14cc1faee2ccf2793247460f3142ddc693a6bc1aae2af244d91333cdd15d0275

Analysis

max time kernel
119s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 23:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

82073b361870baaa466f9713ae3e59f0N.exe
Size

468KB
MD5

82073b361870baaa466f9713ae3e59f0
SHA1

8a089beb2dad41b957fa36bd26fe7c0bba5d50ca
SHA256

14cc1faee2ccf2793247460f3142ddc693a6bc1aae2af244d91333cdd15d0275
SHA512

e58cd5e19e3a78bdf4e631ced9064c4afe5a55544075a73fdc2aa0a90364a98cdbc6397ced21531ed89412bfb148b0b736dfeb817609a086c996160eab4c5a59
SSDEEP

3072:Kkn+ogGHIl5UtbYkPzfjRf8/9KhUUIpA0mHeJVnsSf58depMpmlH:Kk+ogzUtXPbjRfh0dwSfGUpMp

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2892	Unicorn-55380.exe
2836	Unicorn-51187.exe
2240	Unicorn-4679.exe
3020	Unicorn-16460.exe
3064	Unicorn-4762.exe
2796	Unicorn-63522.exe
2736	Unicorn-30941.exe
1352	Unicorn-42308.exe
1200	Unicorn-38778.exe
1996	Unicorn-10019.exe
1980	Unicorn-14103.exe
2064	Unicorn-41300.exe
1496	Unicorn-60901.exe
948	Unicorn-20225.exe
2136	Unicorn-61166.exe
760	Unicorn-26019.exe
2196	Unicorn-49132.exe
2348	Unicorn-16289.exe
2316	Unicorn-44969.exe
2776	Unicorn-40985.exe
896	Unicorn-22873.exe
596	Unicorn-46823.exe
2664	Unicorn-28084.exe
800	Unicorn-28349.exe
1408	Unicorn-16651.exe
1640	Unicorn-36517.exe
2936	Unicorn-10066.exe
1704	Unicorn-55738.exe
2680	Unicorn-12104.exe
1712	Unicorn-18235.exe
1216	Unicorn-17472.exe
884	Unicorn-35.exe
2080	Unicorn-39676.exe
3024	Unicorn-14160.exe
1572	Unicorn-32900.exe
2332	Unicorn-45152.exe
2864	Unicorn-10704.exe
2860	Unicorn-18872.exe
2224	Unicorn-38738.exe
3032	Unicorn-5965.exe
2876	Unicorn-10149.exe
2784	Unicorn-52942.exe
2092	Unicorn-419.exe
2764	Unicorn-58343.exe
2548	Unicorn-64010.exe
2468	Unicorn-29200.exe
2288	Unicorn-511.exe
2132	Unicorn-21586.exe
2924	Unicorn-41452.exe
1288	Unicorn-51466.exe
2900	Unicorn-41814.exe
2540	Unicorn-39122.exe
2940	Unicorn-4311.exe
2888	Unicorn-4311.exe
1728	Unicorn-64995.exe
2300	Unicorn-32827.exe
2428	Unicorn-17310.exe
2116	Unicorn-41260.exe
1608	Unicorn-33646.exe
2448	Unicorn-27446.exe
1512	Unicorn-37652.exe
340	Unicorn-48250.exe
1528	Unicorn-18270.exe
1708	Unicorn-38136.exe

Loads dropped DLL 64 IoCs

pid	Process
1172	82073b361870baaa466f9713ae3e59f0N.exe
1172	82073b361870baaa466f9713ae3e59f0N.exe
2892	Unicorn-55380.exe
2892	Unicorn-55380.exe
1172	82073b361870baaa466f9713ae3e59f0N.exe
1172	82073b361870baaa466f9713ae3e59f0N.exe
2836	Unicorn-51187.exe
2836	Unicorn-51187.exe
2892	Unicorn-55380.exe
2892	Unicorn-55380.exe
2240	Unicorn-4679.exe
2240	Unicorn-4679.exe
1172	82073b361870baaa466f9713ae3e59f0N.exe
1172	82073b361870baaa466f9713ae3e59f0N.exe
3020	Unicorn-16460.exe
3020	Unicorn-16460.exe
2836	Unicorn-51187.exe
2836	Unicorn-51187.exe
2796	Unicorn-63522.exe
2796	Unicorn-63522.exe
2736	Unicorn-30941.exe
2736	Unicorn-30941.exe
2240	Unicorn-4679.exe
1172	82073b361870baaa466f9713ae3e59f0N.exe
1172	82073b361870baaa466f9713ae3e59f0N.exe
2240	Unicorn-4679.exe
3064	Unicorn-4762.exe
3064	Unicorn-4762.exe
2892	Unicorn-55380.exe
2892	Unicorn-55380.exe
1352	Unicorn-42308.exe
1352	Unicorn-42308.exe
3020	Unicorn-16460.exe
3020	Unicorn-16460.exe
1200	Unicorn-38778.exe
1200	Unicorn-38778.exe
2836	Unicorn-51187.exe
2836	Unicorn-51187.exe
1980	Unicorn-14103.exe
1980	Unicorn-14103.exe
2736	Unicorn-30941.exe
2736	Unicorn-30941.exe
948	Unicorn-20225.exe
948	Unicorn-20225.exe
2892	Unicorn-55380.exe
2136	Unicorn-61166.exe
2892	Unicorn-55380.exe
2136	Unicorn-61166.exe
3064	Unicorn-4762.exe
3064	Unicorn-4762.exe
1996	Unicorn-10019.exe
1996	Unicorn-10019.exe
2064	Unicorn-41300.exe
2796	Unicorn-63522.exe
2064	Unicorn-41300.exe
2796	Unicorn-63522.exe
2240	Unicorn-4679.exe
1496	Unicorn-60901.exe
2240	Unicorn-4679.exe
1496	Unicorn-60901.exe
1172	82073b361870baaa466f9713ae3e59f0N.exe
1172	82073b361870baaa466f9713ae3e59f0N.exe
760	Unicorn-26019.exe
760	Unicorn-26019.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2304	2548	WerFault.exe	74
4320	2160	WerFault.exe	140
5228	2184	WerFault.exe	139

