70f157ebbd4f1d85c656cce339f3fbae1b316835596c1500352fc58c8335df2c

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 02:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

20e827d5f7cff0111c4dd752b05d43b0N.exe
Size

468KB
MD5

20e827d5f7cff0111c4dd752b05d43b0
SHA1

dbbfde9a3cdecdab5dcda8abcd9391b83c764083
SHA256

70f157ebbd4f1d85c656cce339f3fbae1b316835596c1500352fc58c8335df2c
SHA512

9b80b704602fb5fd8a1bf98a43b0ace8a684f83e80665e93b7c1f9a34f99cca396ba41b22625e39ef3523312775beff7e7106edf802879f0db0990dc1dae51f3
SSDEEP

3072:ibzoogIdId5UtbYdPztjcfq/sCtvP3prhmHegVhtRcj8GEruGslo:ibcowbUt2PJjcf4ZfsRcQLruG

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1016	Unicorn-11298.exe
2020	Unicorn-42518.exe
2528	Unicorn-38988.exe
2896	Unicorn-5380.exe
2624	Unicorn-61659.exe
1508	Unicorn-35204.exe
3032	Unicorn-29073.exe
2568	Unicorn-25168.exe
2860	Unicorn-28566.exe
780	Unicorn-30835.exe
2680	Unicorn-25197.exe
2988	Unicorn-62033.exe
1540	Unicorn-13346.exe
1840	Unicorn-13081.exe
1412	Unicorn-13346.exe
2056	Unicorn-9781.exe
1200	Unicorn-55261.exe
1064	Unicorn-12085.exe
988	Unicorn-10278.exe
1148	Unicorn-43160.exe
1636	Unicorn-58655.exe
560	Unicorn-61992.exe
1456	Unicorn-4053.exe
1816	Unicorn-6853.exe
984	Unicorn-61608.exe
2204	Unicorn-28744.exe
1820	Unicorn-8878.exe
2908	Unicorn-61343.exe
2012	Unicorn-8494.exe
2592	Unicorn-37893.exe
1884	Unicorn-56149.exe
2752	Unicorn-36283.exe
2816	Unicorn-49963.exe
2936	Unicorn-63698.exe
2380	Unicorn-4291.exe
2616	Unicorn-3523.exe
2792	Unicorn-2874.exe
2692	Unicorn-48811.exe
2744	Unicorn-1037.exe
1380	Unicorn-18407.exe
1068	Unicorn-3798.exe
2992	Unicorn-6075.exe
3004	Unicorn-46497.exe
2252	Unicorn-45921.exe
2332	Unicorn-39791.exe
2468	Unicorn-12864.exe
2384	Unicorn-23014.exe
2996	Unicorn-26352.exe
1588	Unicorn-33949.exe
1532	Unicorn-64177.exe
1620	Unicorn-38711.exe
1596	Unicorn-41462.exe
2160	Unicorn-61136.exe
1572	Unicorn-38478.exe
2188	Unicorn-60752.exe
1492	Unicorn-60103.exe
1488	Unicorn-56647.exe
2540	Unicorn-10975.exe
2740	Unicorn-13126.exe
2212	Unicorn-60411.exe
2620	Unicorn-38586.exe
2088	Unicorn-34672.exe
2976	Unicorn-54538.exe
2852	Unicorn-50904.exe

Loads dropped DLL 64 IoCs

pid	Process
2076	20e827d5f7cff0111c4dd752b05d43b0N.exe
2076	20e827d5f7cff0111c4dd752b05d43b0N.exe
1016	Unicorn-11298.exe
1016	Unicorn-11298.exe
2076	20e827d5f7cff0111c4dd752b05d43b0N.exe
2076	20e827d5f7cff0111c4dd752b05d43b0N.exe
2020	Unicorn-42518.exe
2020	Unicorn-42518.exe
1016	Unicorn-11298.exe
1016	Unicorn-11298.exe
2076	20e827d5f7cff0111c4dd752b05d43b0N.exe
2528	Unicorn-38988.exe
2076	20e827d5f7cff0111c4dd752b05d43b0N.exe
2528	Unicorn-38988.exe
2896	Unicorn-5380.exe
2896	Unicorn-5380.exe
2020	Unicorn-42518.exe
2020	Unicorn-42518.exe
2624	Unicorn-61659.exe
2624	Unicorn-61659.exe
1016	Unicorn-11298.exe
1016	Unicorn-11298.exe
2528	Unicorn-38988.exe
1508	Unicorn-35204.exe
3032	Unicorn-29073.exe
2076	20e827d5f7cff0111c4dd752b05d43b0N.exe
2528	Unicorn-38988.exe
1508	Unicorn-35204.exe
3032	Unicorn-29073.exe
2076	20e827d5f7cff0111c4dd752b05d43b0N.exe
2568	Unicorn-25168.exe
2568	Unicorn-25168.exe
2896	Unicorn-5380.exe
2896	Unicorn-5380.exe
2860	Unicorn-28566.exe
2860	Unicorn-28566.exe
2020	Unicorn-42518.exe
2020	Unicorn-42518.exe
1840	Unicorn-13081.exe
1840	Unicorn-13081.exe
3032	Unicorn-29073.exe
3032	Unicorn-29073.exe
2528	Unicorn-38988.exe
2076	20e827d5f7cff0111c4dd752b05d43b0N.exe
2680	Unicorn-25197.exe
2680	Unicorn-25197.exe
2076	20e827d5f7cff0111c4dd752b05d43b0N.exe
2528	Unicorn-38988.exe
1540	Unicorn-13346.exe
1016	Unicorn-11298.exe
780	Unicorn-30835.exe
1508	Unicorn-35204.exe
1540	Unicorn-13346.exe
1016	Unicorn-11298.exe
780	Unicorn-30835.exe
1508	Unicorn-35204.exe
2624	Unicorn-61659.exe
2624	Unicorn-61659.exe
2056	Unicorn-9781.exe
2056	Unicorn-9781.exe
1200	Unicorn-55261.exe
2568	Unicorn-25168.exe
2568	Unicorn-25168.exe
1200	Unicorn-55261.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3496	4004	WerFault.exe	240

