9b53a6d38f3eff3aecba14493d9f76d9a06a7ba4d724f714100eee78df43bc41

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 03:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f608f7b1262142229a9f04471a27ac60N.exe
Size

468KB
MD5

f608f7b1262142229a9f04471a27ac60
SHA1

bfa3789441d0615684a221981ff4aef9512cbe8e
SHA256

9b53a6d38f3eff3aecba14493d9f76d9a06a7ba4d724f714100eee78df43bc41
SHA512

8bb6641c4375d696ea4a4af30c301a1669c3ed16678edeb9223e3d15e39f415c9ed1f5769b0b40f9dc37f289c270a81ea95e6007454e3ed5c9fff170c74b7493
SSDEEP

3072:KbqMoild4N3Y1bYJPzcjffT/ECGF4IpLf1HCOV0joz2AieuNDrln:Kbto71Y1KP4jffP0QLozjpuND

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2724	Unicorn-18407.exe
2908	Unicorn-63500.exe
2860	Unicorn-10578.exe
1084	Unicorn-53075.exe
2988	Unicorn-3874.exe
2656	Unicorn-35840.exe
2148	Unicorn-49576.exe
1876	Unicorn-56718.exe
1264	Unicorn-43671.exe
2960	Unicorn-33688.exe
1952	Unicorn-13495.exe
1996	Unicorn-13760.exe
2972	Unicorn-13760.exe
2968	Unicorn-43126.exe
2020	Unicorn-62255.exe
1472	Unicorn-14004.exe
2220	Unicorn-29826.exe
2192	Unicorn-65535.exe
1404	Unicorn-39748.exe
2884	Unicorn-45494.exe
2072	Unicorn-11368.exe
964	Unicorn-5238.exe
1988	Unicorn-10984.exe
664	Unicorn-56656.exe
1580	Unicorn-29744.exe
1824	Unicorn-13672.exe
1348	Unicorn-13480.exe
2468	Unicorn-58768.exe
1048	Unicorn-39470.exe
1780	Unicorn-28534.exe
1308	Unicorn-25754.exe
2296	Unicorn-32368.exe
1724	Unicorn-38499.exe
1480	Unicorn-34585.exe
2132	Unicorn-26714.exe
2828	Unicorn-38944.exe
3024	Unicorn-48644.exe
3020	Unicorn-64139.exe
2776	Unicorn-46615.exe
2728	Unicorn-34458.exe
2680	Unicorn-37796.exe
1804	Unicorn-2445.exe
1044	Unicorn-21604.exe
2212	Unicorn-40510.exe
2536	Unicorn-17547.exe
2292	Unicorn-26478.exe
2580	Unicorn-52444.exe
2996	Unicorn-10224.exe
2928	Unicorn-62854.exe
904	Unicorn-3182.exe
2712	Unicorn-3447.exe
1256	Unicorn-3447.exe
2804	Unicorn-47967.exe
1176	Unicorn-50847.exe
1376	Unicorn-53992.exe
2164	Unicorn-53992.exe
2180	Unicorn-20251.exe
2684	Unicorn-45641.exe
2112	Unicorn-31905.exe
316	Unicorn-34815.exe
2068	Unicorn-40178.exe
1792	Unicorn-59202.exe
1320	Unicorn-15346.exe
884	Unicorn-9746.exe