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12104.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30792.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20102.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16060.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11760.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1773.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37040.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39396.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19895.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22429.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55117.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14030.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7233.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64105.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37040.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37637.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63625.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18235.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43886.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17985.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64105.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16319.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7233.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60901.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31232.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43991.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13558.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23304.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50361.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46538.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52942.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38764.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14030.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41260.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33750.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37040.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51931.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33750.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45505.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55117.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33767.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34770.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54631.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11230.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58914.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14030.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10066.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8976.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28369.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16060.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37872.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1172	82073b361870baaa466f9713ae3e59f0N.exe
2892	Unicorn-55380.exe
2836	Unicorn-51187.exe
2240	Unicorn-4679.exe
3020	Unicorn-16460.exe
3064	Unicorn-4762.exe
2736	Unicorn-30941.exe
2796	Unicorn-63522.exe
1352	Unicorn-42308.exe
1200	Unicorn-38778.exe
1980	Unicorn-14103.exe
1496	Unicorn-60901.exe
948	Unicorn-20225.exe
2136	Unicorn-61166.exe
1996	Unicorn-10019.exe
2064	Unicorn-41300.exe
760	Unicorn-26019.exe
2196	Unicorn-49132.exe
2316	Unicorn-44969.exe
2348	Unicorn-16289.exe
2776	Unicorn-40985.exe
2664	Unicorn-28084.exe
896	Unicorn-22873.exe
596	Unicorn-46823.exe
800	Unicorn-28349.exe
1408	Unicorn-16651.exe
1640	Unicorn-36517.exe
2936	Unicorn-10066.exe
1704	Unicorn-55738.exe
2680	Unicorn-12104.exe
1712	Unicorn-18235.exe
1216	Unicorn-17472.exe
884	Unicorn-35.exe
2080	Unicorn-39676.exe
3024	Unicorn-14160.exe
1572	Unicorn-32900.exe
2332	Unicorn-45152.exe
2224	Unicorn-38738.exe
2864	Unicorn-10704.exe
2860	Unicorn-18872.exe
3032	Unicorn-5965.exe
2876	Unicorn-10149.exe
2784	Unicorn-52942.exe
2092	Unicorn-419.exe
2548	Unicorn-64010.exe
2764	Unicorn-58343.exe
2468	Unicorn-29200.exe
2132	Unicorn-21586.exe
2924	Unicorn-41452.exe
2288	Unicorn-511.exe
1288	Unicorn-51466.exe
2900	Unicorn-41814.exe
2940	Unicorn-4311.exe
2540	Unicorn-39122.exe
2888	Unicorn-4311.exe
1728	Unicorn-64995.exe
2300	Unicorn-32827.exe
2428	Unicorn-17310.exe
2116	Unicorn-41260.exe
1608	Unicorn-33646.exe
2448	Unicorn-27446.exe
1512	Unicorn-37652.exe
1708	Unicorn-38136.exe
1528	Unicorn-18270.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 2892	1172	82073b361870baaa466f9713ae3e59f0N.exe	30
PID 1172 wrote to memory of 2892	1172	82073b361870baaa466f9713ae3e59f0N.exe	30
PID 1172 wrote to memory of 2892	1172	82073b361870baaa466f9713ae3e59f0N.exe	30
PID 1172 wrote to memory of 2892	1172	82073b361870baaa466f9713ae3e59f0N.exe	30
PID 2892 wrote to memory of 2836	2892	Unicorn-55380.exe	31
PID 2892 wrote to memory of 2836	2892	Unicorn-55380.exe	31
PID 2892 wrote to memory of 2836	2892	Unicorn-55380.exe	31
PID 2892 wrote to memory of 2836	2892	Unicorn-55380.exe	31
PID 1172 wrote to memory of 2240	1172	82073b361870baaa466f9713ae3e59f0N.exe	32
PID 1172 wrote to memory of 2240	1172	82073b361870baaa466f9713ae3e59f0N.exe	32
PID 1172 wrote to memory of 2240	1172	82073b361870baaa466f9713ae3e59f0N.exe	32
PID 1172 wrote to memory of 2240	1172	82073b361870baaa466f9713ae3e59f0N.exe	32
PID 2836 wrote to memory of 3020	2836	Unicorn-51187.exe	33
PID 2836 wrote to memory of 3020	2836	Unicorn-51187.exe	33
PID 2836 wrote to memory of 3020	2836	Unicorn-51187.exe	33
PID 2836 wrote to memory of 3020	2836	Unicorn-51187.exe	33
PID 2892 wrote to memory of 3064	2892	Unicorn-55380.exe	34
PID 2892 wrote to memory of 3064	2892	Unicorn-55380.exe	34
PID 2892 wrote to memory of 3064	2892	Unicorn-55380.exe	34
PID 2892 wrote to memory of 3064	2892	Unicorn-55380.exe	34
PID 2240 wrote to memory of 2796	2240	Unicorn-4679.exe	35
PID 2240 wrote to memory of 2796	2240	Unicorn-4679.exe	35
PID 2240 wrote to memory of 2796	2240	Unicorn-4679.exe	35
PID 2240 wrote to memory of 2796	2240	Unicorn-4679.exe	35
PID 1172 wrote to memory of 2736	1172	82073b361870baaa466f9713ae3e59f0N.exe	36
PID 1172 wrote to memory of 2736	1172	82073b361870baaa466f9713ae3e59f0N.exe	36
PID 1172 wrote to memory of 2736	1172	82073b361870baaa466f9713ae3e59f0N.exe	36
PID 1172 wrote to memory of 2736	1172	82073b361870baaa466f9713ae3e59f0N.exe	36
PID 3020 wrote to memory of 1352	3020	Unicorn-16460.exe	37
PID 3020 wrote to memory of 1352	3020	Unicorn-16460.exe	37
PID 3020 wrote to memory of 1352	3020	Unicorn-16460.exe	37
PID 3020 wrote to memory of 1352	3020	Unicorn-16460.exe	37
PID 2836 wrote to memory of 1200	2836	Unicorn-51187.exe	38
PID 2836 wrote to memory of 1200	2836	Unicorn-51187.exe	38
PID 2836 wrote to memory of 1200	2836	Unicorn-51187.exe	38
PID 2836 wrote to memory of 1200	2836	Unicorn-51187.exe	38
PID 2796 wrote to memory of 1996	2796	Unicorn-63522.exe	39
PID 2796 wrote to memory of 1996	2796	Unicorn-63522.exe	39
PID 2796 wrote to memory of 1996	2796	Unicorn-63522.exe	39
PID 2796 wrote to memory of 1996	2796	Unicorn-63522.exe	39
PID 2736 wrote to memory of 1980	2736	Unicorn-30941.exe	40
PID 2736 wrote to memory of 1980	2736	Unicorn-30941.exe	40
PID 2736 wrote to memory of 1980	2736	Unicorn-30941.exe	40
PID 2736 wrote to memory of 1980	2736	Unicorn-30941.exe	40
PID 1172 wrote to memory of 1496	1172	82073b361870baaa466f9713ae3e59f0N.exe	42
PID 1172 wrote to memory of 1496	1172	82073b361870baaa466f9713ae3e59f0N.exe	42
PID 1172 wrote to memory of 1496	1172	82073b361870baaa466f9713ae3e59f0N.exe	42
PID 1172 wrote to memory of 1496	1172	82073b361870baaa466f9713ae3e59f0N.exe	42
PID 2240 wrote to memory of 2064	2240	Unicorn-4679.exe	41
PID 2240 wrote to memory of 2064	2240	Unicorn-4679.exe	41
PID 2240 wrote to memory of 2064	2240	Unicorn-4679.exe	41
PID 2240 wrote to memory of 2064	2240	Unicorn-4679.exe	41
PID 3064 wrote to memory of 2136	3064	Unicorn-4762.exe	43
PID 3064 wrote to memory of 2136	3064	Unicorn-4762.exe	43
PID 3064 wrote to memory of 2136	3064	Unicorn-4762.exe	43
PID 3064 wrote to memory of 2136	3064	Unicorn-4762.exe	43
PID 2892 wrote to memory of 948	2892	Unicorn-55380.exe	44
PID 2892 wrote to memory of 948	2892	Unicorn-55380.exe	44
PID 2892 wrote to memory of 948	2892	Unicorn-55380.exe	44
PID 2892 wrote to memory of 948	2892	Unicorn-55380.exe	44
PID 1352 wrote to memory of 760	1352	Unicorn-42308.exe	45
PID 1352 wrote to memory of 760	1352	Unicorn-42308.exe	45
PID 1352 wrote to memory of 760	1352	Unicorn-42308.exe	45
PID 1352 wrote to memory of 760	1352	Unicorn-42308.exe	45