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12085.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3798.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27673.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53150.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40201.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55049.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3247.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7174.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9781.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55261.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13480.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13582.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48357.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54050.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8494.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13126.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1923.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57204.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51243.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18747.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18815.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29663.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62209.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46199.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33228.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46070.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62092.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43113.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19912.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44752.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23221.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56149.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39791.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57204.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9112.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8760.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16733.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47701.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61992.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54044.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11977.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63938.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46297.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19391.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62714.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30573.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27897.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8872.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54864.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28566.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20833.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1327.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2076	20e827d5f7cff0111c4dd752b05d43b0N.exe
1016	Unicorn-11298.exe
2020	Unicorn-42518.exe
2528	Unicorn-38988.exe
2896	Unicorn-5380.exe
2624	Unicorn-61659.exe
3032	Unicorn-29073.exe
1508	Unicorn-35204.exe
2568	Unicorn-25168.exe
2860	Unicorn-28566.exe
780	Unicorn-30835.exe
1840	Unicorn-13081.exe
2680	Unicorn-25197.exe
2988	Unicorn-62033.exe
1540	Unicorn-13346.exe
1412	Unicorn-13346.exe
2056	Unicorn-9781.exe
1200	Unicorn-55261.exe
1064	Unicorn-12085.exe
988	Unicorn-10278.exe
1148	Unicorn-43160.exe
1636	Unicorn-58655.exe
1456	Unicorn-4053.exe
560	Unicorn-61992.exe
1816	Unicorn-6853.exe
2204	Unicorn-28744.exe
2908	Unicorn-61343.exe
1820	Unicorn-8878.exe
984	Unicorn-61608.exe
2012	Unicorn-8494.exe
2592	Unicorn-37893.exe
1884	Unicorn-56149.exe
2752	Unicorn-36283.exe
2816	Unicorn-49963.exe
2380	Unicorn-4291.exe
2936	Unicorn-63698.exe
2616	Unicorn-3523.exe
2792	Unicorn-2874.exe
2744	Unicorn-1037.exe
2692	Unicorn-48811.exe
1380	Unicorn-18407.exe
1068	Unicorn-3798.exe
2992	Unicorn-6075.exe
3004	Unicorn-46497.exe
2996	Unicorn-26352.exe
1588	Unicorn-33949.exe
2384	Unicorn-23014.exe
2252	Unicorn-45921.exe
1620	Unicorn-38711.exe
2468	Unicorn-12864.exe
2332	Unicorn-39791.exe
1596	Unicorn-41462.exe
1532	Unicorn-64177.exe
2160	Unicorn-61136.exe
1572	Unicorn-38478.exe
2188	Unicorn-60752.exe
2540	Unicorn-10975.exe
1488	Unicorn-56647.exe
1492	Unicorn-60103.exe
2740	Unicorn-13126.exe
2212	Unicorn-60411.exe
2976	Unicorn-54538.exe
2088	Unicorn-34672.exe
2620	Unicorn-38586.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 1016	2076	20e827d5f7cff0111c4dd752b05d43b0N.exe	31
PID 2076 wrote to memory of 1016	2076	20e827d5f7cff0111c4dd752b05d43b0N.exe	31
PID 2076 wrote to memory of 1016	2076	20e827d5f7cff0111c4dd752b05d43b0N.exe	31
PID 2076 wrote to memory of 1016	2076	20e827d5f7cff0111c4dd752b05d43b0N.exe	31
PID 1016 wrote to memory of 2020	1016	Unicorn-11298.exe	32
PID 1016 wrote to memory of 2020	1016	Unicorn-11298.exe	32
PID 1016 wrote to memory of 2020	1016	Unicorn-11298.exe	32
PID 1016 wrote to memory of 2020	1016	Unicorn-11298.exe	32
PID 2076 wrote to memory of 2528	2076	20e827d5f7cff0111c4dd752b05d43b0N.exe	33
PID 2076 wrote to memory of 2528	2076	20e827d5f7cff0111c4dd752b05d43b0N.exe	33
PID 2076 wrote to memory of 2528	2076	20e827d5f7cff0111c4dd752b05d43b0N.exe	33
PID 2076 wrote to memory of 2528	2076	20e827d5f7cff0111c4dd752b05d43b0N.exe	33
PID 2020 wrote to memory of 2896	2020	Unicorn-42518.exe	34
PID 2020 wrote to memory of 2896	2020	Unicorn-42518.exe	34
PID 2020 wrote to memory of 2896	2020	Unicorn-42518.exe	34
PID 2020 wrote to memory of 2896	2020	Unicorn-42518.exe	34
PID 1016 wrote to memory of 2624	1016	Unicorn-11298.exe	35
PID 1016 wrote to memory of 2624	1016	Unicorn-11298.exe	35
PID 1016 wrote to memory of 2624	1016	Unicorn-11298.exe	35
PID 1016 wrote to memory of 2624	1016	Unicorn-11298.exe	35
PID 2076 wrote to memory of 3032	2076	20e827d5f7cff0111c4dd752b05d43b0N.exe	36
PID 2076 wrote to memory of 3032	2076	20e827d5f7cff0111c4dd752b05d43b0N.exe	36
PID 2076 wrote to memory of 3032	2076	20e827d5f7cff0111c4dd752b05d43b0N.exe	36
PID 2076 wrote to memory of 3032	2076	20e827d5f7cff0111c4dd752b05d43b0N.exe	36
PID 2528 wrote to memory of 1508	2528	Unicorn-38988.exe	37
PID 2528 wrote to memory of 1508	2528	Unicorn-38988.exe	37
PID 2528 wrote to memory of 1508	2528	Unicorn-38988.exe	37
PID 2528 wrote to memory of 1508	2528	Unicorn-38988.exe	37
PID 2896 wrote to memory of 2568	2896	Unicorn-5380.exe	38
PID 2896 wrote to memory of 2568	2896	Unicorn-5380.exe	38
PID 2896 wrote to memory of 2568	2896	Unicorn-5380.exe	38
PID 2896 wrote to memory of 2568	2896	Unicorn-5380.exe	38
PID 2020 wrote to memory of 2860	2020	Unicorn-42518.exe	39
PID 2020 wrote to memory of 2860	2020	Unicorn-42518.exe	39
PID 2020 wrote to memory of 2860	2020	Unicorn-42518.exe	39
PID 2020 wrote to memory of 2860	2020	Unicorn-42518.exe	39
PID 2624 wrote to memory of 780	2624	Unicorn-61659.exe	40
PID 2624 wrote to memory of 780	2624	Unicorn-61659.exe	40
PID 2624 wrote to memory of 780	2624	Unicorn-61659.exe	40
PID 2624 wrote to memory of 780	2624	Unicorn-61659.exe	40
PID 1016 wrote to memory of 2680	1016	Unicorn-11298.exe	41
PID 1016 wrote to memory of 2680	1016	Unicorn-11298.exe	41
PID 1016 wrote to memory of 2680	1016	Unicorn-11298.exe	41
PID 1016 wrote to memory of 2680	1016	Unicorn-11298.exe	41
PID 2528 wrote to memory of 2988	2528	Unicorn-38988.exe	42
PID 2528 wrote to memory of 2988	2528	Unicorn-38988.exe	42
PID 2528 wrote to memory of 2988	2528	Unicorn-38988.exe	42
PID 2528 wrote to memory of 2988	2528	Unicorn-38988.exe	42
PID 3032 wrote to memory of 1412	3032	Unicorn-29073.exe	43
PID 3032 wrote to memory of 1412	3032	Unicorn-29073.exe	43
PID 3032 wrote to memory of 1412	3032	Unicorn-29073.exe	43
PID 3032 wrote to memory of 1412	3032	Unicorn-29073.exe	43
PID 1508 wrote to memory of 1540	1508	Unicorn-35204.exe	44
PID 1508 wrote to memory of 1540	1508	Unicorn-35204.exe	44
PID 1508 wrote to memory of 1540	1508	Unicorn-35204.exe	44
PID 1508 wrote to memory of 1540	1508	Unicorn-35204.exe	44
PID 2076 wrote to memory of 1840	2076	20e827d5f7cff0111c4dd752b05d43b0N.exe	45
PID 2076 wrote to memory of 1840	2076	20e827d5f7cff0111c4dd752b05d43b0N.exe	45
PID 2076 wrote to memory of 1840	2076	20e827d5f7cff0111c4dd752b05d43b0N.exe	45
PID 2076 wrote to memory of 1840	2076	20e827d5f7cff0111c4dd752b05d43b0N.exe	45
PID 2568 wrote to memory of 2056	2568	Unicorn-25168.exe	46
PID 2568 wrote to memory of 2056	2568	Unicorn-25168.exe	46
PID 2568 wrote to memory of 2056	2568	Unicorn-25168.exe	46
PID 2568 wrote to memory of 2056	2568	Unicorn-25168.exe	46

