        PID:600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-398.exe
        5⤵
        
        PID:2592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30852.exe
        5⤵
        
        PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28693.exe
        5⤵
        
        PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21789.exe
        5⤵
        
        PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29758.exe
      4⤵
      PID:2148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
        5⤵
        
        PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38374.exe
        5⤵
        
        PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50925.exe
        5⤵
        
        PID:5612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8216.exe
      4⤵
      PID:2908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53484.exe
      4⤵
      PID:3080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58528.exe
      4⤵
      PID:4000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41152.exe
      4⤵
      PID:4260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30179.exe
      4⤵
      PID:4268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34424.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34424.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42316.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50728.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44349.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55086.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3552.exe
        7⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57046.exe
        7⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6516.exe
        7⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31091.exe
        6⤵
        
        PID:2112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9289.exe
        6⤵
        
        PID:3564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57922.exe
        6⤵
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48911.exe
        6⤵
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28842.exe
        6⤵
        
        PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30286.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63705.exe
        6⤵
        
        PID:2060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55226.exe
        6⤵
        
        PID:3596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-817.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55344.exe
        6⤵
        
        PID:4664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31596.exe
        6⤵
        
        PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44827.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64421.exe
        5⤵
        
        PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50832.exe
        5⤵
        
        PID:760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59313.exe
        5⤵
        
        PID:4224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33528.exe
        5⤵
        
        PID:1592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8226.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14298.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57246.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19380.exe
        7⤵
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48848.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7852.exe
        7⤵
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18645.exe
        7⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6893.exe
        7⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13816.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44597.exe
        6⤵
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30442.exe
        6⤵
        
        PID:3452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10311.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8294.exe
        6⤵
        
        PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53909.exe
        5⤵
        
        PID:1896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63440.exe
        5⤵
        
        PID:108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-624.exe
        5⤵
        
        PID:3516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47018.exe
        5⤵
        
        PID:4176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47209.exe
        5⤵
        
        PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27124.exe
        5⤵
        
        PID:5532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58822.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58822.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4527.exe
        5⤵
        
        PID:2580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8531.exe
        5⤵
        
        PID:3220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21841.exe
        5⤵
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20958.exe
        5⤵
        
        PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13861.exe
        5⤵
        
        PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31387.exe
        5⤵
        
        PID:5756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43624.exe
      4⤵
      PID:1276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19466.exe
      4⤵
      PID:3204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31805.exe
      4⤵
      PID:3920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28776.exe
      4⤵
      PID:4640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58397.exe
      4⤵
      PID:4752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29558.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29558.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42316.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63499.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2612.exe
        6⤵
        
        PID:2284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43840.exe
        6⤵
        
        PID:280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3424.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6682.exe
        6⤵
        
        PID:4112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46679.exe
        6⤵
        
        PID:4696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33570.exe
        6⤵
        
        PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42528.exe
        5⤵
        
        PID:2856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28132.exe
        5⤵
        
        PID:3188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48341.exe
        5⤵
        
        PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2289.exe
        5⤵
        
        PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52832.exe
        5⤵
        
        PID:5940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2601.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20148.exe
        5⤵
        
        PID:1376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48848.exe
        5⤵
        
        PID:3812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63554.exe
        5⤵
        
        PID:4164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24990.exe
        5⤵
        
        PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48655.exe
        5⤵
        
        PID:5628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44469.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2911.exe
      4⤵
      PID:3748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48188.exe
      4⤵
      PID:3976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19175.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27124.exe
      4⤵
      PID:5548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32788.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32788.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64952.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13390.exe
        5⤵
        
        PID:2168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31854.exe
        6⤵
        
        PID:3116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
        6⤵
        
        PID:5052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41705.exe
        6⤵
        
        PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13816.exe
        5⤵
        
        PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44597.exe
        5⤵
        
        PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64724.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2110.exe
        5⤵
        
        PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48655.exe
        5⤵
        
        PID:5620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44454.exe
      4⤵
      PID:1120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43312.exe
      4⤵
      PID:916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61619.exe
      4⤵
      PID:3112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30328.exe
      4⤵
      PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59313.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25360.exe
      4⤵
      PID:5236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33245.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33245.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56363.exe
      4⤵
      PID:3096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47809.exe
      4⤵
      PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14274.exe
      4⤵
      PID:4300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24365.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24365.exe
    3⤵
    PID:1568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60313.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60313.exe
    3⤵
    PID:3860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51455.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51455.exe
    3⤵
    PID:1168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57680.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57680.exe
    3⤵
    PID:5032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54875.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54875.exe
    3⤵
    PID:4808
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23210.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23210.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59443.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59443.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59809.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42508.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64952.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60609.exe
        7⤵
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28105.exe
        7⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9719.exe
        7⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10616.exe
        7⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24829.exe
        7⤵
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61102.exe
        6⤵
        
        PID:1516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62583.exe
        6⤵
        
        PID:3804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15584.exe
        6⤵
        
        PID:384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1951.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8294.exe
        6⤵
        
        PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22310.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20532.exe
        6⤵
        
        PID:2460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48848.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9719.exe
        6⤵
        
        PID:3236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18976.exe
        6⤵
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24829.exe
        6⤵
        
        PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43701.exe
        5⤵
        
        PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2911.exe
        5⤵
        
        PID:3756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48188.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19175.exe
        5⤵
        
        PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27316.exe
        5⤵
        
        PID:5472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22450.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34584.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8117.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7710.exe
        6⤵
        
        PID:4944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59093.exe
        6⤵
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13437.exe
        5⤵
        
        PID:2940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62583.exe
        5⤵
        
        PID:3852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15584.exe
        5⤵
        
        PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10311.exe
        5⤵
        
        PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8294.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2797.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5537.exe
        5⤵
        
        PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49139.exe
        5⤵
        
        PID:4088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52561.exe
        5⤵
        
        PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39055.exe
        5⤵
        
        PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49843.exe
        5⤵
        
        PID:5716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50692.exe
      4⤵
      PID:1496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55756.exe
      4⤵
      PID:3896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33720.exe
      4⤵
      PID:3904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35346.exe
      4⤵
      PID:4988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11997.exe
      4⤵
      PID:5128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56088.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56088.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42316.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42176.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48848.exe
        6⤵
        
        PID:3836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9719.exe
        6⤵
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18976.exe
        6⤵
        
        PID:5072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42632.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29965.exe
        5⤵
        
        PID:2084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62583.exe
        5⤵
        
        PID:3828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15584.exe
        5⤵
        
        PID:844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34815.exe
        5⤵
        
        PID:4960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60476.exe
        5⤵
        
        PID:4712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14718.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24023.exe
        5⤵
        
        PID:1700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22266.exe
        5⤵
        
        PID:3268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9450.exe
        5⤵
        
        PID:3884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14907.exe
        5⤵
        
        PID:4864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25360.exe
        5⤵
        
        PID:5216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63934.exe
      4⤵
      PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38739.exe
      4⤵
      PID:3320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48341.exe
      4⤵
      PID:3868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11710.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24106.exe
      4⤵
      PID:4492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46466.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46466.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31979.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62394.exe
        5⤵
        
        PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10975.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39518.exe
        5⤵
        
        PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-752.exe
        5⤵
        
        PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5699.exe
        5⤵
        
        PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50199.exe
      4⤵
      PID:2328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23010.exe
      4⤵
      PID:3660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48188.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19175.exe
      4⤵
      PID:4928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27124.exe
      4⤵
      PID:5588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55258.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55258.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37127.exe
      4⤵
      PID:976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63705.exe
        5⤵
        
        PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33652.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35842.exe
        5⤵
        
        PID:4584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60668.exe
        5⤵
        
        PID:4516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28132.exe
      4⤵
      PID:3172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56497.exe
      4⤵
      PID:3348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25507.exe
      4⤵
      PID:4636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3829.exe
      4⤵
      PID:5292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13012.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13012.exe
    3⤵
    PID:576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23457.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23457.exe
    3⤵
    PID:1536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1154.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1154.exe
    3⤵
    PID:3684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42553.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42553.exe
    3⤵
    PID:2292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15190.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15190.exe
    3⤵
    PID:1500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25989.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25989.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5556
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36785.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36785.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35689.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35689.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25596.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5170.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54641.exe
        6⤵
        