C:\Users\Admin\AppData\Local\Temp\82073b361870baaa466f9713ae3e59f0N.exe
"C:\Users\Admin\AppData\Local\Temp\82073b361870baaa466f9713ae3e59f0N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55380.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55380.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51187.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51187.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16460.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42308.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26019.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48250.exe
        8⤵
        Executes dropped EXE
        
        PID:340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50575.exe
        9⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49043.exe
        9⤵
        
        PID:344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        9⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1545.exe
        8⤵
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57159.exe
        8⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37249.exe
        8⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3062.exe
        8⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18270.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43585.exe
        8⤵
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23304.exe
        8⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2027.exe
        8⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        8⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62535.exe
        7⤵
        
        PID:1292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42905.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7395.exe
        7⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21337.exe
        7⤵
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39676.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38136.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58914.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44331.exe
        8⤵
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51447.exe
        8⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37872.exe
        8⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25966.exe
        7⤵
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
        7⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        7⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14557.exe
        7⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40174.exe
        6⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60222.exe
        7⤵
        
        PID:868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23304.exe
        7⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2027.exe
        7⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19895.exe
        7⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31048.exe
        7⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6672.exe
        6⤵
        
        PID:1876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34239.exe
        6⤵
        
        PID:3492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56397.exe
        6⤵
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38403.exe
        6⤵
        