Loads dropped DLL 64 IoCs

pid	Process
2236	f608f7b1262142229a9f04471a27ac60N.exe
2236	f608f7b1262142229a9f04471a27ac60N.exe
2724	Unicorn-18407.exe
2724	Unicorn-18407.exe
2236	f608f7b1262142229a9f04471a27ac60N.exe
2236	f608f7b1262142229a9f04471a27ac60N.exe
2908	Unicorn-63500.exe
2860	Unicorn-10578.exe
2908	Unicorn-63500.exe
2860	Unicorn-10578.exe
2724	Unicorn-18407.exe
2724	Unicorn-18407.exe
2236	f608f7b1262142229a9f04471a27ac60N.exe
2236	f608f7b1262142229a9f04471a27ac60N.exe
2988	Unicorn-3874.exe
2988	Unicorn-3874.exe
2908	Unicorn-63500.exe
2908	Unicorn-63500.exe
2656	Unicorn-35840.exe
2656	Unicorn-35840.exe
2236	f608f7b1262142229a9f04471a27ac60N.exe
2236	f608f7b1262142229a9f04471a27ac60N.exe
2148	Unicorn-49576.exe
1084	Unicorn-53075.exe
2724	Unicorn-18407.exe
2860	Unicorn-10578.exe
2148	Unicorn-49576.exe
1084	Unicorn-53075.exe
2724	Unicorn-18407.exe
2860	Unicorn-10578.exe
1876	Unicorn-56718.exe
2988	Unicorn-3874.exe
1876	Unicorn-56718.exe
2988	Unicorn-3874.exe
1264	Unicorn-43671.exe
1264	Unicorn-43671.exe
2908	Unicorn-63500.exe
2908	Unicorn-63500.exe
2020	Unicorn-62255.exe
2020	Unicorn-62255.exe
2972	Unicorn-13760.exe
2972	Unicorn-13760.exe
2860	Unicorn-10578.exe
2860	Unicorn-10578.exe
2968	Unicorn-43126.exe
2968	Unicorn-43126.exe
1084	Unicorn-53075.exe
1084	Unicorn-53075.exe
2724	Unicorn-18407.exe
1996	Unicorn-13760.exe
2724	Unicorn-18407.exe
1996	Unicorn-13760.exe
2960	Unicorn-33688.exe
2960	Unicorn-33688.exe
2148	Unicorn-49576.exe
2148	Unicorn-49576.exe
2236	f608f7b1262142229a9f04471a27ac60N.exe
2656	Unicorn-35840.exe
2236	f608f7b1262142229a9f04471a27ac60N.exe
2656	Unicorn-35840.exe
2220	Unicorn-29826.exe
2220	Unicorn-29826.exe
1472	Unicorn-14004.exe
2988	Unicorn-3874.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
280	316	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15908.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40510.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52496.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18246.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53927.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42244.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56718.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16530.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29357.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12028.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61916.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35141.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11818.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35384.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31141.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33688.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10984.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25754.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50898.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5001.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62592.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33107.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28500.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24102.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11925.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27159.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35212.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36396.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54476.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34625.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56151.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50554.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27159.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26475.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34044.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1161.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50248.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56724.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39379.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31141.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23587.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22823.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44924.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9196.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29826.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39738.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18407.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3874.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35212.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45813.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42774.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41439.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3508.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62854.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48361.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2236	f608f7b1262142229a9f04471a27ac60N.exe
2724	Unicorn-18407.exe
2908	Unicorn-63500.exe
2860	Unicorn-10578.exe
2988	Unicorn-3874.exe
2148	Unicorn-49576.exe
1084	Unicorn-53075.exe
2656	Unicorn-35840.exe
1876	Unicorn-56718.exe
1264	Unicorn-43671.exe
2968	Unicorn-43126.exe
