202df3bd316d6c195f30c1f3b8e408a59b014e538f7eae7c9996d7b1df6d8765

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-09-2024 12:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

712fa6969321827a0f574aa257321a00N.exe
Size

468KB
MD5

712fa6969321827a0f574aa257321a00
SHA1

dc200b0bd884bc17216c79fde3ea17d858834284
SHA256

202df3bd316d6c195f30c1f3b8e408a59b014e538f7eae7c9996d7b1df6d8765
SHA512

ae6e4694919c36dee4de1b14679a62e94e74a6093a01a24c98c47373c7cc9f841ad6f844374d32ab8ac4cb388d47814188717fdaf262dfd1c363030ff8c45846
SSDEEP

3072:4JqCoJldI03YtbY2PzcjNfT/rChF4GpvQ+HCOVm9NEnLXSQUSXlE:4JXoKOYtBP4jNfvG+TNELiQUS

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2188	Unicorn-57733.exe
2100	Unicorn-53623.exe
2212	Unicorn-17421.exe
2760	Unicorn-42762.exe
2660	Unicorn-50930.exe
2696	Unicorn-31064.exe
2700	Unicorn-15827.exe
3028	Unicorn-37535.exe
1664	Unicorn-61485.exe
2348	Unicorn-16369.exe
2012	Unicorn-41065.exe
2280	Unicorn-12092.exe
2312	Unicorn-57764.exe
2144	Unicorn-40800.exe
1744	Unicorn-5962.exe
2880	Unicorn-46444.exe
2632	Unicorn-33485.exe
1804	Unicorn-37377.exe
2404	Unicorn-51113.exe
2792	Unicorn-57243.exe
2224	Unicorn-61135.exe
1536	Unicorn-41269.exe
2028	Unicorn-28463.exe
932	Unicorn-19532.exe
776	Unicorn-11861.exe
1456	Unicorn-50502.exe
3040	Unicorn-42888.exe
2316	Unicorn-5577.exe
2256	Unicorn-44180.exe
2356	Unicorn-49853.exe
884	Unicorn-30252.exe
2152	Unicorn-30252.exe
2964	Unicorn-30252.exe
2824	Unicorn-43988.exe
2484	Unicorn-13361.exe
2472	Unicorn-43849.exe
2296	Unicorn-35126.exe
2136	Unicorn-6537.exe
2108	Unicorn-46608.exe
2688	Unicorn-53308.exe
2728	Unicorn-59438.exe
2664	Unicorn-59438.exe
2852	Unicorn-47186.exe
2820	Unicorn-26501.exe
2548	Unicorn-31212.exe
1012	Unicorn-38826.exe
2656	Unicorn-18960.exe
1564	Unicorn-42910.exe
1060	Unicorn-1307.exe
2024	Unicorn-56323.exe
1336	Unicorn-19065.exe
1700	Unicorn-36147.exe
1732	Unicorn-56013.exe
1492	Unicorn-12742.exe
1652	Unicorn-14788.exe
2856	Unicorn-27403.exe
2892	Unicorn-41139.exe
3004	Unicorn-6428.exe
2936	Unicorn-6163.exe
1228	Unicorn-298.exe
1340	Unicorn-15142.exe
1736	Unicorn-7736.exe
1332	Unicorn-3652.exe
1344	Unicorn-35183.exe

Loads dropped DLL 64 IoCs

pid	Process
1868	712fa6969321827a0f574aa257321a00N.exe
1868	712fa6969321827a0f574aa257321a00N.exe
2188	Unicorn-57733.exe
2188	Unicorn-57733.exe
1868	712fa6969321827a0f574aa257321a00N.exe
1868	712fa6969321827a0f574aa257321a00N.exe
2100	Unicorn-53623.exe
2100	Unicorn-53623.exe
2212	Unicorn-17421.exe
2212	Unicorn-17421.exe
2188	Unicorn-57733.exe
2188	Unicorn-57733.exe
1868	712fa6969321827a0f574aa257321a00N.exe
1868	712fa6969321827a0f574aa257321a00N.exe
2760	Unicorn-42762.exe
2100	Unicorn-53623.exe
2100	Unicorn-53623.exe
2760	Unicorn-42762.exe
2700	Unicorn-15827.exe
2700	Unicorn-15827.exe
1868	712fa6969321827a0f574aa257321a00N.exe
2696	Unicorn-31064.exe
2188	Unicorn-57733.exe
2660	Unicorn-50930.exe
2212	Unicorn-17421.exe
1868	712fa6969321827a0f574aa257321a00N.exe
2696	Unicorn-31064.exe
2188	Unicorn-57733.exe
2660	Unicorn-50930.exe
2212	Unicorn-17421.exe
1664	Unicorn-61485.exe
1664	Unicorn-61485.exe
2700	Unicorn-15827.exe
2700	Unicorn-15827.exe
2100	Unicorn-53623.exe
2760	Unicorn-42762.exe
2012	Unicorn-41065.exe
2100	Unicorn-53623.exe
2760	Unicorn-42762.exe
2012	Unicorn-41065.exe
2144	Unicorn-40800.exe
2660	Unicorn-50930.exe
2144	Unicorn-40800.exe
2660	Unicorn-50930.exe
1744	Unicorn-5962.exe
1744	Unicorn-5962.exe
1868	712fa6969321827a0f574aa257321a00N.exe
1868	712fa6969321827a0f574aa257321a00N.exe
2188	Unicorn-57733.exe
2188	Unicorn-57733.exe
2880	Unicorn-46444.exe
2880	Unicorn-46444.exe
1664	Unicorn-61485.exe
1664	Unicorn-61485.exe
2632	Unicorn-33485.exe
2632	Unicorn-33485.exe
2700	Unicorn-15827.exe
2700	Unicorn-15827.exe
2212	Unicorn-17421.exe
2212	Unicorn-17421.exe
2696	Unicorn-31064.exe
2312	Unicorn-57764.exe
2280	Unicorn-12092.exe
2312	Unicorn-57764.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5580	2676	WerFault.exe	134