        PID:5544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49132.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38738.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50196.exe
        7⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25028.exe
        8⤵
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23304.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10195.exe
        9⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19895.exe
        9⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        8⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24051.exe
        8⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63107.exe
        7⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
        7⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16060.exe
        7⤵
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37872.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12432.exe
        6⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        7⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8037.exe
        7⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11230.exe
        7⤵
        
        PID:5132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
        6⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50767.exe
        7⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
        7⤵
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40673.exe
        7⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60315.exe
        6⤵
        
        PID:1112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9334.exe
        6⤵
        
        PID:4920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38403.exe
        6⤵
        
        PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5965.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63024.exe
        6⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4176.exe
        7⤵
        
        PID:444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23304.exe
        8⤵
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10195.exe
        8⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64105.exe
        8⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
        7⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7892.exe
        7⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11230.exe
        7⤵
        
        PID:6048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18929.exe
        6⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50274.exe
        7⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19163.exe
        7⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40673.exe
        7⤵
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3303.exe
        6⤵
        
        PID:2128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65406.exe
        6⤵
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11230.exe
        6⤵
        
        PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13558.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23741.exe
        6⤵
        
        PID:2972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe
        6⤵
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40673.exe
        6⤵
        
        PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27254.exe
        5⤵
        
        PID:2716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5395.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7676.exe
        5⤵
        
        PID:5340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38778.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16289.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65333.exe
        6⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56392.exe
        7⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
        7⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        7⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54778.exe
        7⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29011.exe
        6⤵
        
        PID:2020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42905.exe
        6⤵
        
        PID:3444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7395.exe
        6⤵
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21337.exe
        6⤵
        
        PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10704.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55925.exe
        6⤵
        
        PID:776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50959.exe
        7⤵
        
        PID:336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
        7⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14030.exe
        7⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10097.exe
        6⤵
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32898.exe
        6⤵
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        6⤵
        
        PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56702.exe
        5⤵
        
        PID:2528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17602.exe
        6⤵
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14030.exe
        6⤵
        
        PID:6092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50694.exe
        5⤵
        
        PID:976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60825.exe
        5⤵
        
        PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21337.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44969.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32900.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36382.exe
        6⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42577.exe
        7⤵
        
        PID:580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50361.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        7⤵
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54778.exe
        7⤵
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40356.exe
        6⤵
        
        PID:2532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
        6⤵
        
        PID:4116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        6⤵
        
        PID:5112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54778.exe
        6⤵
        
        PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61445.exe
        5⤵
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11488.exe
        6⤵
        
        PID:1368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54820.exe
        6⤵
        
        PID:4596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7233.exe
        6⤵
        
        PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13361.exe
        5⤵
        
        PID:1168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9334.exe
        5⤵
        
        PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38403.exe
        5⤵
        
        PID:5452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14160.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31722.exe
        5⤵
        
        PID:376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23741.exe
        6⤵
        
        PID:2728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40673.exe
        6⤵
        
        PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38877.exe
        5⤵
        
        PID:404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44602.exe
        5⤵
        
        PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37872.exe
        5⤵
        
        PID:5600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4317.exe
      4⤵
      PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32485.exe
        5⤵
        
        PID:532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
        5⤵
        
        PID:4988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40673.exe
        5⤵
        
        PID:5844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27247.exe
      4⤵
      PID:2068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22429.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9337.exe
      4⤵
      PID:4292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11537.exe
      4⤵
      PID:5820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4762.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4762.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61166.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28349.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41452.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2038.exe
        7⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23304.exe
        8⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10195.exe
        8⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64105.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24051.exe
        7⤵
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56070.exe
        6⤵
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7103.exe
        7⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
        7⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7233.exe
        7⤵
        
        PID:1472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58918.exe
        6⤵
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25869.exe
        6⤵
        
        PID:4896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21337.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41814.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29667.exe
        6⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9433.exe
        7⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40673.exe
        7⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32546.exe
        6⤵
        
        PID:2096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59541.exe
        6⤵
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        6⤵
        
        PID:5884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49987.exe
        5⤵
        
        PID:2056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11872.exe
        6⤵
        
        PID:536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
        6⤵
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40673.exe
        6⤵
        
        PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17704.exe
        5⤵
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7925.exe
        5⤵
        
        PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16872.exe
        5⤵
        
        PID:5584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16651.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36059.exe
        5⤵
        
        PID:2724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38323.exe
        6⤵
        
        PID:2992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39396.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33137.exe
        6⤵
        
        PID:4192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        6⤵
        
        PID:5868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65057.exe
        5⤵
        
        PID:2124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20102.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30337.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21337.exe
        5⤵
        
        PID:5852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51466.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2038.exe
        5⤵
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27389.exe
        6⤵
        
        PID:3260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14887.exe
        6⤵
        
        PID:4592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14030.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7523.exe
        5⤵
        
        PID:3148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28622.exe
        5⤵
        
        PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64105.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44686.exe
      4⤵
      PID:2308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17704.exe
      4⤵
      PID:3220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65294.exe
      4⤵
      PID:4172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16872.exe
      4⤵
      PID:5476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20225.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20225.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46823.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29200.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6869.exe
        5⤵
        
        PID:1524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27389.exe
        6⤵
        
        PID:3292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14887.exe
        6⤵
        
        PID:4624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7233.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21258.exe
        5⤵
        
        PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61130.exe
        5⤵
        
        PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50136.exe
        5⤵
        
        PID:6620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21586.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33559.exe
        5⤵
        
        PID:1768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3320.exe
        6⤵
        
        PID:2108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28369.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33137.exe
        6⤵
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        6⤵
        
        PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16319.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63625.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15811.exe
        5⤵
        
        PID:5352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23920.exe
      4⤵
      PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
        5⤵
        
        PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1862.exe
        5⤵
        
        PID:1084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47569.exe
        5⤵
        
        PID:5248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29973.exe
      4⤵
      PID:3392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30098.exe
      4⤵
      PID:4980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21337.exe
      4⤵
      PID:5876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28084.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28084.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10149.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        5⤵
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64581.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5899.exe
        6⤵
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63782.exe
        6⤵
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40587.exe
        6⤵
        
        PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22541.exe
        5⤵
        
        PID:2872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53132.exe
        5⤵
        
        PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39003.exe
        5⤵
        
        PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37872.exe
        5⤵
        
        PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19915.exe
      4⤵
      PID:1796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19548.exe
        5⤵
        
        PID:3236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
        5⤵
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7233.exe
        5⤵
        
        PID:5184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42691.exe
      4⤵
      PID:2004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38764.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37872.exe
      4⤵
      PID:5576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52942.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52942.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53616.exe
      4⤵
      PID:1972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23304.exe
      4⤵
      PID:3500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10195.exe
      4⤵
      PID:2512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19895.exe
      4⤵
      PID:1420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28150.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28150.exe
    3⤵
    PID:2296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34770.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34770.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51931.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51931.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11537.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11537.exe
    3⤵
    PID:5484
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4679.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4679.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63522.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63522.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10019.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36517.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-419.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33559.exe
        7⤵
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27389.exe
        8⤵
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14887.exe
        8⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7233.exe
        8⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36438.exe
        7⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34535.exe
        7⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37872.exe
        7⤵
        
        PID:5836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10185.exe
        6⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8499.exe
        7⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23304.exe
        7⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2027.exe
        7⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        7⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27065.exe
        6⤵
        
        PID:3060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42905.exe
        6⤵
        
        PID:3532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7395.exe
        6⤵
        
        PID:4588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21337.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58343.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2832.exe
        6⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58442.exe
        7⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
        7⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40673.exe
        7⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36438.exe
        6⤵
        
        PID:3156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2172.exe
        6⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19895.exe
        6⤵
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64761.exe
        5⤵
        
        PID:1552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27389.exe
        6⤵
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41529.exe
        6⤵
        
        PID:4652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14030.exe
        6⤵
        
        PID:6084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8976.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56741.exe
        5⤵
        
        PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60232.exe
        5⤵
        
        PID:5164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55738.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27446.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42577.exe
        6⤵
        
        PID:1944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10589.exe
        6⤵
        
        PID:4200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22283.exe
        6⤵
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11230.exe
        6⤵
        
        PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7112.exe
        5⤵
        
        PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50196.exe
        5⤵
        
        PID:4224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42782.exe
        5⤵
        
        PID:4732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52064.exe
        5⤵
        
        PID:5292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37652.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33750.exe
        5⤵
        
        PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
        5⤵
        
        PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16060.exe
        5⤵
        
        PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46425.exe
        5⤵
        
        PID:5256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32308.exe
      4⤵
      PID:3044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58115.exe
        5⤵
        
        PID:3356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14887.exe
        5⤵
        
        PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14030.exe
        5⤵
        
        PID:6100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18458.exe
      4⤵
      PID:3096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9287.exe
      4⤵
      PID:4556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11760.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41300.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41300.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10066.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4311.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13605.exe
        6⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33767.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10850.exe
        7⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40673.exe
        7⤵
        
        PID:5500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17985.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24585.exe
        6⤵
        
        PID:1088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19895.exe
        6⤵
        
        PID:5212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4590.exe
        5⤵
        
        PID:2720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42905.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64764.exe
        5⤵
        
        PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21337.exe
        5⤵
        
        PID:5860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17310.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29065.exe
        5⤵
        
        PID:2184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63772.exe
        6⤵
        
        PID:4452
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 212
        6⤵
        Program crash
        
        PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
        5⤵
        
        PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        5⤵
        
        PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24051.exe
        5⤵
        
        PID:5336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64844.exe
      4⤵
      PID:2684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19450.exe
        5⤵
        
        PID:6528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50030.exe
      4⤵
      PID:3388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52465.exe
      4⤵
      PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60232.exe
      4⤵
      PID:6068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12104.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12104.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4311.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56392.exe
        5⤵
        
        PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
        5⤵
        
        PID:3076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16060.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37872.exe
        5⤵
        
        PID:5616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31232.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42905.exe
      4⤵
      PID:3416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64764.exe
      4⤵
      PID:4252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21337.exe
      4⤵
      PID:5508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32827.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32827.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58447.exe
      4⤵
      PID:548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58442.exe
        5⤵
        
        PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
        5⤵
        
        PID:3540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16060.exe
        5⤵
        
        PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37872.exe
        5⤵
        
        PID:5592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35068.exe
      4⤵
      PID:3552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16060.exe
      4⤵
      PID:4548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11230.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58645.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58645.exe
    3⤵
    PID:2952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50959.exe
      4⤵
      PID:696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49890.exe
      4⤵
      PID:4212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40673.exe
      4⤵
      PID:5764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15379.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15379.exe
    3⤵
    PID:1960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30629.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30629.exe
    3⤵
    PID:4156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43991.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43991.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6004
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30941.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30941.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14103.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14103.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40985.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45152.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56226.exe
        6⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33750.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
        7⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7892.exe
        7⤵
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37872.exe
        7⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47710.exe
        6⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27389.exe
        7⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14887.exe
        7⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14030.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21258.exe
        6⤵
        