2020	Unicorn-62255.exe
1996	Unicorn-13760.exe
2972	Unicorn-13760.exe
2960	Unicorn-33688.exe
1952	Unicorn-13495.exe
1472	Unicorn-14004.exe
2220	Unicorn-29826.exe
2192	Unicorn-65535.exe
1404	Unicorn-39748.exe
2884	Unicorn-45494.exe
2072	Unicorn-11368.exe
964	Unicorn-5238.exe
664	Unicorn-56656.exe
1988	Unicorn-10984.exe
1580	Unicorn-29744.exe
1824	Unicorn-13672.exe
1348	Unicorn-13480.exe
2468	Unicorn-58768.exe
1780	Unicorn-28534.exe
1048	Unicorn-39470.exe
1308	Unicorn-25754.exe
2296	Unicorn-32368.exe
1724	Unicorn-38499.exe
1480	Unicorn-34585.exe
2132	Unicorn-26714.exe
2828	Unicorn-38944.exe
3024	Unicorn-48644.exe
3020	Unicorn-64139.exe
2776	Unicorn-46615.exe
2728	Unicorn-34458.exe
2680	Unicorn-37796.exe
1044	Unicorn-21604.exe
1804	Unicorn-2445.exe
2292	Unicorn-26478.exe
2536	Unicorn-17547.exe
2212	Unicorn-40510.exe
2580	Unicorn-52444.exe
2996	Unicorn-10224.exe
1256	Unicorn-3447.exe
904	Unicorn-3182.exe
2712	Unicorn-3447.exe
2928	Unicorn-62854.exe
1376	Unicorn-53992.exe
2164	Unicorn-53992.exe
2180	Unicorn-20251.exe
2804	Unicorn-47967.exe
1176	Unicorn-50847.exe
2112	Unicorn-31905.exe
316	Unicorn-34815.exe
2684	Unicorn-45641.exe
2068	Unicorn-40178.exe
1572	Unicorn-35212.exe
1792	Unicorn-59202.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2724	2236	f608f7b1262142229a9f04471a27ac60N.exe	30
PID 2236 wrote to memory of 2724	2236	f608f7b1262142229a9f04471a27ac60N.exe	30
PID 2236 wrote to memory of 2724	2236	f608f7b1262142229a9f04471a27ac60N.exe	30
PID 2236 wrote to memory of 2724	2236	f608f7b1262142229a9f04471a27ac60N.exe	30
PID 2724 wrote to memory of 2908	2724	Unicorn-18407.exe	31
PID 2724 wrote to memory of 2908	2724	Unicorn-18407.exe	31
PID 2724 wrote to memory of 2908	2724	Unicorn-18407.exe	31
PID 2724 wrote to memory of 2908	2724	Unicorn-18407.exe	31
PID 2236 wrote to memory of 2860	2236	f608f7b1262142229a9f04471a27ac60N.exe	32
PID 2236 wrote to memory of 2860	2236	f608f7b1262142229a9f04471a27ac60N.exe	32
PID 2236 wrote to memory of 2860	2236	f608f7b1262142229a9f04471a27ac60N.exe	32
PID 2236 wrote to memory of 2860	2236	f608f7b1262142229a9f04471a27ac60N.exe	32
PID 2860 wrote to memory of 1084	2860	Unicorn-10578.exe	34
PID 2860 wrote to memory of 1084	2860	Unicorn-10578.exe	34
PID 2860 wrote to memory of 1084	2860	Unicorn-10578.exe	34
PID 2860 wrote to memory of 1084	2860	Unicorn-10578.exe	34
PID 2908 wrote to memory of 2988	2908	Unicorn-63500.exe	33
PID 2908 wrote to memory of 2988	2908	Unicorn-63500.exe	33
PID 2908 wrote to memory of 2988	2908	Unicorn-63500.exe	33
PID 2908 wrote to memory of 2988	2908	Unicorn-63500.exe	33
PID 2724 wrote to memory of 2656	2724	Unicorn-18407.exe	35
PID 2724 wrote to memory of 2656	2724	Unicorn-18407.exe	35
PID 2724 wrote to memory of 2656	2724	Unicorn-18407.exe	35
PID 2724 wrote to memory of 2656	2724	Unicorn-18407.exe	35
PID 2236 wrote to memory of 2148	2236	f608f7b1262142229a9f04471a27ac60N.exe	36
PID 2236 wrote to memory of 2148	2236	f608f7b1262142229a9f04471a27ac60N.exe	36
PID 2236 wrote to memory of 2148	2236	f608f7b1262142229a9f04471a27ac60N.exe	36
PID 2236 wrote to memory of 2148	2236	f608f7b1262142229a9f04471a27ac60N.exe	36
PID 2988 wrote to memory of 1876	2988	Unicorn-3874.exe	37
PID 2988 wrote to memory of 1876	2988	Unicorn-3874.exe	37
PID 2988 wrote to memory of 1876	2988	Unicorn-3874.exe	37
PID 2988 wrote to memory of 1876	2988	Unicorn-3874.exe	37
PID 2908 wrote to memory of 1264	2908	Unicorn-63500.exe	38
PID 2908 wrote to memory of 1264	2908	Unicorn-63500.exe	38
PID 2908 wrote to memory of 1264	2908	Unicorn-63500.exe	38
PID 2908 wrote to memory of 1264	2908	Unicorn-63500.exe	38
PID 2656 wrote to memory of 2960	2656	Unicorn-35840.exe	39
PID 2656 wrote to memory of 2960	2656	Unicorn-35840.exe	39
PID 2656 wrote to memory of 2960	2656	Unicorn-35840.exe	39
PID 2656 wrote to memory of 2960	2656	Unicorn-35840.exe	39
PID 2236 wrote to memory of 1952	2236	f608f7b1262142229a9f04471a27ac60N.exe	40
PID 2236 wrote to memory of 1952	2236	f608f7b1262142229a9f04471a27ac60N.exe	40
PID 2236 wrote to memory of 1952	2236	f608f7b1262142229a9f04471a27ac60N.exe	40
PID 2236 wrote to memory of 1952	2236	f608f7b1262142229a9f04471a27ac60N.exe	40
PID 2148 wrote to memory of 1996	2148	Unicorn-49576.exe	41
PID 2148 wrote to memory of 1996	2148	Unicorn-49576.exe	41
PID 2148 wrote to memory of 1996	2148	Unicorn-49576.exe	41
PID 2148 wrote to memory of 1996	2148	Unicorn-49576.exe	41
PID 1084 wrote to memory of 2972	1084	Unicorn-53075.exe	42
PID 1084 wrote to memory of 2972	1084	Unicorn-53075.exe	42
PID 1084 wrote to memory of 2972	1084	Unicorn-53075.exe	42
PID 1084 wrote to memory of 2972	1084	Unicorn-53075.exe	42
PID 2724 wrote to memory of 2968	2724	Unicorn-18407.exe	43
PID 2724 wrote to memory of 2968	2724	Unicorn-18407.exe	43
PID 2724 wrote to memory of 2968	2724	Unicorn-18407.exe	43
PID 2724 wrote to memory of 2968	2724	Unicorn-18407.exe	43
PID 2860 wrote to memory of 2020	2860	Unicorn-10578.exe	44
PID 2860 wrote to memory of 2020	2860	Unicorn-10578.exe	44
PID 2860 wrote to memory of 2020	2860	Unicorn-10578.exe	44
PID 2860 wrote to memory of 2020	2860	Unicorn-10578.exe	44
PID 1876 wrote to memory of 1472	1876	Unicorn-56718.exe	45
PID 1876 wrote to memory of 1472	1876	Unicorn-56718.exe	45
PID 1876 wrote to memory of 1472	1876	Unicorn-56718.exe	45
PID 1876 wrote to memory of 1472	1876	Unicorn-56718.exe	45