C:\Users\Admin\AppData\Local\Temp\20e827d5f7cff0111c4dd752b05d43b0N.exe
"C:\Users\Admin\AppData\Local\Temp\20e827d5f7cff0111c4dd752b05d43b0N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11298.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11298.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42518.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42518.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5380.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25168.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9781.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37893.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10975.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55914.exe
        9⤵
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5108.exe
        10⤵
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14006.exe
        10⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9064.exe
        10⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5855.exe
        10⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13582.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39937.exe
        9⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
        9⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45143.exe
        9⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1923.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49078.exe
        9⤵
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28100.exe
        9⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        9⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5471.exe
        9⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20280.exe
        8⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62714.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55273.exe
        8⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29663.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13126.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-455.exe
        8⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9927.exe
        8⤵
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        8⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38336.exe
        8⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24968.exe
        7⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2420.exe
        7⤵
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37400.exe
        7⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56176.exe
        7⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36283.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28057.exe
        7⤵
        
        PID:648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        8⤵
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38445.exe
        9⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64514.exe
        9⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46199.exe
        9⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54049.exe
        8⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39999.exe
        8⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50098.exe
        8⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61466.exe
        8⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58778.exe
        7⤵
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46099.exe
        8⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56440.exe
        8⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41929.exe
        8⤵
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54864.exe
        8⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42190.exe
        7⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45864.exe
        7⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41049.exe
        7⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29663.exe
        7⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21926.exe
        6⤵
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21927.exe
        7⤵
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55049.exe
        7⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9064.exe
        7⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54864.exe
        7⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21661.exe
        6⤵
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10650.exe
        7⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43113.exe
        7⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9064.exe
        7⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54864.exe
        7⤵
        
        PID:5692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56998.exe
        6⤵
        
        PID:3304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6377.exe
        6⤵
        
        PID:4968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8048.exe
        6⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12520.exe
        6⤵
        
        PID:6164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55261.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56149.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11637.exe
        7⤵
        
        PID:1244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57204.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55049.exe
        8⤵
        
        PID:3740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        8⤵
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5471.exe
        8⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2170.exe
        7⤵
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3247.exe
        7⤵
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14929.exe
        7⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62727.exe
        7⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43468.exe
        6⤵
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57388.exe
        7⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-797.exe
        8⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50744.exe
        8⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48357.exe
        7⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40201.exe
        7⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32944.exe
        7⤵
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5046.exe
        6⤵
        
        PID:2812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16015.exe
        6⤵
        
        PID:3480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55266.exe
        6⤵
        
        PID:4316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63257.exe
        6⤵
        
        PID:5156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63698.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44715.exe
        6⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1117.exe
        7⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55049.exe
        7⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        7⤵
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38336.exe
        7⤵
        
        PID:6324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6695.exe
        6⤵
        
        PID:1404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19391.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14737.exe
        6⤵
        
        PID:5300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45143.exe
        6⤵
        
        PID:6948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16494.exe
        5⤵
        
        PID:1952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46464.exe
        6⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64838.exe
        7⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28100.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9064.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54864.exe
        7⤵
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28636.exe
        6⤵
        
        PID:3788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42403.exe
        6⤵
        
        PID:4124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30309.exe
        6⤵
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54116.exe
        6⤵
        
        PID:7136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44571.exe
        5⤵
        
        PID:348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33448.exe
        6⤵
        
        PID:3208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11977.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8872.exe
        6⤵
        
        PID:5244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54864.exe
        6⤵
        
        PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34001.exe
        5⤵
        
        PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54579.exe
        5⤵
        
        PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20541.exe
        5⤵
        
        PID:5544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34938.exe
        5⤵
        
        PID:6648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28566.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12085.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4291.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20263.exe
        7⤵
        
        PID:1168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37687.exe
        8⤵
        
        PID:808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38328.exe
        8⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54864.exe
        8⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54360.exe
        7⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3247.exe
        7⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
        7⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61274.exe
        7⤵
        
        PID:6624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42903.exe
        6⤵
        
        PID:828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24522.exe
        7⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36538.exe
        7⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54242.exe
        7⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27610.exe
        7⤵
        
        PID:6280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15132.exe
        6⤵
        