        PID:860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43701.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2911.exe
        7⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48188.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19175.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27124.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9300.exe
        6⤵
        
        PID:1508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2911.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6919.exe
        6⤵
        
        PID:3212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16430.exe
        6⤵
        
        PID:4776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10596.exe
        6⤵
        
        PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44397.exe
        5⤵
        
        PID:1564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42400.exe
        6⤵
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55226.exe
        6⤵
        
        PID:3652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-817.exe
        6⤵
        
        PID:4076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50191.exe
        6⤵
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48125.exe
        6⤵
        
        PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27551.exe
        5⤵
        
        PID:2852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-624.exe
        5⤵
        
        PID:3524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47018.exe
        5⤵
        
        PID:4200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47209.exe
        5⤵
        
        PID:4656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27124.exe
        5⤵
        
        PID:5524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11729.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33879.exe
        5⤵
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34040.exe
        6⤵
        
        PID:3060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55226.exe
        6⤵
        
        PID:3584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-817.exe
        6⤵
        
        PID:4080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55344.exe
        6⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48125.exe
        6⤵
        
        PID:5604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43840.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3424.exe
        5⤵
        
        PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6682.exe
        5⤵
        
        PID:4120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41526.exe
        5⤵
        
        PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49906.exe
        5⤵
        
        PID:6008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9300.exe
      4⤵
      PID:2080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2911.exe
      4⤵
      PID:3764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64084.exe
      4⤵
      PID:4092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20525.exe
      4⤵
      PID:4348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21789.exe
      4⤵
      PID:5516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22642.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22642.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6898.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14485.exe
        5⤵
        
        PID:2916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13816.exe
        5⤵
        
        PID:2804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44597.exe
        5⤵
        
        PID:4056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30442.exe
        5⤵
        
        PID:3448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34815.exe
        5⤵
        
        PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60476.exe
        5⤵
        
        PID:2716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12876.exe
      4⤵
      PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20101.exe
        5⤵
        
        PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43840.exe
        5⤵
        
        PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39518.exe
        5⤵
        
        PID:3336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28245.exe
        5⤵
        
        PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30190.exe
        5⤵
        
        PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50373.exe
        5⤵
        
        PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13010.exe
      4⤵
      PID:2316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63440.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-624.exe
      4⤵
      PID:3532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47018.exe
      4⤵
      PID:4156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47209.exe
      4⤵
      PID:4624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6704.exe
      4⤵
      PID:6064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15419.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37033.exe
      4⤵
      PID:2832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3424.exe
      4⤵
      PID:3604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6682.exe
      4⤵
      PID:4136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46679.exe
      4⤵
      PID:4544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33570.exe
      4⤵
      PID:6092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19835.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19835.exe
    3⤵
    PID:2108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63135.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63135.exe
    3⤵
    PID:2788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31383.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31383.exe
    3⤵
    PID:3288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7245.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7245.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53062.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53062.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27707.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27707.exe
    3⤵
    PID:5812
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10535.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10535.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33053.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33053.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42560.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62394.exe
        5⤵
        
        PID:2724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59157.exe
        6⤵
        
        PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10975.exe
        5⤵
        
        PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3424.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6682.exe
        5⤵
        
        PID:4104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41526.exe
        5⤵
        
        PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31589.exe
        5⤵
        
        PID:5652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37759.exe
      4⤵
      PID:816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28132.exe
      4⤵
      PID:3156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15860.exe
      4⤵
      PID:3732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
      4⤵
      PID:4996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25360.exe
      4⤵
      PID:5300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62959.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62959.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2548
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 200
      4⤵
      Program crash
      PID:2652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-718.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-718.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-624.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-624.exe
    3⤵
    PID:3536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47018.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47018.exe
    3⤵
    PID:4148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42056.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42056.exe
    3⤵
    PID:4340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27124.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27124.exe
    3⤵
    PID:5564
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40459.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40459.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59088.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59088.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56323.exe
      4⤵
      PID:3000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33652.exe
      4⤵
      PID:3148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9417.exe
      4⤵
      PID:4496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48381.exe
      4⤵
      PID:5048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14485.exe
      4⤵
      PID:5896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39010.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39010.exe
    3⤵
    PID:2432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62583.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62583.exe
    3⤵
    PID:3820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64724.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64724.exe
    3⤵
    PID:3892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2110.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2110.exe
    3⤵
    PID:4940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48655.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48655.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5660
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24686.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24686.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2612.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2612.exe
    3⤵
    PID:2140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22266.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22266.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57006.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57006.exe
    3⤵
    PID:3716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27176.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27176.exe
    3⤵
    PID:4612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30190.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30190.exe
    3⤵
    PID:4328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20331.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20331.exe
    3⤵
    PID:5152
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53994.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53994.exe
  2⤵
  PID:2948
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33774.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33774.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2808
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39825.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39825.exe
  2⤵
  PID:3656
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41418.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41418.exe
  2⤵
  PID:4184
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62344.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62344.exe
  2⤵
  PID:4556
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29061.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29061.exe
  2⤵
  PID:5692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-16857.exe

Filesize
468KB

MD5
1f35cfeae4fc2172df7104c11b0a8c42

SHA1
30a5bb9aa1a8969ed74ffe18af2013f637c9d5cf

SHA256
34b3be74801322247e9ac48f239bae122cb20748ec77a875eec4008ac06839bf

SHA512
a7694b42b6d41760c4d90cb5e7a83fac11f28df13fd704de6eb30ed0b176597eb610110e313effb54f27b7490275f6860f4209134910be61292c364238278db9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20958.exe

Filesize
468KB

MD5
6bdcaf69ee3c14a370666b3852068a2a

SHA1
0c89f3ba7783b70e291cd1d469b4bf7e4d2940db

SHA256
7ca2485801b69ff23aee95247aee75a064191e5d96c5a207935e61359a210e47

SHA512
12f6b219fb64bd2767ac8aa7ff4910c4e3144bb43f82d4b18767afd05c8bbbb99500eb5d4285d343d5d547b46f801e3128676555f27056d1ee7bf2571e0617bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26364.exe

Filesize
468KB

MD5
1308b24212c62046f270f6b451c35dcd

SHA1
4603debf032b5571cbab35394dca1081d23d4304

SHA256
33c3597ebe4583b3b80e4881a9a8faa3a7cc1dec9a4be2728fc590bdca6a0a2a

SHA512
6e9ea3f92ab4b79b073e7dbc9c0751b508e26ad47b00701a0d76d879173f98169bb1f3e656d46d7b7b6477b090d175cb22d40857177c0dcec129ca22d72e8f1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26556.exe

Filesize
468KB

MD5
dc3a886f662eeb551c1774a9f9696f60

SHA1
1e7524a85527d10c7a847b94231a3a7a9eaebd3a

SHA256
117d2c53c145d942f1869f6e4fc38e372d1f8bd5b281d661c8f5a18a3f571cca

SHA512
58e518a126d8e22d42aa0812c0478c0804ed1d0f8d86569e07942bbeebf5effb3d283ab0c187ac002d954434347cbb8bf7833c0fce120d14609ce153128c470d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34424.exe

Filesize
468KB

MD5
f6f78f08175b1d8dc64450f1ffb70a78

SHA1
fd370d9a8affcdc4825e13538f4fc393334fc78b

SHA256
e56206127d55413470af58893df272413ef329906ea75d78891844baff03a636

SHA512
cb63387e8ccfa3038850e52a37456fcaa209d58083be2c8e171bd9ab947718a0605ccc1b64c97e9b3ac29963466981ca3e7074346c54b373fd3b1ea4c71d87e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35689.exe