C:\Users\Admin\AppData\Local\Temp\f608f7b1262142229a9f04471a27ac60N.exe
"C:\Users\Admin\AppData\Local\Temp\f608f7b1262142229a9f04471a27ac60N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18407.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18407.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63500.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63500.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3874.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56718.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14004.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38499.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35212.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26754.exe
        9⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26212.exe
        9⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6163.exe
        9⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35141.exe
        9⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41439.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38408.exe
        8⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36549.exe
        8⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12028.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
        8⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25588.exe
        8⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64246.exe
        7⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7530.exe
        8⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25934.exe
        8⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62592.exe
        8⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48970.exe
        8⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31141.exe
        8⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6667.exe
        7⤵
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39926.exe
        7⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45525.exe
        7⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25708.exe
        7⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15410.exe
        7⤵
        
        PID:5508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34585.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53992.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23363.exe
        8⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45044.exe
        8⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20721.exe
        8⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43123.exe
        7⤵
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39594.exe
        7⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe
        7⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43318.exe
        7⤵
        
        PID:2592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34815.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:316
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 316 -s 188
        7⤵
        Program crash
        
        PID:280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46004.exe
        6⤵
        
        PID:2060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24441.exe
        6⤵
        
        PID:3204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59057.exe
        6⤵
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42774.exe
        6⤵
        
        PID:4320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56592.exe
        6⤵
        
        PID:5520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29826.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25754.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42986.exe
        7⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35406.exe
        8⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54622.exe
        8⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50898.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31800.exe
        7⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53927.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33503.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30727.exe
        7⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23587.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1592.exe
        6⤵
        
        PID:2404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4617.exe
        6⤵
        
        PID:3844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9723.exe
        6⤵
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1067.exe
        6⤵
        
        PID:4848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45508.exe
        6⤵
        
        PID:6092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32368.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64163.exe
        6⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5266.exe
        7⤵
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16385.exe
        7⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45044.exe
        7⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3508.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50933.exe
        6⤵
        
        PID:304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33107.exe
        6⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27159.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25708.exe
        6⤵
        
        PID:4116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60910.exe
        6⤵
        
        PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3182.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26370.exe
        6⤵
        
        PID:2376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59352.exe
        6⤵
        
        PID:3348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35825.exe
        6⤵
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
        6⤵
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61058.exe
        6⤵
        
        PID:5528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26396.exe
        5⤵
        
        PID:1956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42542.exe
        5⤵
        
        PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5896.exe
        5⤵
        
        PID:2492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe
        5⤵
        
        PID:4440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48844.exe
        5⤵
        
        PID:5048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43671.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65535.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26714.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56182.exe
        7⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52763.exe
        8⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45216.exe
        8⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28273.exe
        8⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17787.exe
        8⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39296.exe
        8⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34625.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42039.exe
        7⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20590.exe
        7⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39812.exe
        7⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15266.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42284.exe
        6⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20091.exe
        7⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45216.exe
        7⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11326.exe
        7⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
        7⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25588.exe
        7⤵
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48361.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18246.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41583.exe
        6⤵
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6447.exe
        6⤵
        
        PID:4800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15118.exe
        6⤵
        
        PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38944.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61678.exe
        6⤵
        
        PID:1468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45216.exe
        6⤵
        
        PID:3076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62966.exe
        6⤵
        
        PID:4008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe
        6⤵
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14588.exe
        6⤵
        
        PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7006.exe
        5⤵
        
        PID:912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64816.exe
        5⤵
        
        PID:2572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11925.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23276.exe
        5⤵
        
        PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47599.exe
        5⤵
        
        PID:4420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39748.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48644.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64008.exe
        6⤵
        
        PID:1328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36549.exe
        6⤵
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12028.exe
        6⤵
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25708.exe
        6⤵
        
        PID:4176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60910.exe
        6⤵
        
        PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18206.exe
        5⤵
        
        PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58951.exe
        5⤵
        
        PID:272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51924.exe
        5⤵
        
        PID:3148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42774.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39379.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64139.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49156.exe
        5⤵
        
        PID:2508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6440.exe
        5⤵
        
        PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31800.exe
        5⤵
        
        PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53927.exe
        5⤵
        
        PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40431.exe
        5⤵
        
        PID:4136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30727.exe
        5⤵
        
        PID:5864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22929.exe
      4⤵
      PID:1856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19864.exe
      4⤵
      PID:2392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62019.exe
      4⤵
      PID:3832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54259.exe
      4⤵
      PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15908.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55457.exe
      4⤵
      PID:5480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35840.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35840.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33688.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13480.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35212.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56923.exe
        7⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50554.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12523.exe
        7⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-537.exe
        7⤵
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31141.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37197.exe
        6⤵
        
        PID:432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33209.exe
        6⤵
        
        PID:3324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52462.exe
        6⤵
        