        PID:3372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45864.exe
        6⤵
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6072.exe
        6⤵
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62209.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49963.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13106.exe
        6⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10650.exe
        7⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43113.exe
        7⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43849.exe
        7⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37267.exe
        7⤵
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29020.exe
        6⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41836.exe
        6⤵
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51167.exe
        6⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12073.exe
        6⤵
        
        PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47371.exe
        5⤵
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64859.exe
        6⤵
        
        PID:3340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11977.exe
        6⤵
        
        PID:4940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8509.exe
        6⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27686.exe
        6⤵
        
        PID:6676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59202.exe
        5⤵
        
        PID:4004
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 188
        6⤵
        Program crash
        
        PID:3496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54049.exe
        5⤵
        
        PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55458.exe
        5⤵
        
        PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46729.exe
        5⤵
        
        PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10278.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3523.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30470.exe
        6⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17646.exe
        7⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55049.exe
        7⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        7⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5471.exe
        7⤵
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37530.exe
        6⤵
        
        PID:2000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1348.exe
        6⤵
        
        PID:3980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49714.exe
        6⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61466.exe
        6⤵
        
        PID:6188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24849.exe
        5⤵
        
        PID:684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-541.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56440.exe
        6⤵
        
        PID:4168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8872.exe
        6⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22191.exe
        6⤵
        
        PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53295.exe
        5⤵
        
        PID:2416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57483.exe
        5⤵
        
        PID:3220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8760.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61075.exe
        5⤵
        
        PID:6684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2874.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30573.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44179.exe
        6⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2685.exe
        7⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-892.exe
        7⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26310.exe
        7⤵
        
        PID:5988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17362.exe
        6⤵
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40240.exe
        6⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44944.exe
        6⤵
        
        PID:6636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24317.exe
        5⤵
        
        PID:3140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13191.exe
        5⤵
        
        PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12705.exe
        5⤵
        
        PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5644.exe
        5⤵
        
        PID:7112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19126.exe
      4⤵
      PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59041.exe
        5⤵
        
        PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63902.exe
        5⤵
        
        PID:3172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43849.exe
        5⤵
        
        PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4594.exe
        5⤵
        
        PID:6232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61998.exe
      4⤵
      PID:572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-510.exe
        5⤵
        
        PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26263.exe
        5⤵
        
        PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8872.exe
        5⤵
        
        PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54864.exe
        5⤵
        
        PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45644.exe
      4⤵
      PID:3448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16198.exe
      4⤵
      PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45657.exe
      4⤵
      PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50575.exe
      4⤵
      PID:5128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61659.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61659.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30835.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28744.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44715.exe
        7⤵
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60546.exe
        8⤵
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46875.exe
        8⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29048.exe
        8⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22320.exe
        8⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18781.exe
        7⤵
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3247.exe
        7⤵
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46297.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27937.exe
        7⤵
        
        PID:6880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64978.exe
        6⤵
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27246.exe
        7⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55049.exe
        7⤵
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6183.exe
        7⤵
        
        PID:7032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8937.exe
        6⤵
        
        PID:1424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1838.exe
        6⤵
        
        PID:4192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38737.exe
        6⤵
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30201.exe
        6⤵
        
        PID:6372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56647.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16760.exe
        6⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27246.exe
        7⤵
        
        PID:344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55049.exe
        7⤵
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9064.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21506.exe
        7⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13348.exe
        6⤵
        
        PID:352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36434.exe
        6⤵
        
        PID:4148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
        6⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62343.exe
        6⤵
        
        PID:6500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59062.exe
        5⤵
        
        PID:2756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57059.exe
        6⤵
        
        PID:3532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42403.exe
        6⤵
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30309.exe
        6⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54116.exe
        6⤵
        
        PID:7120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60058.exe
        5⤵
        
        PID:1696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1838.exe
        5⤵
        
        PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55074.exe
        5⤵
        
        PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61996.exe
        5⤵
        
        PID:6204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8494.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64177.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43849.exe
        6⤵
        
        PID:2628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48357.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31539.exe
        6⤵
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16799.exe
        6⤵
        
        PID:5672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40127.exe
        5⤵
        
        PID:2312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62092.exe
        5⤵
        
        PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46066.exe
        5⤵
        
        PID:1372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8819.exe
        5⤵
        
        PID:1260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38478.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19324.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48357.exe
        5⤵
        
        PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14627.exe
        5⤵
        
        PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34013.exe
        5⤵
        
        PID:5996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41363.exe
      4⤵
      PID:996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60780.exe
        5⤵
        
        PID:3500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36538.exe
        5⤵
        
        PID:4224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38975.exe
        5⤵
        
        PID:6052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5114.exe
        5⤵
        
        PID:6260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23811.exe
      4⤵
      PID:3624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22500.exe
      4⤵
      PID:4628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62236.exe
      4⤵
      PID:5908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5942.exe
      4⤵
      PID:6532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25197.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25197.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61992.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26352.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15099.exe
        6⤵
        
        PID:896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3247.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47794.exe
        6⤵
        
        PID:2032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47709.exe
        6⤵
        
        PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41087.exe
        5⤵
        
        PID:1472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4086.exe
        6⤵
        
        PID:6412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62092.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30309.exe
        5⤵
        
        PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55185.exe
        5⤵
        
        PID:7064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41462.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16733.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62627.exe
        6⤵
        
        PID:3076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9927.exe
        6⤵
        
        PID:4244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45302.exe
        6⤵
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20738.exe
        6⤵
        
        PID:6700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32477.exe
        5⤵
        
        PID:3636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39036.exe
        5⤵
        
        PID:4656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45915.exe
        5⤵
        
        PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50719.exe
        5⤵
        
        PID:7044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38585.exe
      4⤵
      PID:948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43281.exe
        5⤵
        
        PID:1400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55049.exe
        5⤵
        
        PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9064.exe
        5⤵
        
        PID:4488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5855.exe
        5⤵
        
        PID:4620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9959.exe
      4⤵
      PID:448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-447.exe
      4⤵
      PID:3392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29579.exe
      4⤵
      PID:5164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49650.exe
      4⤵
      PID:7128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61343.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61343.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45921.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2655.exe
        5⤵
        
        PID:1656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53321.exe
        6⤵
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8872.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54864.exe
        6⤵
        
        PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39409.exe
        5⤵
        
        PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56849.exe
        5⤵
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62343.exe
        5⤵
        
        PID:6564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51124.exe
      4⤵
      PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35477.exe
        5⤵
        
        PID:3548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11593.exe
        5⤵
        
        PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25592.exe
        5⤵
        
        PID:4664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27937.exe
        5⤵
        