        PID:3136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26320.exe
        6⤵
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37872.exe
        6⤵
        
        PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30330.exe
        5⤵
        
        PID:1956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60476.exe
        6⤵
        
        PID:528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
        6⤵
        
        PID:3616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16060.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37872.exe
        6⤵
        
        PID:5828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2369.exe
        5⤵
        
        PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42905.exe
        5⤵
        
        PID:3516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7395.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64635.exe
        5⤵
        
        PID:5724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18872.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57679.exe
        5⤵
        
        PID:2476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3704.exe
        6⤵
        
        PID:2848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
        6⤵
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7233.exe
        6⤵
        
        PID:6028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12619.exe
        5⤵
        
        PID:2000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54778.exe
        5⤵
        
        PID:5496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14792.exe
      4⤵
      PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58442.exe
        5⤵
        
        PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
        5⤵
        
        PID:5084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14030.exe
        5⤵
        
        PID:6076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61000.exe
      4⤵
      PID:2400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21930.exe
      4⤵
      PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21337.exe
      4⤵
      PID:5384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22873.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22873.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64010.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2548
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 236
        5⤵
        Program crash
        
        PID:2304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23999.exe
      4⤵
      PID:2324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1649.exe
        5⤵
        
        PID:3592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45505.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14030.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3303.exe
      4⤵
      PID:3084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65406.exe
      4⤵
      PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50136.exe
      4⤵
      PID:6612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-511.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-511.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58447.exe
      4⤵
      PID:2436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27389.exe
        5⤵
        
        PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39360.exe
        5⤵
        
        PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19895.exe
        5⤵
        
        PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30792.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32898.exe
      4⤵
      PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
      4⤵
      PID:5536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1773.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48821.exe
      4⤵
      PID:1644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2027.exe
      4⤵
      PID:4956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
      4⤵
      PID:5520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37259.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37259.exe
    3⤵
    PID:1020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40205.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40205.exe
    3⤵
    PID:4868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38403.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38403.exe
    3⤵
    PID:5900
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60901.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60901.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18235.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18235.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41260.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29065.exe
        5⤵
        
        PID:2160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27389.exe
        6⤵
        
        PID:3224
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 212
        6⤵
        Program crash
        
        PID:4320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7523.exe
        5⤵
        
        PID:3144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28622.exe
        5⤵
        
        PID:4572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19895.exe
        5⤵
        
        PID:5188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33750.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16060.exe
      4⤵
      PID:4492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7146.exe
      4⤵
      PID:5312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33646.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33646.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25604.exe
      4⤵
      PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27389.exe
        5⤵
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39360.exe
        5⤵
        
        PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64105.exe
        5⤵
        
        PID:5180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
      4⤵
      PID:3580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
      4⤵
      PID:4344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24051.exe
      4⤵
      PID:5324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58176.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58176.exe
    3⤵
    PID:1068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58401.exe
      4⤵
      PID:4364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21483.exe
      4⤵
      PID:5680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42905.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42905.exe
    3⤵
    PID:3104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64764.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64764.exe
    3⤵
    PID:4948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21337.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21337.exe
    3⤵
    PID:5412
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17472.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17472.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39122.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39122.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45811.exe
      4⤵
      PID:844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17602.exe
        5⤵
        
        PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
        5⤵
        
        PID:4996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7233.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26324.exe
      4⤵
      PID:2416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32898.exe
      4⤵
      PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
      4⤵
      PID:5436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9609.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9609.exe
    3⤵
    PID:2452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43886.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13611.exe
        5⤵
        
        PID:6632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23304.exe
      4⤵
      PID:3508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10195.exe
      4⤵
      PID:4728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19895.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31725.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31725.exe
    3⤵
    PID:2016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42905.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42905.exe
    3⤵
    PID:3612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64764.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64764.exe
    3⤵
    PID:352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21337.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21337.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5712
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64995.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64995.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4970.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4970.exe
    3⤵
    PID:2524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36569.exe
      4⤵
      PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40673.exe
      4⤵
      PID:5640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28955.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28955.exe
    3⤵
    PID:2804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59541.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59541.exe
    3⤵
    PID:4924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5428
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60161.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60161.exe
  2⤵
  PID:264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7679.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7679.exe
    3⤵
    PID:3472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
    3⤵
    PID:5092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14030.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14030.exe
    3⤵
    PID:6132
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65460.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65460.exe
  2⤵
  PID:3040
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30405.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30405.exe
  2⤵
  PID:4844
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54631.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54631.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12104.exe

Filesize
468KB

MD5
412915cb6e9a8616358681f98051099e

SHA1
f53784e88e03d8c48e0b8aae75f199d9d53b1211

SHA256
7aef3fe7f79c7c7f4c7e97dddc4f297426b79fc1d17ce061001dd4c431e1c19c

SHA512
e188af27672babb195feafb4dfbda00fa72b5daf926b2035cb4ef1ed289045475dea93e45d8529015cb922bccb21524f0ce556a8615fd5055b2985ba32f302a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20225.exe

Filesize
468KB

MD5
6738a0808fd67b3e79673996a9d0e274

SHA1
44ae9498f0dfc337bd065823967172c456b8e44b

SHA256
3fc1a2f57dcaa90f3127c95d634e79b3339e2fc72cc8eaa3cfca9569bc982d86

SHA512
f5bc8eccb408203dff928286a9447eb3892e63bd4d296d4ffc237fe4ed81cb50a6ad0feba2fcda8bd3f0740a32c13d9480cdb648f796cacb70b93cb53378e243