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1005.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11861.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12287.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54960.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47206.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23745.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24317.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27268.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24468.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60985.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23504.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35183.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20114.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40522.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22853.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30815.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36589.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30252.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13413.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50424.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27322.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-736.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56172.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13413.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43070.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33788.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12902.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34319.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16986.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61135.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26402.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33134.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40383.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26818.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12092.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12317.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63101.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64539.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40854.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51074.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27268.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26180.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39605.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13533.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26501.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8679.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23002.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40901.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36147.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-777.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-279.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6428.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23772.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-725.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50502.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43205.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47206.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27583.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1868	712fa6969321827a0f574aa257321a00N.exe
2188	Unicorn-57733.exe
2100	Unicorn-53623.exe
2212	Unicorn-17421.exe
2760	Unicorn-42762.exe
2696	Unicorn-31064.exe
2660	Unicorn-50930.exe
2700	Unicorn-15827.exe
1664	Unicorn-61485.exe
3028	Unicorn-37535.exe
2348	Unicorn-16369.exe
2012	Unicorn-41065.exe
2312	Unicorn-57764.exe
2280	Unicorn-12092.exe
2144	Unicorn-40800.exe
1744	Unicorn-5962.exe
2880	Unicorn-46444.exe
2632	Unicorn-33485.exe
2404	Unicorn-51113.exe
1804	Unicorn-37377.exe
2792	Unicorn-57243.exe
2224	Unicorn-61135.exe
1536	Unicorn-41269.exe
2028	Unicorn-28463.exe
932	Unicorn-19532.exe
776	Unicorn-11861.exe
1456	Unicorn-50502.exe
3040	Unicorn-42888.exe
2316	Unicorn-5577.exe
2256	Unicorn-44180.exe
2356	Unicorn-49853.exe
884	Unicorn-30252.exe
2824	Unicorn-43988.exe
2152	Unicorn-30252.exe
2484	Unicorn-13361.exe
2472	Unicorn-43849.exe
2296	Unicorn-35126.exe
2664	Unicorn-59438.exe
2728	Unicorn-59438.exe
2136	Unicorn-6537.exe
2108	Unicorn-46608.exe
2688	Unicorn-53308.exe
2852	Unicorn-47186.exe
2820	Unicorn-26501.exe
2548	Unicorn-31212.exe
1564	Unicorn-42910.exe