        PID:6888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59798.exe
      4⤵
      PID:3256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31578.exe
      4⤵
      PID:4976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41433.exe
      4⤵
      PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45807.exe
      4⤵
      PID:6660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33949.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33949.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44715.exe
      4⤵
      PID:1172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17070.exe
        5⤵
        
        PID:1876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31229.exe
        5⤵
        
        PID:1772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43849.exe
        5⤵
        
        PID:5388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4594.exe
        5⤵
        
        PID:6212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6695.exe
      4⤵
      PID:1784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3247.exe
      4⤵
      PID:3720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6499.exe
      4⤵
      PID:5936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12079.exe
      4⤵
      PID:6608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56831.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56831.exe
    3⤵
    PID:1296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1726.exe
      4⤵
      PID:2688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3015.exe
        5⤵
        
        PID:3412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44338.exe
        5⤵
        
        PID:320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31401.exe
        5⤵
        
        PID:6420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48357.exe
      4⤵
      PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30123.exe
      4⤵
      PID:5608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33228.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33228.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4541.exe
      4⤵
      PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46943.exe
      4⤵
      PID:5536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48999.exe
      4⤵
      PID:5432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38291.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38291.exe
    3⤵
    PID:3872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11065.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11065.exe
    3⤵
    PID:1020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
    3⤵
    PID:5564
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38988.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38988.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35204.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35204.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13346.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61608.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61782.exe
        6⤵
        
        PID:1832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57204.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55049.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        7⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54864.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65264.exe
        6⤵
        
        PID:484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9112.exe
        6⤵
        
        PID:3620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12513.exe
        6⤵
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5644.exe
        6⤵
        
        PID:7084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23014.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13480.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18815.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14929.exe
        6⤵
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46199.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36842.exe
        5⤵
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3484.exe
        6⤵
        
        PID:6332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2420.exe
        5⤵
        
        PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37400.exe
        5⤵
        
        PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13135.exe
        5⤵
        
        PID:6448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8878.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46497.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23225.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50614.exe
        7⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43113.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37714.exe
        7⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38856.exe
        7⤵
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42756.exe
        6⤵
        
        PID:3744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47701.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6264.exe
        6⤵
        
        PID:4524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31173.exe
        6⤵
        
        PID:6784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51243.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53831.exe
        6⤵
        
        PID:2856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55049.exe
        6⤵
        
        PID:3804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        6⤵
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37267.exe
        6⤵
        
        PID:6392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3793.exe
        5⤵
        
        PID:2984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9112.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39129.exe
        5⤵
        
        PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57821.exe
        5⤵
        
        PID:2504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39791.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26828.exe
        5⤵
        
        PID:1924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48357.exe
        5⤵
        
        PID:584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14627.exe
        5⤵
        
        PID:4768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34013.exe
        5⤵
        
        PID:6012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11871.exe
      4⤵
      PID:1392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4541.exe
        5⤵
        
        PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14078.exe
        5⤵
        
        PID:5600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65143.exe
        5⤵
        
        PID:6536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59292.exe
      4⤵
      PID:3896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12204.exe
      4⤵
      PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25878.exe
      4⤵
      PID:5992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62033.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62033.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48811.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16879.exe
        5⤵
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60546.exe
        6⤵
        
        PID:3040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53150.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4465.exe
        6⤵
        
        PID:5644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29274.exe
        6⤵
        
        PID:7164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64684.exe
        5⤵
        
        PID:700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1327.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40240.exe
        5⤵
        
        PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44944.exe
        5⤵
        
        PID:6600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9980.exe
      4⤵
      PID:316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50439.exe
        5⤵
        
        PID:2192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46070.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17362.exe
        6⤵
        
        PID:3564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41956.exe
        6⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23221.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20833.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62092.exe
        5⤵
        
        PID:4028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53165.exe
        5⤵
        
        PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28985.exe
        5⤵
        
        PID:6004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35374.exe
      4⤵
      PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62811.exe
        5⤵
        
        PID:2956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44608.exe
        5⤵
        
        PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54242.exe
        5⤵
        
        PID:800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13130.exe
        5⤵
        
        PID:6984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26034.exe
      4⤵
      PID:1028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33112.exe
      4⤵
      PID:3924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6602.exe
      4⤵
      PID:5312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25198.exe
      4⤵
      PID:5512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6853.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6853.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61136.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe
        5⤵
        
        PID:2072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1519.exe
        5⤵
        
        PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47794.exe
        5⤵
        
        PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62727.exe
        5⤵
        
        PID:6116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40127.exe
      4⤵
      PID:2640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62092.exe
      4⤵
      PID:3984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46066.exe
      4⤵
      PID:1904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24278.exe
      4⤵
      PID:5188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60103.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60103.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47222.exe
      4⤵
      PID:2836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48357.exe
      4⤵
      PID:4076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exe
      4⤵
      PID:5412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44752.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37331.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37331.exe
    3⤵
    PID:944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42756.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42756.exe
    3⤵
    PID:3800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29270.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29270.exe
    3⤵
    PID:4668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
    3⤵
    PID:5636
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29073.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29073.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13346.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13346.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60411.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43465.exe
        5⤵
        
        PID:3000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48357.exe
        5⤵
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40201.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37651.exe
        5⤵
        
        PID:5660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45805.exe
      4⤵
      PID:2008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59292.exe
      4⤵
      PID:3948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20865.exe
      4⤵
      PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24808.exe
      4⤵
      PID:5172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58655.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58655.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3798.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38586.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53255.exe
        6⤵
        
        PID:2288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55049.exe
        6⤵
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        6⤵
        
        PID:4676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4402.exe
        6⤵
        
        PID:6592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61887.exe
        5⤵
        
        PID:1948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23278.exe
        5⤵
        
        PID:4388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29240.exe
        5⤵
        
        PID:6108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29127.exe
        5⤵
        
        PID:7004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34672.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38564.exe
        5⤵
        
        PID:2604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46875.exe
        5⤵
        
        PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13667.exe
        5⤵
        
        PID:7060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10770.exe
      4⤵
      PID:2392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62138.exe
      4⤵
      PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42502.exe
      4⤵
      PID:5460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31173.exe
      4⤵
      PID:6776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6075.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6075.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16760.exe
      4⤵
      PID:2820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24555.exe
        5⤵
        
        PID:2460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        6⤵
        
        PID:3648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28484.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8872.exe
        6⤵
        