        PID:3432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43844.exe
        6⤵
        
        PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48294.exe
        5⤵
        
        PID:2904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9789.exe
        6⤵
        
        PID:1928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45216.exe
        6⤵
        
        PID:2184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14725.exe
        6⤵
        
        PID:3772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32141.exe
        6⤵
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47069.exe
        6⤵
        
        PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20654.exe
        5⤵
        
        PID:760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64816.exe
        5⤵
        
        PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21951.exe
        5⤵
        
        PID:3460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23520.exe
        5⤵
        
        PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42934.exe
        5⤵
        
        PID:4372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28534.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53992.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36396.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58732.exe
        6⤵
        
        PID:3948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6407.exe
        6⤵
        
        PID:3852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21025.exe
        6⤵
        
        PID:4828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52496.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16530.exe
        5⤵
        
        PID:1292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5001.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27320.exe
        5⤵
        
        PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1067.exe
        5⤵
        
        PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62037.exe
        5⤵
        
        PID:6064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45641.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11024.exe
        5⤵
        
        PID:1684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45216.exe
        5⤵
        
        PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27159.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25708.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14341.exe
        5⤵
        
        PID:5380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61112.exe
      4⤵
      PID:2188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56151.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27294.exe
      4⤵
      PID:3992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40342.exe
      4⤵
      PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9924.exe
      4⤵
      PID:5008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43126.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43126.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3447.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29357.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29842.exe
        6⤵
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29959.exe
        6⤵
        
        PID:3980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50909.exe
        6⤵
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12056.exe
        6⤵
        
        PID:5472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32521.exe
        5⤵
        
        PID:2632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43578.exe
        5⤵
        
        PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21247.exe
        5⤵
        
        PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24632.exe
        5⤵
        
        PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9196.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47967.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7210.exe
        5⤵
        
        PID:2940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26212.exe
        5⤵
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27924.exe
        5⤵
        
        PID:3912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49538.exe
        5⤵
        
        PID:4680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35384.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36576.exe
      4⤵
      PID:1636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42414.exe
      4⤵
      PID:3316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3363.exe
      4⤵
      PID:3568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9940.exe
      4⤵
      PID:4596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42654.exe
      4⤵
      PID:5088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40510.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36396.exe
        5⤵
        
        PID:600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58732.exe
        5⤵
        
        PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49905.exe
        5⤵
        
        PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54466.exe
        5⤵
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42124.exe
        5⤵
        
        PID:5248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16530.exe
      4⤵
      PID:628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1307.exe
        5⤵
        
        PID:3868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29120.exe
        5⤵
        
        PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31555.exe
        5⤵
        
        PID:2024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34008.exe
      4⤵
      PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22823.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
      4⤵
      PID:3820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58645.exe
      4⤵
      PID:4356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17547.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17547.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52763.exe
      4⤵
      PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45216.exe
      4⤵
      PID:2800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2922.exe
      4⤵
      PID:3884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1067.exe
      4⤵
      PID:4708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62862.exe
      4⤵
      PID:5908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13265.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13265.exe
    3⤵
    PID:2852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56681.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56681.exe
    3⤵
    PID:2912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56461.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56461.exe
    3⤵
    PID:3732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62677.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62677.exe
    3⤵
    PID:4972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9666.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9666.exe
    3⤵
    PID:4988
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10578.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10578.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13760.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11368.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46615.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9457.exe
        7⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64370.exe
        7⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60574.exe
        7⤵
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35141.exe
        7⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9643.exe
        7⤵
        
        PID:1360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16530.exe
        6⤵
        
        PID:1968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61878.exe
        6⤵
        
        PID:3572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56812.exe
        6⤵
        
        PID:3900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1067.exe
        6⤵
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26676.exe
        6⤵
        
        PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2445.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36396.exe
        6⤵
        
        PID:1248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58732.exe
        6⤵
        
        PID:3932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65477.exe
        6⤵
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
        6⤵
        
        PID:4120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35872.exe
        6⤵
        
        PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30265.exe
        5⤵
        
        PID:2432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18433.exe
        5⤵
        
        PID:3500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57774.exe
        5⤵
        
        PID:4044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9940.exe
        5⤵
        
        PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42654.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56656.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10224.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26626.exe
        6⤵
        
        PID:3788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19366.exe
        6⤵
        
        PID:3616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29275.exe
        6⤵
        
        PID:4620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50789.exe
        6⤵
        
        PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32521.exe
        5⤵
        
        PID:2668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27241.exe
        5⤵
        
        PID:3220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe
        5⤵
        
        PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17442.exe
        5⤵
        
        PID:4400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11818.exe
        5⤵
        
        PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62854.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36396.exe
        5⤵
        
        PID:1508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64289.exe
        5⤵
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18388.exe
        5⤵
        
        PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49538.exe
        5⤵
        
        PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1502.exe
        5⤵
        
        PID:6112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37366.exe
      4⤵
      PID:2832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4130.exe
      4⤵
      PID:3920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57342.exe
      4⤵
      PID:4064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21243.exe
      4⤵
      PID:4140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34044.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62255.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62255.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45494.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37796.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40178.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42462.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45216.exe
        7⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44893.exe
        7⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25588.exe
        7⤵
        
        PID:5140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39975.exe
        6⤵
        
        PID:824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58951.exe
        6⤵
        
        PID:2136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50248.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56724.exe
        6⤵
        
        PID:4784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30533.exe
        6⤵
        
        PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15346.exe
        5⤵
        Executes dropped EXE
        
        PID:1320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
        6⤵
        
        PID:2660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1161.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61916.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50909.exe
        6⤵
        
        PID:5108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12056.exe
        6⤵
        
        PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50933.exe
        5⤵
        
        PID:2548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30928.exe
        5⤵
        
        PID:4056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28273.exe
        5⤵
        
        PID:4488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31263.exe
        5⤵
        
        PID:4940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21604.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35212.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10749.exe
        6⤵
        
        PID:1756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45216.exe
        6⤵
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44383.exe
        6⤵
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31648.exe
        6⤵
        
        PID:4792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14588.exe
        6⤵
        
        PID:4880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38932.exe
        5⤵
        
        PID:2240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58951.exe
        5⤵
        
        PID:2652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36227.exe
        5⤵
        
        PID:3652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9940.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10173.exe
        5⤵
        
        PID:4456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13596.exe
      4⤵
      PID:2716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55928.exe
        5⤵
        
        PID:956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58951.exe
        5⤵
        
        PID:1000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50248.exe
        5⤵
        
        PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56724.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15266.exe
        5⤵
        
        PID:4992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60292.exe
      4⤵
      PID:1788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12824.exe
      4⤵
      PID:2384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44953.exe
      4⤵
      PID:3748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59646.exe
      4⤵
      PID:4212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39738.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61727.exe
      4⤵
      PID:5868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5238.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5238.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3447.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26370.exe
        5⤵
        
        PID:2116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27940.exe
        5⤵
        
        PID:3360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39028.exe
        5⤵
        
        PID:3648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35141.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42124.exe
        5⤵
        
        PID:5232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16530.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61878.exe
      4⤵
      PID:3588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14031.exe
      4⤵
      PID:3196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25708.exe
      4⤵
      PID:4204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15410.exe
      4⤵
      PID:5500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50847.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50847.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46118.exe
      4⤵
      PID:3168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15540.exe
      4⤵
      PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44924.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27312.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27312.exe
    3⤵
    PID:2772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54476.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54476.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20364.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20364.exe
    3⤵
    PID:3164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21243.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21243.exe
    3⤵
    PID:4168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1180.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1180.exe
    3⤵
    PID:5424
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49576.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49576.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13760.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13760.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13672.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20251.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24007.exe
        6⤵
        
        PID:1816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1877.exe
        6⤵
        
        PID:3372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13239.exe
        6⤵
        
        PID:3808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-537.exe
        6⤵
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31141.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26403.exe
        5⤵
        
        PID:2000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39594.exe
        5⤵
        
        PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe
        5⤵
        
        PID:4472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17442.exe
        5⤵
        
        PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11818.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31905.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24443.exe
        5⤵
        
        PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25934.exe
        5⤵
        
        PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62592.exe
        5⤵
        
        PID:4748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24102.exe
        5⤵
        
        PID:5028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13661.exe
        5⤵
        
        PID:5824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39947.exe
      4⤵
      PID:2224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33107.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60325.exe
      4⤵
      PID:3916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25708.exe
      4⤵
      PID:4200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12586.exe
      4⤵
      PID:5568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58768.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58768.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26478.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36396.exe
        5⤵
        
        PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58732.exe
        5⤵
        
        PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49905.exe
        5⤵
        
        PID:2444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54466.exe
        5⤵
        
        PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42124.exe
        5⤵
        
        PID:4996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16530.exe
      4⤵
      PID:2064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12568.exe
      4⤵
      PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-902.exe
      4⤵
      PID:4016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
      4⤵
      PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25588.exe
      4⤵
      PID:5196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52444.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52444.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36396.exe
      4⤵
      PID:928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31800.exe
      4⤵
      PID:3308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53927.exe
      4⤵
      PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32434.exe
      4⤵
      PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18855.exe
      4⤵
      PID:5896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37366.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37366.exe
    3⤵
    PID:2744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4130.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4130.exe
    3⤵
    PID:3964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52609.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52609.exe
    3⤵
    PID:3632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12890.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12890.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21123.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21123.exe
    3⤵
    PID:5124
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13495.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13495.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34458.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34458.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35212.exe
      4⤵
      PID:1668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61821.exe
        5⤵
        
        PID:3984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31308.exe
        5⤵
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14856.exe
        5⤵
        
        PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37197.exe
      4⤵
      PID:2040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27241.exe
      4⤵
      PID:3236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19104.exe
      4⤵
      PID:3876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
      4⤵
      PID:4300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61058.exe
      4⤵
      PID:5540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29081.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29081.exe
    3⤵
    PID:1748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5226.exe
      4⤵
      PID:2524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9214.exe
      4⤵
      PID:3384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62592.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50039.exe
      4⤵
      PID:5060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29997.exe
      4⤵
      PID:5804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56798.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56798.exe
    3⤵
    PID:1696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24441.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24441.exe
    3⤵
    PID:3228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10624.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10624.exe
    3⤵
    PID:3628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45073.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45073.exe
    3⤵
    PID:4364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
    3⤵
    PID:6120
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39470.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39470.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59202.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59202.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48196.exe
      4⤵
      PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36396.exe
        5⤵
        
        PID:560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58732.exe
        5⤵
        
        PID:3940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49905.exe
        5⤵
        
        PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54466.exe
        5⤵
        
        PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42124.exe
        5⤵
        
        PID:5224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32521.exe
      4⤵
      PID:2980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11289.exe
      4⤵
      PID:4020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28500.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49538.exe
      4⤵
      PID:4864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1502.exe
      4⤵
      PID:6080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47163.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47163.exe
    3⤵
    PID:568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24450.exe
      4⤵
      PID:2528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50535.exe
      4⤵
      PID:3140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28273.exe
      4⤵
      PID:4500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40585.exe
      4⤵
      PID:4424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47593.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47593.exe
    3⤵
    PID:1912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45813.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45813.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3363.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3363.exe
    3⤵
    PID:3552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9940.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9940.exe
    3⤵
    PID:4604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42654.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42654.exe
    3⤵
    PID:5240
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9746.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9746.exe
  2⤵
  - Executes dropped EXE
  PID:884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28994.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28994.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25934.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25934.exe
    3⤵
    PID:3276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62592.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62592.exe
    3⤵
    PID:4732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24102.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24102.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13661.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13661.exe
    3⤵
    PID:5304
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48663.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48663.exe
  2⤵
  PID:2976
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25553.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25553.exe
  2⤵
  PID:3376
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17077.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17077.exe
  2⤵
  PID:3872
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20108.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20108.exe
  2⤵
  PID:4124
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59133.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59133.exe
  2⤵
  PID:5724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10578.exe

Filesize
468KB

MD5
4ff910054d3b62edee2902903e7611eb

SHA1
ca132cb415c981e0c7ac9b2b6266177c042d5358

SHA256
f55bf83e18bf45e43bf364c7b8aacc6540f01335aee38aa0d3ffadf31fba7fc0

SHA512
1200e226da4a192e4577c1ebb69ace97c80d78f21d4f180173c3d6e023cf392f73244cd013b821c7496dbd3e27d39986480eff48d731b5cc35f9be1d4c0dcc9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3508.exe

Filesize
468KB

MD5
973ffdeaf8b5696e279dc45d9e6fc91a

SHA1
62b23c81e700aa642bc956d669415e9a722daced

SHA256
7797e722a92044e3a4388a2973fb2a2d388b886851daa9cff81e02f57ae7736a

SHA512
53d9067630320fd4cb78127d7dff0a6063a7f9388d857d966a8218147b4691ce9689eab4c97375b7dce685c1dc672d5287ba91ee27d048e0e91dd9dd4d5c0c2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35840.exe

Filesize
468KB

MD5
ea866bc4cdcd3f1559e3ffec90042612

SHA1
c79b538067e843ebed2e07b513260a4db783b0a9

SHA256
b5b4ffb4d086c07644c94959e54cc2d722ab47f148d1d4e0358184c7241a9c4d

SHA512
9d918b093def9ce86ba6cf46e419b0cfdb8b2f8ecb16d1ca3eaf423d4829dda8eca75dc24c9092e24f4f4a386ed1248a1b1bd00eb10cf419811813078a990d5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39975.exe

Filesize
468KB

MD5
b07bf4388c7816cbd3e5f4f3466ef93d

SHA1
8e5964c87561b96bab7e002ba09198d0e70e487c

SHA256
be4f939c0dc73982bea438fbfcd24ead8355c840cbdca67749f0fd1ea78c8318

SHA512
74ea342065ecb97b68d7a52c95d64c0b6ef4a9a0f732d779915e29b615b84b9a45723543a53f12b37373225c6202fa8038364385be433f4fcfa2cc82d635c23e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe

Filesize
468KB

MD5
d7fd4918d1cedc1f5409e05da84cbbf5

SHA1
ae74e61f6e2171e26f1cb875b5121352fa68d217

SHA256
3b19bde5a48d51b8264fb763586df15649ade7b7fad68935d42b82d77fa85d6f

SHA512
9a6b9468468d76712a2771e069298c0d76072e1bd1c4ee6c79934b05ae5eda541edb86b33aa6d4ee586df90ce98da226e10d9b832b5a627302b8134b49192527