2656	Unicorn-18960.exe
1060	Unicorn-1307.exe
1012	Unicorn-38826.exe
2024	Unicorn-56323.exe
1336	Unicorn-19065.exe
1732	Unicorn-56013.exe
1700	Unicorn-36147.exe
1492	Unicorn-12742.exe
1652	Unicorn-14788.exe
2892	Unicorn-41139.exe
2936	Unicorn-6163.exe
2856	Unicorn-27403.exe
1228	Unicorn-298.exe
3004	Unicorn-6428.exe
1340	Unicorn-15142.exe
1736	Unicorn-7736.exe
1332	Unicorn-3652.exe
1344	Unicorn-35183.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 2188	1868	712fa6969321827a0f574aa257321a00N.exe	31
PID 1868 wrote to memory of 2188	1868	712fa6969321827a0f574aa257321a00N.exe	31
PID 1868 wrote to memory of 2188	1868	712fa6969321827a0f574aa257321a00N.exe	31
PID 1868 wrote to memory of 2188	1868	712fa6969321827a0f574aa257321a00N.exe	31
PID 2188 wrote to memory of 2100	2188	Unicorn-57733.exe	32
PID 2188 wrote to memory of 2100	2188	Unicorn-57733.exe	32
PID 2188 wrote to memory of 2100	2188	Unicorn-57733.exe	32
PID 2188 wrote to memory of 2100	2188	Unicorn-57733.exe	32
PID 1868 wrote to memory of 2212	1868	712fa6969321827a0f574aa257321a00N.exe	33
PID 1868 wrote to memory of 2212	1868	712fa6969321827a0f574aa257321a00N.exe	33
PID 1868 wrote to memory of 2212	1868	712fa6969321827a0f574aa257321a00N.exe	33
PID 1868 wrote to memory of 2212	1868	712fa6969321827a0f574aa257321a00N.exe	33
PID 2100 wrote to memory of 2760	2100	Unicorn-53623.exe	34
PID 2100 wrote to memory of 2760	2100	Unicorn-53623.exe	34
PID 2100 wrote to memory of 2760	2100	Unicorn-53623.exe	34
PID 2100 wrote to memory of 2760	2100	Unicorn-53623.exe	34
PID 2212 wrote to memory of 2660	2212	Unicorn-17421.exe	35
PID 2212 wrote to memory of 2660	2212	Unicorn-17421.exe	35
PID 2212 wrote to memory of 2660	2212	Unicorn-17421.exe	35
PID 2212 wrote to memory of 2660	2212	Unicorn-17421.exe	35
PID 2188 wrote to memory of 2696	2188	Unicorn-57733.exe	36
PID 2188 wrote to memory of 2696	2188	Unicorn-57733.exe	36
PID 2188 wrote to memory of 2696	2188	Unicorn-57733.exe	36
PID 2188 wrote to memory of 2696	2188	Unicorn-57733.exe	36
PID 1868 wrote to memory of 2700	1868	712fa6969321827a0f574aa257321a00N.exe	37
PID 1868 wrote to memory of 2700	1868	712fa6969321827a0f574aa257321a00N.exe	37
PID 1868 wrote to memory of 2700	1868	712fa6969321827a0f574aa257321a00N.exe	37
PID 1868 wrote to memory of 2700	1868	712fa6969321827a0f574aa257321a00N.exe	37
PID 2100 wrote to memory of 3028	2100	Unicorn-53623.exe	39
PID 2100 wrote to memory of 3028	2100	Unicorn-53623.exe	39
PID 2100 wrote to memory of 3028	2100	Unicorn-53623.exe	39
PID 2100 wrote to memory of 3028	2100	Unicorn-53623.exe	39
PID 2700 wrote to memory of 1664	2700	Unicorn-15827.exe	40
PID 2700 wrote to memory of 1664	2700	Unicorn-15827.exe	40
PID 2700 wrote to memory of 1664	2700	Unicorn-15827.exe	40
PID 2700 wrote to memory of 1664	2700	Unicorn-15827.exe	40
PID 2760 wrote to memory of 2348	2760	Unicorn-42762.exe	38
PID 2760 wrote to memory of 2348	2760	Unicorn-42762.exe	38
PID 2760 wrote to memory of 2348	2760	Unicorn-42762.exe	38
PID 2760 wrote to memory of 2348	2760	Unicorn-42762.exe	38
PID 1868 wrote to memory of 2144	1868	712fa6969321827a0f574aa257321a00N.exe	41
PID 1868 wrote to memory of 2144	1868	712fa6969321827a0f574aa257321a00N.exe	41
PID 1868 wrote to memory of 2144	1868	712fa6969321827a0f574aa257321a00N.exe	41
PID 1868 wrote to memory of 2144	1868	712fa6969321827a0f574aa257321a00N.exe	41
PID 2696 wrote to memory of 2012	2696	Unicorn-31064.exe	42
PID 2696 wrote to memory of 2012	2696	Unicorn-31064.exe	42
PID 2696 wrote to memory of 2012	2696	Unicorn-31064.exe	42
PID 2696 wrote to memory of 2012	2696	Unicorn-31064.exe	42
PID 2188 wrote to memory of 1744	2188	Unicorn-57733.exe	43
PID 2188 wrote to memory of 1744	2188	Unicorn-57733.exe	43
PID 2188 wrote to memory of 1744	2188	Unicorn-57733.exe	43
PID 2188 wrote to memory of 1744	2188	Unicorn-57733.exe	43
PID 2660 wrote to memory of 2280	2660	Unicorn-50930.exe	44
PID 2660 wrote to memory of 2280	2660	Unicorn-50930.exe	44
PID 2660 wrote to memory of 2280	2660	Unicorn-50930.exe	44
PID 2660 wrote to memory of 2280	2660	Unicorn-50930.exe	44
PID 2212 wrote to memory of 2312	2212	Unicorn-17421.exe	45
PID 2212 wrote to memory of 2312	2212	Unicorn-17421.exe	45
PID 2212 wrote to memory of 2312	2212	Unicorn-17421.exe	45
PID 2212 wrote to memory of 2312	2212	Unicorn-17421.exe	45
PID 1664 wrote to memory of 2880	1664	Unicorn-61485.exe	46
PID 1664 wrote to memory of 2880	1664	Unicorn-61485.exe	46
PID 1664 wrote to memory of 2880	1664	Unicorn-61485.exe	46
PID 1664 wrote to memory of 2880	1664	Unicorn-61485.exe	46