        PID:5276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21122.exe
        6⤵
        
        PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30748.exe
        5⤵
        
        PID:3916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56849.exe
        5⤵
        
        PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45385.exe
        5⤵
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55185.exe
        5⤵
        
        PID:7048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11041.exe
      4⤵
      PID:2736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62092.exe
      4⤵
      PID:4012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20492.exe
      4⤵
      PID:5012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24278.exe
      4⤵
      PID:5232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5598.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5598.exe
    3⤵
    PID:748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54044.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26263.exe
      4⤵
      PID:4328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
      4⤵
      PID:4252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54864.exe
      4⤵
      PID:6120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11941.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11941.exe
    3⤵
    PID:3404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37729.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37729.exe
    3⤵
    PID:4304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50992.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50992.exe
    3⤵
    PID:4588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46375.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46375.exe
    3⤵
    PID:5624
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13081.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13081.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43160.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43160.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18407.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27673.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41628.exe
        6⤵
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3627.exe
        7⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9064.exe
        7⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15839.exe
        7⤵
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48357.exe
        6⤵
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31539.exe
        6⤵
        
        PID:4684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32944.exe
        6⤵
        
        PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57808.exe
        5⤵
        
        PID:1076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62092.exe
        5⤵
        
        PID:4032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46066.exe
        5⤵
        
        PID:1004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7174.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40095.exe
      4⤵
      PID:2052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26177.exe
        5⤵
        
        PID:1480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63902.exe
        5⤵
        
        PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56776.exe
        5⤵
        
        PID:5948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27878.exe
        5⤵
        
        PID:6584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65298.exe
      4⤵
      PID:1720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9112.exe
      4⤵
      PID:3236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38937.exe
      4⤵
      PID:4640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13135.exe
      4⤵
      PID:6316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1037.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1037.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54538.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8249.exe
        5⤵
        
        PID:1868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19912.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10048.exe
        6⤵
        
        PID:6896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15995.exe
        5⤵
        
        PID:3468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25328.exe
        5⤵
        
        PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
        5⤵
        
        PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29670.exe
        5⤵
        
        PID:6360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45670.exe
      4⤵
      PID:2132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7346.exe
        5⤵
        
        PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1273.exe
        5⤵
        
        PID:6832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64707.exe
      4⤵
      PID:3608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18038.exe
      4⤵
      PID:4300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12705.exe
      4⤵
      PID:6092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5644.exe
      4⤵
      PID:7096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50904.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50904.exe
    3⤵
    - Executes dropped EXE
    PID:2852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43826.exe
      4⤵
      PID:2848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11810.exe
      4⤵
      PID:4408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44893.exe
      4⤵
      PID:6076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11677.exe
      4⤵
      PID:6292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18747.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18747.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49648.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49648.exe
    3⤵
    PID:3168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25966.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25966.exe
    3⤵
    PID:5476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12603.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12603.exe
    3⤵
    PID:6744
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4053.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4053.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12864.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12864.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27897.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48357.exe
      4⤵
      PID:3580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41208.exe
      4⤵
      PID:5592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42102.exe
      4⤵
      PID:6472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57232.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57232.exe
    3⤵
    PID:2476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18326.exe
      4⤵
      PID:3864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28100.exe
      4⤵
      PID:4560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8872.exe
      4⤵
      PID:5268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54864.exe
      4⤵
      PID:5488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42969.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42969.exe
    3⤵
    PID:3124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62138.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62138.exe
    3⤵
    PID:4876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28849.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28849.exe
    3⤵
    PID:4636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5644.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5644.exe
    3⤵
    PID:7076
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38711.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38711.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45769.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45769.exe
    3⤵
    PID:2376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17362.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17362.exe
    3⤵
    PID:3568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6499.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6499.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44752.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44752.exe
    3⤵
    PID:6728
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51593.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51593.exe
  2⤵
  PID:2664
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38291.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38291.exe
  2⤵
  PID:3888
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11065.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11065.exe
  2⤵
  PID:5028
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3212.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3212.exe
  2⤵
  PID:5952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-13346.exe

Filesize
468KB

MD5
5074c3805df30964177ddfe97d829bf3

SHA1
8115f3ea9428207e0cf87c9112dd3c0b98801884

SHA256
23fda575a598dc78faf05c0701d89bb958bc326b9bb7a1aac529eb48f8ec7c26

SHA512
b48eee2f15c645adea9e8cabbdd7c4babb6e6f4699d62c2c90215898667796adfb3e04c1037ca8d24f1cbe4926df62342ad11afc3b20a83ac94b9c9ed0b06a43

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28566.exe

Filesize
468KB

MD5
0212a310d9c9a8f99167992f50c43cd3

SHA1
4b16fe68ddc34309bb280b45f05925d6c3111d55

SHA256
4e71ccd6f41b9524d4aeeccc9fb5a25eae55531641073a9547a4dd53d2f2fbfe

SHA512
8857abcc03bb4b004b51e43e304dcb4fe87078be70721b25398d4b070833bd00ce1fb3b2610d0076d267fb3a9bda23aeccab0cb328d68e215c0ba2cb9f2738aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35204.exe

Filesize
468KB

MD5
407532ab3cfca81b24aa18594c82ef1c

SHA1
9a38d0916bb4712a597d31e1bd0712dbcc7192ef

SHA256
d498d5af8ff70c5d3d47b61588aa870398b12d5722bc805b5413d8516dada9a8

SHA512
43341832f1b44ac3d88a9a839c4f58538d4ce6867e50963fbaef35f40fe4e021016541b1f6ca155be0bfeb123b8008c39eb743589f9ff2284abeab80c28b28a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40095.exe

Filesize
468KB

MD5
c343494031168b3201fe8c7befc62554

SHA1
439c594500fd19771688f80545f068599291f76d

SHA256
0397fa58c5057812e0a09fab1e3d18264dfec4ae9c7ad14dbb266cf35701402b

SHA512
2682ec5cd9dbcc9c5893ed0d20d2f6d5acea993823f624556725a5cf0cdeaf9f8b840fd23dc219a274e1578d261f80a1ac4cf60ee967a67199483e3d402227d0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-11298.exe

Filesize
468KB

MD5
c63ae6c98441cfa4b6e36d601abfbf53

SHA1
b1ff3058e718a4989c57f862f6955e62db5c113d

SHA256
b87ba14ff4a8c3b3367d78a3bc1b3e5ef6ca4ee6c51f06d6ddcc03843c373cc8

SHA512
5ae805a25af4f5503329142669d7653901830acea03618cf4cabf35c0a6e6eef2ddf3ea81c7918ab0e461f8639877ac79aaa9e71401a585dcd841e5dabbea7eb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12085.exe