Filesize
468KB

MD5
a58444ba2e1c057b5bfe340526a6a884

SHA1
29f5a78cfd52aeb5cf642fe68c74ff269c15584f

SHA256
1975695b4041c89a809631446ec713ba777f30449a685b616fb0161960d82e36

SHA512
9dd12709b7704aeaba783f505fd6f25be5c76a863197d7921abe089244e1511660753e2023531e62dedcd8026a06b2fb5e6f169ea80ec2a9648183b03cadfb74

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44617.exe

Filesize
468KB

MD5
847473e5ec52c18938f1617cc28f163a

SHA1
56a35e9d2620281572a504e7498386b84571234d

SHA256
d2e61a14add72ffe7a3605550ef922703b7e2f67a33dcebd5849f74f36b8d0fa

SHA512
5910eb770020104b84688bb4c977dc749279b85f2eef454605bb1aec37720bef5883e0da5b5cd8050e664373934118ad8d033323a59956dadc8f4c23a9090392

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5537.exe

Filesize
468KB

MD5
b6f5f7d8794579fb9499a9c94c617a20

SHA1
004fb9938fc8e55432d11e5b5805fa952e66167a

SHA256
1689a9c0b407dc8bf02d8420faaaf7c07d564d621e3d173a5ec5dd48ae58a64b

SHA512
5f069466607ffda654e85581bf65e73a4dac81698131f64677cc19f996f9e60b7d7510fa2f2e9ca4f41e4eae8ea224e5756671af9965a2963dabc3f5239d8952

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59443.exe

Filesize
468KB

MD5
c0950f9f66be09f20e07add775a3107c

SHA1
5cdba00349457496d7e4c683b6f286525180c755

SHA256
f7817d894232f171bcd3735ccd0b5400cf89c0a17703feee6cd86fbb657f9bd6

SHA512
503fdaf6b11e5b05b6c4d08e156a554d453a427809f9a798bf84ce83d1177afb13184e5818350344362021452613c957631ef945c6d2cb5f4dfc7a6a9409454c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59809.exe

Filesize
468KB

MD5
cda0c2938899470a8e1c471a71ad87ff

SHA1
e129a0d73079cda5be243be05fd54a11c8909147

SHA256
c8bb20caca4ff68aa051f766715443eb6b7c32c05cdae0d5f6408b94adbf7a32

SHA512
b324b72cb6bdfa67aba504d65dbfdd258172d6d08e84190d9d88357bca3df22b7299c70afda6e8abd5fdc24e90e6e55d5824a675db0c32215f68f8adbf51aa17

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-10535.exe

Filesize
468KB

MD5
0724f9f818f7ac2817bc02781247acc6

SHA1
404adb484701365cac6d5e6abd5a9b80b3da1dd6

SHA256
1927407e9d0bf714dd921ef5ec8ce560d4225c7ccd4111e1e50df0eb3e3101a1

SHA512
c5d2397d92c64092a3ae7bfbdc32d8e99e28dfca3a2025629da70e56c85877e78f60329647f9da9ac30d857803b2c2f1a5216f86cb925bf77a064f789f671a0d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13449.exe

Filesize
468KB

MD5
547d82f3a691226bdd7c780ea2f0fd84

SHA1
ed5b4453738923dcad1aef382bcf67c59f594d69

SHA256
b72b4ef547bfb5aff3a775aa07eb83781b419c788d035e912ebecd1c50150ea7

SHA512
7a8265f729c977703e40e4a8496e0e6dbea08cebe268c31ca77b8b682378c833156efbedc11239a06515978fc1c61a366c87d7e25f062ab928a257227f7ce2af

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe

Filesize
468KB

MD5
8ae12d78327ecf20520e0f9011427434

SHA1
c743a53800f28bee0a00b5bf7f8acfc0c0f98cb6

SHA256
8cddcacb488be207a8335cadcb9c5882d1bf35e519fa3ffc64b013176a247595

SHA512
cfb60a234eb7da54861700452dabe690a35479417583bef120c59d20f8527bee20bcccbf60deb31d19d43d4c5d467599fb5356495f70bc056bffd720ab0167f9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23210.exe