C:\Users\Admin\AppData\Local\Temp\712fa6969321827a0f574aa257321a00N.exe
"C:\Users\Admin\AppData\Local\Temp\712fa6969321827a0f574aa257321a00N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57733.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57733.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53623.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53623.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42762.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16369.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41139.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13413.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64119.exe
        7⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27268.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3583.exe
        7⤵
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29293.exe
        6⤵
        
        PID:808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30264.exe
        7⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32645.exe
        7⤵
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31352.exe
        7⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3583.exe
        7⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51074.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51633.exe
        6⤵
        
        PID:3492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34319.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39454.exe
        6⤵
        
        PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37377.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6537.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
        7⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51644.exe
        8⤵
        
        PID:320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
        8⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42454.exe
        8⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14186.exe
        8⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7082.exe
        7⤵
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5047.exe
        7⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42454.exe
        7⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64347.exe
        7⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53574.exe
        6⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59812.exe
        7⤵
        
        PID:836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42454.exe
        7⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60455.exe
        7⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54834.exe
        6⤵
        
        PID:1292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35225.exe
        6⤵
        
        PID:3800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33788.exe
        6⤵
        
        PID:4652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9903.exe
        6⤵
        
        PID:4100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45018.exe
        6⤵
        
        PID:5428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53308.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12287.exe
        6⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35490.exe
        7⤵
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22853.exe
        7⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63255.exe
        7⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51675.exe
        6⤵
        
        PID:3368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39543.exe
        6⤵
        
        PID:4800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14186.exe
        6⤵
        
        PID:5388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61031.exe
        5⤵
        
        PID:2780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3284.exe
        6⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22853.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63255.exe
        6⤵
        
        PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45506.exe
        5⤵
        
        PID:3164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16210.exe
        5⤵
        
        PID:3700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43305.exe
        5⤵
        
        PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11235.exe
        5⤵
        
        PID:5488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37535.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30252.exe
        5⤵
        Executes dropped EXE
        
        PID:2964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-298.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50424.exe
        6⤵
        
        PID:2848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56941.exe
        6⤵
        
        PID:3876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33134.exe
        6⤵
        
        PID:1708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44119.exe
        6⤵
        
        PID:6024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28634.exe
        5⤵
        
        PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9517.exe
        5⤵
        
        PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7933.exe
        5⤵
        
        PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10632.exe
        5⤵
        
        PID:5140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51113.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59438.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31748.exe
        6⤵
        
        PID:484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20591.exe
        7⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46216.exe
        7⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36589.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22852.exe
        7⤵
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21384.exe
        6⤵
        
        PID:2384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15493.exe
        6⤵
        
        PID:3744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-736.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18270.exe
        6⤵
        
        PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15774.exe
        5⤵
        
        PID:1280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49361.exe
        6⤵
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22853.exe
        6⤵
        
        PID:4700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16986.exe
        6⤵
        
        PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40138.exe
        5⤵
        
        PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32174.exe
        5⤵
        
        PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5826.exe
        5⤵
        
        PID:4156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15700.exe
        5⤵
        
        PID:5632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26501.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52443.exe
        5⤵
        
        PID:980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38654.exe
        5⤵
        
        PID:3216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31375.exe
        5⤵
        
        PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43016.exe
        5⤵
        
        PID:6008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7908.exe
      4⤵
      PID:2412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58519.exe
      4⤵
      PID:3512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24999.exe
      4⤵
      PID:3448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51706.exe
      4⤵
      PID:6044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31064.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31064.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41065.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57243.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59438.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50424.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24317.exe
        7⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33788.exe
        7⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43919.exe
        7⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59085.exe
        6⤵
        
        PID:592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12317.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33134.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22354.exe
        6⤵
        
        PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11135.exe
        6⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38261.exe
        7⤵
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22853.exe
        7⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63255.exe
        7⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35722.exe
        6⤵
        
        PID:3308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27268.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22852.exe
        6⤵
        
        PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25617.exe
        5⤵
        
        PID:2600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28173.exe
        6⤵
        
        PID:3660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22853.exe
        6⤵
        
        PID:4676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63255.exe
        6⤵
        
        PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5738.exe
        5⤵
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24468.exe
        5⤵
        
        PID:3748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27583.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43988.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7736.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-502.exe
        6⤵
        
        PID:2460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34570.exe
        6⤵
        
        PID:3188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35546.exe
        6⤵
        
        PID:3756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2239.exe
        6⤵
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32235.exe
        6⤵
        
        PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59085.exe
        5⤵
        
        PID:536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9480.exe
        6⤵
        
        PID:3488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1005.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22852.exe
        6⤵
        
        PID:5284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11296.exe
        5⤵
        
        PID:3420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33788.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43919.exe
        5⤵
        
        PID:5752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35183.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20591.exe
        5⤵
        
        PID:3036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46216.exe
        5⤵
        
        PID:3852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36589.exe
        5⤵
        
        PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3583.exe
        5⤵
        
        PID:5868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11660.exe
      4⤵
      PID:2888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40615.exe
      4⤵
      PID:4020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42741.exe
      4⤵
      PID:5008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38203.exe
      4⤵
      PID:6012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5962.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5962.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28463.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47186.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31447.exe
        6⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26850.exe
        7⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8679.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26402.exe
        6⤵
        
        PID:3092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59858.exe
        6⤵
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31020.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45406.exe
        5⤵
        
        PID:1188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13917.exe
        6⤵
        
        PID:3460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61911.exe
        6⤵
        
        PID:5096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40901.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26818.exe
        5⤵
        
        PID:4056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20384.exe
        5⤵
        
        PID:3912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59104.exe
        5⤵
        
        PID:5164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18960.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36216.exe
        5⤵
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54960.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61426.exe
        6⤵
        
        PID:3156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27268.exe
        6⤵
        
        PID:4112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15835.exe
        6⤵
        
        PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43070.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42105.exe
        5⤵
        
        PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29050.exe
        5⤵
        
        PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10102.exe
        5⤵
        
        PID:5172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58482.exe
      4⤵
      PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27322.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22853.exe
        5⤵
        
        PID:4660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16986.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40985.exe
      4⤵
      PID:1404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9116.exe
      4⤵
      PID:3344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9298.exe
      4⤵
      PID:5048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65241.exe
      4⤵
      PID:5124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11861.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11861.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38826.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12287.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13413.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43205.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23184.exe
        6⤵
        
        PID:4184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3583.exe
        6⤵
        
        PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42748.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56941.exe
        5⤵
        
        PID:3868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33134.exe
        5⤵
        
        PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64539.exe
        5⤵
        
        PID:5948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41430.exe
      4⤵
      PID:2840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
        5⤵
        
        PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13533.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21070.exe
        5⤵
        
        PID:5524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40138.exe
      4⤵
      PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32174.exe
      4⤵
      PID:3352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59111.exe
      4⤵
      PID:5112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15700.exe
      4⤵
      PID:5268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1307.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1307.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31748.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45510.exe
        5⤵
        
        PID:1972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43205.exe
        5⤵
        
        PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27268.exe
        5⤵
        
        PID:4120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3583.exe
        5⤵
        
        PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30688.exe
      4⤵
      PID:308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51378.exe
        5⤵
        
        PID:5636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24317.exe
      4⤵
      PID:3948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47206.exe
      4⤵
      PID:4988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14716.exe
      4⤵
      PID:5324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10174.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10174.exe
    3⤵
    PID:2204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47944.exe
      4⤵
      PID:2264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57233.exe
      4⤵
      PID:3464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36589.exe
      4⤵
      PID:4516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3583.exe
      4⤵
      PID:5696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59580.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59580.exe
    3⤵
    PID:2624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55143.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55143.exe
    3⤵
    PID:3604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7453.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7453.exe
    3⤵
    PID:4328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38319.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38319.exe
    3⤵
    PID:5824
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17421.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17421.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50930.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50930.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12092.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30252.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3460.exe
        6⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26481.exe
        7⤵
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39889.exe
        7⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31375.exe
        7⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60455.exe
        7⤵
        
        PID:5596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6423.exe
        6⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23745.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53625.exe
        6⤵
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33134.exe
        6⤵
        
        PID:2948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64539.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28933.exe
        5⤵
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24006.exe
        6⤵
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22853.exe
        6⤵
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1802.exe
        6⤵
        
        PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28733.exe
        5⤵
        
        PID:2364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12693.exe
        5⤵
        
        PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41072.exe
        5⤵
        
        PID:4904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60985.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41269.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42910.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60720.exe
        6⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63896.exe
        7⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65209.exe
        7⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36589.exe
        7⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49385.exe
        7⤵
        
        PID:5484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-725.exe
        6⤵
        
        PID:2080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59951.exe
        6⤵
        
        PID:4036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42454.exe
        6⤵
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60455.exe
        6⤵
        
        PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16350.exe
        5⤵
        
        PID:3056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4752.exe
        6⤵
        
        PID:3016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18451.exe
        6⤵
        
        PID:3952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42454.exe
        6⤵
        
        PID:4580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14186.exe
        6⤵
        
        PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8098.exe
        5⤵
        
        PID:1752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59490.exe
        5⤵
        
        PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24468.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56172.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56323.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24540.exe
        5⤵
        
        PID:752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34582.exe
        6⤵
        
        PID:3388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63370.exe
        6⤵
        
        PID:5104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23504.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34570.exe
        5⤵
        
        PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26308.exe
        5⤵
        
        PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39188.exe
        5⤵
        
        PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32235.exe
        5⤵
        
        PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
      4⤵
      PID:268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7135.exe
        5⤵
        
        PID:5060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4403.exe
        5⤵
        
        PID:5440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37337.exe
      4⤵
      PID:3124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40522.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39605.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11235.exe
      4⤵
      PID:5520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57764.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57764.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30252.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3652.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20591.exe
        6⤵
        
        PID:992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28451.exe
        6⤵
        
        PID:3348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17433.exe
        6⤵
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20704.exe
        6⤵
        
        PID:2308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-725.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59951.exe
        5⤵
        
        PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42454.exe
        5⤵
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63742.exe
        5⤵
        
        PID:4948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63188.exe
        5⤵
        
        PID:5292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62867.exe
      4⤵
      PID:1056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26180.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28369.exe
        5⤵
        
        PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35459.exe
        5⤵
        
        PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14186.exe
        5⤵
        
        PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23175.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2631.exe
      4⤵
      PID:3428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17253.exe
      4⤵
      PID:4348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60985.exe
      4⤵
      PID:5664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49853.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49853.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6428.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40383.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53928.exe
        6⤵
        
        PID:3416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31839.exe
        6⤵
        
        PID:5080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35035.exe
        6⤵
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50907.exe
        5⤵
        
        PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27268.exe
        5⤵
        
        PID:4128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22852.exe
        5⤵
        
        PID:5232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-97.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-97.exe
      4⤵
      PID:2440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26818.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20384.exe
      4⤵
      PID:3768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63188.exe
      4⤵
      PID:5180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15142.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15142.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13413.exe
      4⤵
      PID:2464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18451.exe
      4⤵
      PID:3964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63742.exe
      4⤵
      PID:4964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63188.exe
      4⤵
      PID:5276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37148.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37148.exe
    3⤵
    PID:772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54671.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54671.exe
    3⤵
    PID:3820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3468.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3468.exe
    3⤵
    PID:3848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49303.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49303.exe
    3⤵
    PID:5148
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15827.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15827.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61485.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61485.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46444.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50502.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19065.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9952.exe
        7⤵
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13983.exe
        7⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42454.exe
        7⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60455.exe
        7⤵
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2614.exe
        6⤵
        
        PID:1052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63101.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29050.exe
        6⤵
        
        PID:2008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14186.exe
        6⤵
        
        PID:5380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36147.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60964.exe
        6⤵
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15624.exe
        6⤵
        
        PID:3776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36589.exe
        6⤵
        