Filesize
468KB

MD5
456108ca4b696e864a5a0c16d70fc8c8

SHA1
a998527bbfca28bdf173716cb1a31321eb5fbb27

SHA256
5c4c4480c15047e217a603bdcb5f33f1c68bf599d0ec3569a53e882fff05bc31

SHA512
b13771ecf90de10b107ccdac702242026429528cf31d7b43a134ca9f3352991a04225eb55b1cde62338379114ebdaaeed54b606f682eece8b21a2cce816eb394

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13081.exe

Filesize
468KB

MD5
b93047382954eb85b5ad7faaa39adc7a

SHA1
ed3a9b80d2d0a8ad5673541ff9c0c2a6cd337b8a

SHA256
c3d18f6463702de1b8991dd1b0147579718146a5f6064d03a7a7ebe0e16a9a70

SHA512
da2fa1395526d9019e6c62e7fb2832144ae2a131641e0089061612ffc265538de155980ec978ac766b757256ce231aa02dc839fda146ec6accd3af90adb21460

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25168.exe

Filesize
468KB

MD5
3a2d163cb9bd59c505729e56b54a3db5

SHA1
1d3de85cf7b07050fbc869a29290c05ae292a6dc

SHA256
9b57836b3b57265505e9e2c79fcfa0fc0a1cec0c53a87835e7a16ccbc4c212c3

SHA512
1369dea792c1b81d9a38f7bff11fa3bc7435dd4064782cf5368c88ef66d072ec58f4738a7d90f45db83525e17f6d335e2f7be3335fda132a751da38dc3584d5f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25197.exe

Filesize
468KB

MD5
c68ed9a13647ee57594f176c2110d9f5

SHA1
65205d10a5c4c3260bc0ade78132698140b93857

SHA256
a7692639f6aa660c66443e1dbf4e5528b89bff9dc131c6392aab59c54d0f9922

SHA512
9e30016400692d711e02793c63ae3efbb482cab5197b0fad3569fce41300b3d162352b37fcb3fdf887410e1c99672b774e12386c10f2b7905d9ad49de353b927

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29073.exe

Filesize
468KB

MD5
2c25c445e5ee150c696c4bdb146ef0f9

SHA1
57a96883fd6abb857b52e357fd5ef4fca059b2bd

SHA256
bf27a14c5a38e1860290197802b78ac405de574328c924fff4bb4f8997f8ca76

SHA512
483441910d20d5b31dee694eb47a67bb97465b16f863815daf67e3ac0b2058c0dd858e74ae1ec4f40886aaf9d5a59369ba4ef360615d317f88dedf923d0f9f7b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-30835.exe

Filesize
468KB

MD5
caf22dc53862bbd8fd2b8c15efb36156

SHA1
7e72f538da9bd02de100e6fcac0b6dc0d274c7c7

SHA256
23750a6b05a519ae491631c851a36b02e254ce9b79d8a1c4624ad25a09c1e67c

SHA512
f84012ddb37a9bd933d8db1c7aa34f1398c189e205bc040d9fadb03306cbe4668de227111df4ccf63419e3f1a45691e42e72617c33098a6aceca0fa0b0b775d8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38988.exe

Filesize
468KB

MD5
d4f90eadf349e9722e05cb9db7f8f04d

SHA1
3ddc180322c9d5ebc4caa9359636504aa8738ced

SHA256
6f8d7955e224f987bc8e342b3b392dd33c0e0a8ef33c0f3c7f0bab008a3795e0

SHA512
71e32230b1b3240f7c3552cc0f6246af64c3ae920cea5df4a07f6cc555a8b9c1f3bd7bd46ae8d2321296daef408d263374416c36012cd36a87571fe134d2e75a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42518.exe

Filesize
468KB

MD5
07289741939c5acb335a2cfaf0e7b8d4

SHA1
c552d77f323facb0cfdf31174e58c6d739b33b7a

SHA256
7ff5417bc49a1ae38ce8dd774379f7be0265f897dea435a617d03bdebebaeada

SHA512
f57bfa279411ce1202320bfd67501740acf69e2b775550ca63080891d8cfddedbca3b62a9a1c9500091c5297ede2010eeb096c91f035f8cf733fd09e23907a6d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-5380.exe

Filesize
468KB

MD5
b070907c6a881c361293253350d6f663

SHA1
b42681da090ec76d6e4152e07ac441d0d8905cbd

SHA256
8bbc426fef33954bd2995d551cbc5f520b5642f3b0925678c7fd9c2e89d85b0a

SHA512
07dabcfad13fc6047e8216740f45005ecca7e8dbd469d97d8d948ccf5e1ba8b909d265186390e67096b8109d6e686eb2dca5708a72ad7f1a20a2c8d48e0692df

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55261.exe

Filesize
468KB

MD5
7b3a107732f667415cd0e9c7a320ae4c

SHA1
e4ee67d0cc43d4c3add88a97d0833bf130347ed3

SHA256
cce7feafab4275d7e98ca4f20ca1cf82aacc347483b0a60371748ccb235e5d40

SHA512
4a37c01f10b2ee6be254983aa58731e56db08dcfaa32b52542d5c17b1ce56a94048540353251a172bbd5b7b2f58f5700672f3c7ce32a93dc9214ef9f98c5fbbf

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61659.exe

Filesize
468KB

MD5
b886de5c71d628cd3e3ae0a91f833d80

SHA1
c07c5c525501a6b118b8d74737731996bd3a42a9

SHA256
d1ad171617d73177e783dadba8eb077d230ecc162451bf1dd5eecb2d0d5f3ac0

SHA512
e25122a7cf1dca6126756bcfbc53c69e55c860c1fb56dc6f833a886fde16e757b76c1931143068566d21ad9bebe4b76748373aa00323621249daea983f2f87e7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62033.exe

Filesize
468KB

MD5
6b563c8e23a5b24781ff746667e06a01

SHA1
7a8686c630367591e4ece38e615f07eca7dd6481

SHA256
30b1db8d3dac7aa0397869e6935f4b3b8cd52f41a0bbc92665c5e31037833a77

SHA512
630e478189af9fb61c7efd4e71440a7c22daf4bb918aa718b026263282ca411e27124a5878ceda505ac6f8d1f926bdf156bbd3869b9e03b33a0497fcd3c2b95d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9781.exe