Filesize
468KB

MD5
6392b6be11a9cc7c0e70a3631190daf2

SHA1
9d6a21fafab58ef161972aea2e8ef59a8f6a721a

SHA256
56e624a5bb11b693e42415421ae9b78642d51666f2d590614bb70e2fe098fa2d

SHA512
d241f63564f841b0ae281dd8ba289bdbd8bdc48dd9fc1a900a77ce2a38128824eec5e270533859fd1896c25bd09ce8eddc3da525e3f3da1d6e83d14e25764ad5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29558.exe

Filesize
468KB

MD5
5c681987ccb67aa3efd8b4d4b44ee718

SHA1
2235b107d8a9f745503a93d8805f878d40338094

SHA256
56a21fa4efca36c9ece827a96559bd8c0b592f9dc18b10e6ab296f05471de19c

SHA512
e5d5fe03df4a27cb8d8716b1b7469effb31cc6cec809851e466a7286ef250e34fadd3080e757b287f5d3cc1a52c0192b943bec811e58d9078b392e79bb9da8cd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36785.exe

Filesize
468KB

MD5
ff1f909e97e592a12f44c9836fbc7132

SHA1
51c0d313437916d93680824eaeaa0826ce087326

SHA256
96e07f4071290e4556b4af7fa0a402ca106ea115164a00e92f95719ddaf43ac3

SHA512
3013da8cc2b715a106f30d280072cb896e77fdfd99f38f5c251839d530d3aeab3024152815bdaa811ed1652c4442751e6d8c96f45999baac8728e99b351f259a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37831.exe

Filesize
468KB

MD5
0ef09a3b576b1ae51ca2c5969afd756f

SHA1
2a44954b9afb7c97849e074ad80d24ea03940216

SHA256
e9724380ec6491d3bd7af40f81cfd87361869606fe4ad8210b12ba908674a39f

SHA512
90f421fa43077e6e202ba12eaab122f98f4c0c5af379c67e81da525d29a90a44a137e6cad5f1241ceb9f596cfa6603cc7a500ef2e467521ad40ea6314903ef5e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52330.exe

Filesize
468KB

MD5
f7fb3dc69e08168a98d8ede47162d75a

SHA1
2840d8549addedcecdbc59686dd6d2786cba0f27

SHA256
5ec910b321678dccce7f8e988edc1781c0d28c586b93145ce65f4db70a3869de

SHA512
ef3c001328b4867c6af39ad673661d7ba7f550ce13bdf838b51de3e00645e9f92b45cd5d78218b3f36800d20559ce8290858cdeab86ab366e492ec96a28618e0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56088.exe

Filesize
468KB

MD5
44ec57f940d16fec9258252b2adccf11

SHA1
6fd70549d09f4696b246151cf9be4dc5bf7f6b26

SHA256
00491a079b72f30b8ba7c176be278f11ebdbc7c6e6b94dac2fe77e4d91025343

SHA512
b7dfc973a25008ccfb157e5f0b42231e7d698385c65eb767637439ba3a6676c86a4fdc9a553993a2ca22794e04379c2a851d691d37688c31a4ec8a9a75e48231

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59412.exe

Filesize
468KB

MD5
3e02989546be2543a75770412dc8d107

SHA1
091cd062f4d2758a125a3b16671340cd398503a6

SHA256
da9a398795374ec4337052fef3bc7d538450403e9a305987909dc5d1154ce719

SHA512
d5dabdb198ea1c3e243f5787789a14a0b247b288fc8cd8de56985190b5da78ea0be26d35ef0c767b257b4a9ebfbd656ea899219b1ab57a88b429fc506e6bfc50

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-6498.exe

Filesize
468KB

MD5
e9af6fbf94667160e19ce22a7b19e830

SHA1
64b21bbb38ff260f8a42b1b71469f5122e820a95

SHA256
e269cc14ea44d954aa4a290e9e4877c80be5fa8b270faea293bc4192732d1ed5

SHA512
5bc849e3263a97b198fb160df1ec064c33c6e17c74536ee9eb6a8f8a64dd1c21db85087e28788c4c883629be114fc14dcefd1b57df416d5f7c981ebb32e9c01e

Download Submit