        PID:4524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43272.exe
        6⤵
        
        PID:2072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32235.exe
        6⤵
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14460.exe
        5⤵
        
        PID:912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-279.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47206.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14716.exe
        5⤵
        
        PID:5404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42888.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56013.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25090.exe
        6⤵
        
        PID:2836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43205.exe
        6⤵
        
        PID:3884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23184.exe
        6⤵
        
        PID:4192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22852.exe
        6⤵
        
        PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19443.exe
        5⤵
        
        PID:2720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19848.exe
        5⤵
        
        PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33788.exe
        5⤵
        
        PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47206.exe
        5⤵
        
        PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60985.exe
        5⤵
        
        PID:5672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12742.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6719.exe
        5⤵
        
        PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57233.exe
        5⤵
        
        PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36589.exe
        5⤵
        
        PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22852.exe
        5⤵
        
        PID:5192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51187.exe
      4⤵
      PID:2064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35303.exe
      4⤵
      PID:3672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17253.exe
      4⤵
      PID:4368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18800.exe
      4⤵
      PID:5532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33485.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33485.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5577.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14788.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-777.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18451.exe
        6⤵
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42454.exe
        6⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18704.exe
        6⤵
        
        PID:5836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50424.exe
        5⤵
        
        PID:3020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34582.exe
        6⤵
        
        PID:3392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59286.exe
        6⤵
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14543.exe
        6⤵
        
        PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24317.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33788.exe
        5⤵
        
        PID:4636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43919.exe
        5⤵
        
        PID:5912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27403.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52443.exe
        5⤵
        
        PID:2980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6469.exe
        6⤵
        
        PID:1168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26402.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56049.exe
        5⤵
        
        PID:4236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22852.exe
        5⤵
        
        PID:5316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47657.exe
      4⤵
      PID:2952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37835.exe
      4⤵
      PID:3240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14342.exe
      4⤵
      PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14716.exe
      4⤵
      PID:5308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44180.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44180.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4482.exe
      4⤵
      PID:2812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31852.exe
        5⤵
        
        PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13533.exe
        5⤵
        
        PID:3364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12902.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64642.exe
      4⤵
      PID:1928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33134.exe
      4⤵
      PID:3148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60455.exe
      4⤵
      PID:5784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6163.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6163.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61571.exe
      4⤵
      PID:2676
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 200
        5⤵
        Program crash
        
        PID:5580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64119.exe
      4⤵
      PID:3536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35459.exe
      4⤵
      PID:4808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6408.exe
      4⤵
      PID:5516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4483.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4483.exe
    3⤵
    PID:2988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58519.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58519.exe
    3⤵
    PID:3520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20914.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20914.exe
    3⤵
    PID:3360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58722.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58722.exe
    3⤵
    PID:5156
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40800.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40800.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61135.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61135.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13361.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43040.exe
        5⤵
        
        PID:1796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30456.exe
        6⤵
        
        PID:1740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22234.exe
        6⤵
        
        PID:3496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63742.exe
        6⤵
        
        PID:4996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43919.exe
        6⤵
        
        PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2230.exe
        5⤵
        
        PID:1676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27908.exe
        5⤵
        
        PID:3652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33788.exe
        5⤵
        
        PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43919.exe
        5⤵
        
        PID:5776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40854.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20114.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22853.exe
        5⤵
        
        PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16986.exe
        5⤵
        
        PID:5364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35120.exe
      4⤵
      PID:1920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21358.exe
      4⤵
      PID:3696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57608.exe
      4⤵
      PID:4912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43919.exe
      4⤵
      PID:5680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43849.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43849.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24540.exe
      4⤵
      PID:1548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39200.exe
        5⤵
        
        PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56849.exe
        5⤵
        
        PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36589.exe
        5⤵
        
        PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22852.exe
        5⤵
        
        PID:5340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-725.exe
      4⤵
      PID:1540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59951.exe
      4⤵
      PID:4044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42454.exe
      4⤵
      PID:4588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60455.exe
      4⤵
      PID:5808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59141.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59141.exe
    3⤵
    PID:2060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57763.exe
      4⤵
      PID:4892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43188.exe
      4⤵
      PID:5572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4970.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4970.exe
    3⤵
    PID:2672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24468.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24468.exe
    3⤵
    PID:3612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43919.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43919.exe
    3⤵
    PID:5720
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19532.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19532.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35126.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35126.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3460.exe
      4⤵
      PID:780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19356.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35447.exe
        5⤵
        
        PID:944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42454.exe
        5⤵
        
        PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60455.exe
        5⤵
        
        PID:5740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31778.exe
      4⤵
      PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13407.exe
      4⤵
      PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63742.exe
      4⤵
      PID:4980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43919.exe
      4⤵
      PID:5648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55847.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55847.exe
    3⤵
    PID:2452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35490.exe
      4⤵
      PID:3780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1005.exe
      4⤵
      PID:5024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3583.exe
      4⤵
      PID:5712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22867.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22867.exe
    3⤵
    PID:948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21358.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21358.exe
    3⤵
    PID:3760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47206.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47206.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60985.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60985.exe
    3⤵
    PID:5704
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46608.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46608.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23772.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23772.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13413.exe
      4⤵
      PID:1968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43205.exe
      4⤵
      PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31375.exe
      4⤵
      PID:4864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22354.exe
      4⤵
      PID:5556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33178.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33178.exe
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11183.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11183.exe
    3⤵
    PID:3224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17253.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17253.exe
    3⤵
    PID:4356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60985.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60985.exe
    3⤵
    PID:5896
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2735.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2735.exe
  2⤵
  PID:2564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20591.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20591.exe
    3⤵
    PID:304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46216.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46216.exe
    3⤵
    PID:3840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36589.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36589.exe
    3⤵
    PID:4492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3583.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3583.exe
    3⤵
    PID:5760
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52112.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52112.exe
  2⤵
  PID:2640
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30815.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30815.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3920
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11653.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11653.exe
  2⤵
  PID:4376
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10583.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10583.exe
  2⤵
  PID:5816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-31839.exe