Filesize
468KB

MD5
cd2640fc873a26f812ebb6f021cbb646

SHA1
b801f3fd5e6b96411bfea0949fe549f5bc2cf0c9

SHA256
dd432e9687655f62145c21eea8d4d990af4df5ebe2a73bef5e77a4143e7d105e

SHA512
5aa7b9184cb598d7fb5b0e9261502684765e901634f90c87833e7b30416b17fe3ff148f8a925e7469403328626e6c3cbc8c3e8c7f132c3b5748ffc0f8d61a540

Download Submit
memory/560-250-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/780-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/780-267-0x00000000026B0000-0x0000000002725000-memory.dmp

Filesize
468KB

Download
memory/988-215-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1016-281-0x0000000002A70000-0x0000000002AE5000-memory.dmp

Filesize
468KB

Download
memory/1016-265-0x0000000001D80000-0x0000000001DF5000-memory.dmp

Filesize
468KB

Download
memory/1016-117-0x0000000001D80000-0x0000000001DF5000-memory.dmp

Filesize
468KB

Download
memory/1016-17-0x0000000002A70000-0x0000000002AE5000-memory.dmp

Filesize
468KB

Download
memory/1016-52-0x0000000001D80000-0x0000000001DF5000-memory.dmp

Filesize
468KB

Download
memory/1016-277-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1064-203-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1064-350-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1068-405-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1148-396-0x00000000026F0000-0x0000000002765000-memory.dmp

Filesize
468KB

Download
memory/1148-392-0x00000000026F0000-0x0000000002765000-memory.dmp

Filesize
468KB

Download
memory/1148-225-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1200-320-0x0000000002870000-0x00000000028E5000-memory.dmp

Filesize
468KB

Download
memory/1380-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1412-462-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1456-463-0x00000000026E0000-0x0000000002755000-memory.dmp

Filesize
468KB

Download
memory/1456-258-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1456-468-0x00000000026E0000-0x0000000002755000-memory.dmp

Filesize
468KB

Download
memory/1508-137-0x0000000002370000-0x00000000023E5000-memory.dmp

Filesize
468KB

Download
memory/1508-344-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1508-269-0x0000000002370000-0x00000000023E5000-memory.dmp

Filesize
468KB

Download
memory/1508-447-0x0000000002370000-0x00000000023E5000-memory.dmp

Filesize
468KB

Download
memory/1508-450-0x0000000002370000-0x00000000023E5000-memory.dmp

Filesize
468KB

Download
memory/1540-457-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1540-473-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/1540-263-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/1636-235-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1636-404-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1636-407-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1820-440-0x0000000003380000-0x00000000033F5000-memory.dmp

Filesize
468KB

Download
memory/1820-436-0x0000000003380000-0x00000000033F5000-memory.dmp

Filesize
468KB

Download
memory/1840-223-0x0000000002990000-0x0000000002A05000-memory.dmp

Filesize
468KB

Download
memory/1840-458-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1840-394-0x0000000002990000-0x0000000002A05000-memory.dmp

Filesize
468KB

Download
memory/1840-221-0x0000000002990000-0x0000000002A05000-memory.dmp

Filesize
468KB

Download
memory/2012-292-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2020-46-0x0000000002720000-0x0000000002795000-memory.dmp

Filesize
468KB

Download
memory/2020-282-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2020-375-0x0000000002720000-0x0000000002795000-memory.dmp

Filesize
468KB

Download
memory/2020-370-0x0000000002720000-0x0000000002795000-memory.dmp

Filesize
468KB

Download
memory/2020-214-0x0000000002720000-0x0000000002795000-memory.dmp

Filesize
468KB

Download
memory/2020-45-0x0000000002920000-0x0000000002995000-memory.dmp

Filesize
468KB

Download
memory/2020-213-0x0000000002920000-0x0000000002995000-memory.dmp

Filesize
468KB

Download
memory/2056-472-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2056-311-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2076-156-0x00000000028C0000-0x0000000002935000-memory.dmp

Filesize
468KB

Download
memory/2076-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2076-5-0x00000000033F0000-0x0000000003465000-memory.dmp

Filesize
468KB

Download
memory/2076-63-0x00000000028C0000-0x0000000002935000-memory.dmp

Filesize
468KB

Download
memory/2076-26-0x00000000028C0000-0x0000000002935000-memory.dmp

Filesize
468KB

Download
memory/2076-337-0x00000000028C0000-0x0000000002935000-memory.dmp

Filesize
468KB

Download
memory/2076-142-0x00000000028C0000-0x0000000002935000-memory.dmp

Filesize
468KB

Download
memory/2076-257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2076-251-0x00000000028C0000-0x0000000002935000-memory.dmp

Filesize
468KB

Download
memory/2528-309-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2528-253-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/2528-72-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/2528-248-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/2528-134-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/2568-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2568-174-0x0000000002870000-0x00000000028E5000-memory.dmp

Filesize
468KB

Download
memory/2616-361-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2624-291-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/2624-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2624-108-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/2680-252-0x0000000002960000-0x00000000029D5000-memory.dmp

Filesize
468KB

Download
memory/2680-249-0x0000000002960000-0x00000000029D5000-memory.dmp

Filesize
468KB

Download
memory/2680-420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2692-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2744-395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2752-331-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2792-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2816-341-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2860-374-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2860-102-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2860-196-0x00000000026C0000-0x0000000002735000-memory.dmp

Filesize
468KB

Download
memory/2860-201-0x00000000026C0000-0x0000000002735000-memory.dmp

Filesize
468KB

Download
memory/2896-183-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2896-326-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2896-88-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2896-342-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2908-448-0x0000000002380000-0x00000000023F5000-memory.dmp

Filesize
468KB

Download
memory/2988-446-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2988-377-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/2992-431-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3004-441-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3032-151-0x0000000001DC0000-0x0000000001E35000-memory.dmp

Filesize
468KB

Download
memory/3032-234-0x0000000001DC0000-0x0000000001E35000-memory.dmp

Filesize
468KB

Download
memory/3032-345-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3032-233-0x0000000001DC0000-0x0000000001E35000-memory.dmp

Filesize
468KB

Download
memory/3032-430-0x0000000001DC0000-0x0000000001E35000-memory.dmp

Filesize
468KB

Download
memory/3032-426-0x0000000001DC0000-0x0000000001E35000-memory.dmp

Filesize
468KB

Download