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39676.exe

Filesize
468KB

MD5
0279cd36b040ed4f83dda072cc687628

SHA1
2322ee2ac89d69c607b0197ff315cd555db7943c

SHA256
cb640303792db0c5f72a8f17dd512525cad9b2c5960088be9b48801f4282e180

SHA512
0e89c45f2904a8bab5e0b4a0e6563c5c1d64764a8e160adc16267c87daa76abf35f281d1891decc212ab79326fb7aa3f29c43a80ec36086dc48d11d225caf6df

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41300.exe

Filesize
468KB

MD5
ab354244aa062d27a7497cbdc6bd5ad4

SHA1
d6ecdd12226e608aba39bf97576988f848ff7559

SHA256
6f6ca9f7955b71893cb1f568b0be2d8a4b3b6b2f185dfa63932209cac8d38b7d

SHA512
b3f40d02bdd8ca5bc1c08c62b90f83f7eeff9498fa229575d0a96abd5496ea3f72698fdac6558a4141c9dd41b779e4e70cd82ae5540a918463ccc66c50f314e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4762.exe

Filesize
468KB

MD5
eb3b45ad7e076d6cf06e686a1ec2c51a

SHA1
12dba3f9f06cb7f8f34c75b1687e2fe5a9f3aa1b

SHA256
4bc135c6eabec53b2cbc7840e4d78b3eba8cb7a5b3c16aece8a14c2da78539f3

SHA512
265b02273309664528f0f12c587882fde5410b1491da8d2d8985dee68d0c2196ff0828658ba4012f6c270a5ac0dc2931e9ae56b27acb52f4cc54bcf63d0b266a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5395.exe

Filesize
468KB

MD5
b034bb765d9473276f30619e5e3ea595

SHA1
35c24dd9a3619e99ae2a508178e664002d844712

SHA256
4839d66baa534e1c26c1a8d298f2eb11af226ecfa4ba1e0b4e05e5529d6c667c

SHA512
2693f303ae91a0fed68c49f29a46d48e15ef185fef0b39bbbd7b9e8d1cb204932b99a5a1c0261f69414b8d449f356a8e8cb747bf3a5b042fa40eb2342b90d12b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60901.exe

Filesize
468KB

MD5
a5e55110db564074b948530bda1a1786

SHA1
19f26d8a6834682c7cf4082066858f1ac0799985

SHA256
2edfc713ebbe5840333c873764fcb2850ef81a6442be21e14f546e0e62760153

SHA512
b95dafde8195b6eeb6a83bbbb106ebd557aaa685fbaf557c092a9a1ec29afa6ca9a67ff3b06fd58db9b3ca1a06a6e2965f5760227c40ecfbefe80fdf323e0c4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61166.exe

Filesize
468KB

MD5
05b8f8248fe8d0bc31fbd1457d61c57a

SHA1
7cde68c43edff99dcdc0e4a18dea96cac6eb16e6

SHA256
8ef6647e8f7cad1b422721364103894c6d9020a18a99c2973b2c3ece5205cbfa

SHA512
346bc899ac6b2cff6bac45fe5f0c29b7ccc2e03566f374b6918da2234b97758d62ebf50f231f1ce17d6e3fb23aac0a60f525caa6ce8dbeb4c910b7ceed634551

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-10019.exe

Filesize
468KB

MD5
f33c13976f6ca678e243a299bf97718f

SHA1
0e53a360cefc485bc0b1cdbd10fd8c8e7833d319

SHA256
d22b42bd19b0c9b15e7e00c17bc275f4ac7de63fc8dc82c0f11f5a805e9b2df9

SHA512
f9dc78921cdc837535cc7fa99ab4938b73aba1b821d05a4049fab7746277353ecf800a507a41898ca348fd3ab0206ea264da354707aad2ff6518cb50a8ccc7a0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14103.exe

Filesize
468KB

MD5
df9c63ecee45dc0fc11fd782f6314bd8

SHA1
aca742574fb55549e906887e465e671382a4566f

SHA256
0512e6180e707e4f50644d9d6b14a8b76ddb16129276655c64c7ae75888fbfbd

SHA512
2efb63f6bd73b989ee006d4ffb0538a15eedced7b10a6de55574816205ad586d95e1cd3bb73d65c3a2660f3b24f21105d59f1e83d81b038f964ab23b5fdc1e19

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16289.exe

Filesize
468KB

MD5
ce5f94ecb9420570996fb293cf5b6e64

SHA1
21bc310667cf69cc16d906e26d672f5dc0e1130c

SHA256
4ce65fb080707f8ccaaff26b6e0f6152e6802e15cd88fe1c50ef04debd21ced7

SHA512
4231b8256f452a51d0424b28974f90bcd09b4ece4428adbd9d6a3930d480bb30a1a0e2c8885b03b0272d9defc932906bb96bc20c5eca74e1aea0b3c04d94c911

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16460.exe

Filesize
468KB

MD5
fcebeb8656580724940e1f5ca248c50b

SHA1
853a91e5e0de1fd7e7acf27e11b883a95829b5c8

SHA256
6e34dc18279a722e9de1c53a31f13ca8ea780245244ff2a2c36fda76d6341992

SHA512
71a4ed442fa46eac67102d31ad02b066b9ef65325832cf2c84762cbaa8427b8c1c647cf8c06a58216ed8b5048346613ab2e1161ad4783f473077e891422783fd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26019.exe