Filesize
468KB

MD5
ce6095ef567f3d9721f811f91e0b80f8

SHA1
5c8058129dcb6ec1d6232d2f4bfa2187e85810cb

SHA256
429055d1dc16c397635bae36fa07b88edcf06c14fd8d15d7932624252059f527

SHA512
3efe335e3d8f60651f308120296eb5e13c856e9c880e6ec6ff66de5b23206a329d89f7d82c457c8a2984cd4fa5142d6b1beb31010fee9ef896eb452876f2d3f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39889.exe

Filesize
468KB

MD5
53343a16d1916b6fbb6469316c81abc2

SHA1
b5af5b9c11a52296466e74261c455c486b622859

SHA256
c81cb89072390a837480da40b43fab7dc93a1d3b3d0d86022cbd172a99a2b134

SHA512
2ed2a492ddf43d76779bbffef4079a178d23f107e3c3f68ec178be7226199f8c199b82a059c7bf0cbc9d2f5652233388a27f7f401072079883e004e6c3db2adf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41065.exe

Filesize
468KB

MD5
990c9cff8c5c14ab21443bec4a581051

SHA1
669e3f2421008fbed82984b94351aa2de87099af

SHA256
aceab52e983b44c937c4bc93a2c287a3ddeb72ec5734c34a21ed87e5cb6914aa

SHA512
47a5572af8c0bf585fcd0660357dd63abfea54765fb1df08c4d0d2525c54b43010e1cc68e24109b6b752e7c716d83b479e19046d9a98cfd9491571f7e60771f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50930.exe

Filesize
468KB

MD5
3fa6df335a7714596c90fa00913f4cfc

SHA1
213e0f13e8560a9896dfa385b01c6d6b30791864

SHA256
8a836510ecad3163a9926b4ecf316089348eefbc961c1287181958f8025d7bdf

SHA512
b8a84035f74a213719c839ce8a99fc969936c1db82c4a0b396b010b86d7e08b300a5302654feddbb05690822aed0c644d746fb34a6f75d568ebeda31db9bc1a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53623.exe

Filesize
468KB

MD5
65ff7a7cae15e5509e47cf77ee639804

SHA1
a3db2afb16ac2ae1957b381ce14a04c17b22d6f2

SHA256
2079bf175f1ccf83d5db154dca5b46cb61c5909240eebf7006c6944277aceee0

SHA512
81a6f0ee5305ff4d276df2bcf2cade2021b06179b94479583b24b2aa1353bf671d91de09fd16a7d7d46a7ab1f0604ac2fef5ce118eba0076dee53c9c35e00735

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57764.exe

Filesize
468KB

MD5
0aed8d537b941bb5f88aff267de7c31b

SHA1
eb591767a72c252da37eecbc89b2a3ee1698326f

SHA256
2adf480eca63236eec7d641c7e58e64ddc7444c0a0659a1f0681874792f1519e

SHA512
bf6bf2a5fef9ef35178004f8233dee34d4cb836f8241cbae528a500169cd091f66af50ceb3636360368bc0090251d20d408fe08f284b4812f6beedb70bf99fd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5962.exe

Filesize
468KB

MD5
940c145592d88cca656bd5519a1e6ba3

SHA1
a8d692a4ec1149a8f3e219a517ebf05fe546e76e

SHA256
de8b17c2bc19ca385272d6f4f1da8a2309c3441d7b241585d033c1b10b6b3904

SHA512
5eb35b068b7aa59cee3b8f05ae4d1a570fbb16f5b7898ff90e421ba3a38478b7eea31699e2887661d4e997cd692b3869a6fa25027dc8a654f3fbb61fce21d92c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12092.exe

Filesize
468KB

MD5
d361e091e31659aa284d46b2dac97a20

SHA1
715acaebbb49b7d0b363d94220ee006316eaf10a

SHA256
6e0afeee31e1d4d1893e0c8c0901ae8397515dd8d21ddb4bda822230aea30e66

SHA512
629ab62b441f701a3aab7cca1f0d0fbd3e4d39e961f5f8765d38d583c95c24fce0d719516a46a106d83ea4067d8a48ec63bb3050d929bff1605482f5435d08fd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15827.exe

Filesize
468KB

MD5
0e3c04ffc8fd886bb98b43cf0c2c20c4

SHA1
07df8e83c24a7e5671e5631fc954bec117814eb3

SHA256
0fbe5ff577de3155ebad81f96de1190f2d6a491c5f349d2cf89dd43ef7604b53

SHA512
1827f24d85398c3d88713498c2b894e7c353646e2326e2471936e2f23f5664c2a00174502fa5ccee20fe2cd91346edb2fdb8c0c8dd301a82324353c408a7cba1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16369.exe

Filesize
468KB

MD5
5572edee787af30763e38342927d5033

SHA1
ce9c0d31839d01fbb82bfe7fe7b57da0ae569f4e

SHA256
d5be25154861dd9ee10897cd7e70c372dec16c6dfca1daedee52279df0196da7

SHA512
44415ca31108479169fc46ad8e6b8cb7256b3ead67fb371f4f8dc8eea6768f1e7485c0b2f39f14a81ec58f32daab024ae7efcecf125f4b93526fd42e0f53004e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17421.exe

Filesize
468KB

MD5
1a8cae7a57d551086c4d62195041ac3e

SHA1
5f3784371d8426e4615325d07cd76e34d4e339c2

SHA256
d708765faf3d5d2b1b73d559653db982b724aed0fb40dfe07f4212f4703a5091

SHA512
8f5d8a6a841a8283932b185e7219a824c7b2e9383c8d09595cd3f5e1d54265b1b51cf24c7b00d735a74ae4215a61947a4c391ea8752b100b5ca790b5f0e5ce0a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31064.exe

Filesize
468KB

MD5
4b81e7471bc6f871f7008c7f4d24f062

SHA1
20da2afc4d8be143f5cdfcd6d88012a0952ffc98

SHA256
81cec8388703f5a95a231f53dec3968ca3f834545ef32dcd940198f85f5851f0

SHA512
71acd4560dd2e79bc001d105e3ac40e554c8a0a55f2bdcfb4a1ba8de238f759f20482e53536dcc01b3ca317b981a72bb27d38294afadc45716f88a74a333e13e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33485.exe

Filesize
468KB

MD5
e0ebfbe04c9fdc6cd6833882440b0b1a

SHA1
fabbaade1c30188ffca6d5a2b2fa5399b40138cd

SHA256
f2de177c06f1dd480c1e3cd8c80d46d65f38181140c461eb6eb30ef6a58a97ed

SHA512
a03f21885dd6ec5b6a649c7460e337c552074b473a300de58f17ec1bc84a7ba095593c2dd53eeb7294ac3491f6583ada847e1947a8ac9988ce359f84a21b008c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37535.exe

Filesize
468KB

MD5
64b9448821e82b0e407d9ab8352df0f5

SHA1
f55fcdd6be579757199fe0ca6f169d1d7d85eb58

SHA256
72e27f6a202f1b3ce13bc4f590ecf1886274f091988c44ff8536834ea224c289

SHA512
bc221e48d35546e3b5f72eb8838ae432c67f8ef0b92b4eaf03c5764f7be0c8aef86ca45c3b2b360fb3ea56665544a91a61f045d56cdcddbb5ebebbb6d7be86f7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40800.exe

Filesize
468KB

MD5
e0ff093e225fa83a18d8fc1b293a6090

SHA1
69fb0075bd1c2b9e4a8cc8ac217f9394a5c8c8b2

SHA256
7ef8d055d991ed1d1daabb578fbd59bcfd5876c15df4b0f46b280aa05dfd175a

SHA512
85c9a7f235b8acac6dc9f3ff1b665190098f03402ea0ce330ea41b8e5ed43b070f00eb0efc18f90e5ef88aba71f7a8cfea06f224ea1a7b19eaefaa9aa0189df5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42762.exe

Filesize
468KB

MD5
7f890301969787a59b3772fa0b493b8f

SHA1
efd6acb99ce56e9a52992d6f398ccbdd52a10145

SHA256
2277a0f3c04f6c2c4000e45f9224063ecd9b730d09b59e9d4f248b86cd44ef34

SHA512
833abbb4ed3290d0cd2f9e55f0403e3cdaf2103926e8914ecea89dca5669f6369bc2e3e1575ea60201c295ed4924a69227e5c556e556a9c01dc7838557471625

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46444.exe

Filesize
468KB

MD5
08ac045d894b4291fbd8c0fecfbd7efc

SHA1
27da751079e32cd7cb4d6f1bad60ea0e0cb29b0a

SHA256
55642adac3ca4d0947bbe51a70b2c030749fc6836eb3e80f782986eaec787afc

SHA512
e4cc688a711121c9805727e01c2dbb5c27df9f30615ebcb6fa3e69a066457ad91a89df7f2140648f03bd6cf97b03bca9dcf91061bb9097ad741a9fa198a73f5e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57733.exe

Filesize
468KB

MD5
e23db3805b704519d016b92f1da64b45

SHA1
a6de750098477ec795ff2e41e44e3704ba5d9fb3

SHA256
f5c8558b77a684ea1b775785882ac9c634e8c053a47b9e40f664b1ba367ebe74

SHA512
5c0a4dc060ca9f876d78342398500c7675fcc35ae38a03e0612132eb2455b49847e4c45f3650c3607834e18ad98c161016652cd5860637b05a0a8d95eedfe7c1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61485.exe

Filesize
468KB

MD5
1a0739542272adfc537dce67e272de15

SHA1
254141ff9bce81cb9484014ff628d24aae9b9851

SHA256
46ef92d153abebf9d900235c5cacc14a9c4aba6c9ceb81d80dac1fc180b358dc

SHA512
85b55f047da10c5d2c6254de80781c07196f27fedc4c7a547266b6d5dffab809ed7b7228f8c45c633b34e226bbdd3373f69169148be92e6dba846adcea863971

Download Submit