Filesize
468KB

MD5
7cd590ba1eb052829eb89d79cc8c46eb

SHA1
488c0b5801d98b7232e0ffa09158c86c60f93635

SHA256
fb78aab46d879c8b44ff21813c37bfc9a295ff9735098dd48cc873dec3fd9f12

SHA512
5ddbfb60e5cdeabcbf40bc8b3b8c5029adeba505e54769fad8f41150c2413a31839d925ac633709d657e2bd49d57bb810264c42fd3074e6db38344907a855506

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-30941.exe

Filesize
468KB

MD5
9adfb699a08d7b5bc7d6b1c4f70e58af

SHA1
e5854470cb44682cfb41df04e75ef12de52e4d50

SHA256
b13ef66895ef89fff560e5a2c5e79ee7feefd37da056bed33299e48cfaa4ec3d

SHA512
1526d4c91c96e9bfc4fb16228776ca7b107b6939f1ed4bd619fcb9368eef1c253b1b2193bdd68f4677a2c8fd838aa06bcbf4f67820fadc163022e0663a81ad4c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38778.exe

Filesize
468KB

MD5
3e56d0272835cc058fd2debc6dcea91d

SHA1
37f20a6125b12f45fa362b0f2c9ebbf8ba947fa9

SHA256
5eebbaab7869850b343eba621934272ecbbed5e1a61f81058f59d3b8c8457963

SHA512
a4c9b2dfb1b6375e31cd7496f3bfeeeddba8eb4efe8b14374ebee31655719a6180791197e7df8e1cca7b736317cce22b0a15abbd2375043e11ac44de0c10e6fa

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42308.exe

Filesize
468KB

MD5
75712c8b9b8236de33194c1b4f700128

SHA1
4e1f8e4872cc2b18d6bc2f2b0e24eac7ce592ea2

SHA256
f0734ff6980b8abf178761182e180e6aec0b8f648557bcb521215cf7dfeebf73

SHA512
2a201e049f47bb5d54e406a1b1ed92dc9c45c7f6d8978417c7e422ed898a5b1a4185315f84c1837ab9e55d3514f5022dd9383e9b83347089d5f60c9f8da19c5b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-44969.exe

Filesize
468KB

MD5
b057dd687ee58af7b92d0b8f5ade54a4

SHA1
03ce05e7965b346b62f315b0716e210a0eb8fea2

SHA256
a2386ff8402171f1e9acd70696dfdf3af3bfb1f3581eddc75060ff420ae0838d

SHA512
a6486deceafe30c5dc563d1134dcffbe7bf68b0d90f785e85a9c5fc3cfe0674359da60db6c8d848d8d1a31a9bd6a6cb76f3ad36370254fa549d5aef01b8cc258

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4679.exe

Filesize
468KB

MD5
500015352028c2f8857a7a6cacd5f703

SHA1
d417e9ebaef7739e53b29213a0e36281d14f1347

SHA256
f423d1b2d48b3fdf2b6c3cb368e7fd9440a3ff0ed7de49dad9b2d5d03c84d6ff

SHA512
88c9c6f85bef542a7800ef15500c5f833527b5d65ad54541d0b19dda0d4122f2f923f3e726f7fc42dfdf819ce145ed9995236b6dc8fb3b1bfd853eddd34b8a32

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49132.exe

Filesize
468KB

MD5
b89d8fcfc32a3c5e6fc652ad661f7f58

SHA1
e582ef67ae20efcc056c0b40eb4ee0de5a35c507

SHA256
5a24a77a9e0be8760da29aa549d628f4d522cc26cd59e85ffc81be0f4efa4aee

SHA512
18fc4dd1315bfab9a73fafcb9ec14ae14d378b655d5c3cc5e2475046b88b7c6c42084a9ff7e6d3f6b0f5e71c831a3596fcf7c0e9845912bb720fc4d588125cc8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51187.exe

Filesize
468KB

MD5
b8cc70a8fdd2273d13a1c82e463bf229

SHA1
8894e7dfdcfecad5161f2f8fc9f0f44ff85504ae

SHA256
8b4382ca068316cb05239fe1c2801ef471e89c22fccf6046f4f61959fe4d61e0

SHA512
5a1ef75679f4455a13e5743c2e38f90be88ef298f7cd3665fe1f15819ed3df7afe82a9f5a33343ce982dc0abb13915ab945491bdee66a3ea3f4787a14de98150

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55380.exe

Filesize
468KB

MD5
49787f23f17c56564150faf6816113ca

SHA1
d0bade5c31d4bba150b751f6984a2f4cb15cd95a

SHA256
b648a33e11e7b7cb2660f1caf6aa17c1e001bc86349f0ded1af74bdb1d773beb

SHA512
98cc7536747828cb1d4c56e50d4de4920a9f8c40de3eee4bc790e44c7ae0d38bdce9e2649dba6022642adc718b2f1a56066859d9f95b4bcc16e3f0a129c27cac

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63522.exe

Filesize
468KB

MD5
4e0a8e1a219af642f34f985df0bfae90

SHA1
e2d48fdd7b3561d6e047262b9ca8d4f201b9efaa

SHA256
4bc9d91fa11bb8a4865c9e0629c526feecccc1dc14115e2d79940f4603e2e778

SHA512
748f155c58cc7ccede2f66f108f3565c29949b07e6a29ce88702a7d2132c1484ba2a38bc2e51130f6447c1722b2979716f40d3dd8687aad3624bcc96c5588e89

Download Submit