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65535.exe

Filesize
468KB

MD5
53135d7227e9a84de0c818e29b8cddd7

SHA1
aa6c3a8d1263a19503199e485ba0b5dbe5a8d21c

SHA256
85908ff8352ce1c9466fd99bb36e63726aa6f3023f41c78f3af4143c4231a55e

SHA512
b44f8606b4dd24d6ce77ed19d5e2803f460bf1178a6911587980cc76f3e4bd7a7344ed022ecfd706eb0691e983ae8b8a481f781e7ad6cd11269ff7d7eeb948c7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13495.exe

Filesize
468KB

MD5
68a4cc12e6eed0cd1c8175b5435429cd

SHA1
413c1eda40721feee8be5aaeb619b8084f3272cc

SHA256
a6b966f34ad0771bb4e2e7c81af754a78cc26fe8969b0e05a9eaf9b954e10fce

SHA512
72bf8707c1235049f3e0eb034050bd3ea08384125cf464d4bcf6394acd81f0d74603add26e9fd227abb05133aff4397052ebaa6a4cedaf264e1ec74d6ac083d4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13760.exe

Filesize
468KB

MD5
ce809135faeefb57ce6978a99ebc0ca8

SHA1
875603f9ae2db7f378896cc0e6792477824fe1b2

SHA256
ff126db2f47b8559c1c06d4a47409fdbc59e9fe0565fcfc904f4ac696078569e

SHA512
f2725dfd2d370b96d4a995d6e47e505e022e018bdab8dae2763a4c1c9cef1da38fc14e0d9caa4efdad01fa94b96ff9575f99c8f54e27f1ab6221073315df2433

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14004.exe

Filesize
468KB

MD5
1358913cd886c7795329a5a379cb1576

SHA1
7c4e3c0a5ec6a413c4a888b1554a4747bcdfc21f

SHA256
a3e07c2676c43b908c369b302868f30c3b5853d7bbddfeec43a0e3b2d9e0bfa2

SHA512
7ca90ad7c77434f826ca25a9d04a19f8858005b19e5677ba04b7ec2de49e3a64e348563258b5db49f2f2a4e92fa1e43838b84a8373f87bd9852f41ec3247acaa

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18407.exe

Filesize
468KB

MD5
5ad714f866eef1bacec8bf409c607f0b

SHA1
5ba412236c685fc079344fb4955032c4cb7069c8

SHA256
481187fe88a2153882ca1764dc86ab08df4181088b63643a08439af739d5a8e4

SHA512
2c7c00164e1b4591568b8feb685259f9415b90690b7aa244172cc4a1451ea5bc9beeed180f12075b81251e84b26cfaf68d95a2bec5c96a3e6cdcf98128fd1064

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29826.exe

Filesize
468KB

MD5
d6bec3414e20511d8b14266975bab376

SHA1
c84719e31bb140a3f10d2f63800d10133979dc7a

SHA256
03ad80fe8b9f96d6d376b88d05fe7c2880c391cb53ae0adb30841d7196340a02

SHA512
121b70ada446a792cfd745d35e7278f588e9816572c4f8734516712d77ac0d9766f0e8a2563c154775f1b3b2061f046fa629a6f370f4dd594cff3a64abf4d3e4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33688.exe

Filesize
468KB

MD5
203dfb20afd503fbc6794b58fb480526

SHA1
4722da6c3ba5414cf679d079c072d17f1ddb3f3e

SHA256
065ea87b1d38f418992fe8968347e8213c551fd587b0c4f452de08a431b7a7fd

SHA512
c8f62a4d3e52e3d275a8934e41625fb2dd02e70a655e6332cb9330952c81f201b1995d3ece0cd69935dfbb89ba3de1ce8f50035c4635b52f1a9bcc46733f9e7e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3874.exe

Filesize
468KB

MD5
e0fc815c290be8dd96ef51dba3648f25

SHA1
d1295fbc1602108e64d60da9d6885050879e3fdf

SHA256
b383c35d67b54722459f33d57486cfd59d03871e77d7eb6286311be223bced6c

SHA512
edeadb8a242f661b9cff085bec9e30865e94beb16f8f260141e951058ec490739653d3a8e6c35de8deb25c6917d59f66aaecea95b19465712b506f2b7e2b63f9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43126.exe

Filesize
468KB

MD5
cdfd1bf2a9b626d1def58c5a97b4affd

SHA1
937d3a0fd62cd6d1569e013eaaa0ae7046d51ec3

SHA256
47ac71fc39c29b20f2725358df433a1446d257344cce266a48be6b79180fea2e

SHA512
0391ab1277a0142f8a3868950c094dc824939fbd97811ef85e1081fd19f9e9fb344965d7e40bbb10deb034ea9979c8a009494d628a243f1f35b47be4bae3c9d6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43671.exe

Filesize
468KB

MD5
8f4c30fe95782778c84f8ea49b11e253

SHA1
c297d8852e0620ba0f32f628384997b00a73cb16

SHA256
c16864697f7c543818ff954631845373fad0d36475f7edc9156b4f4356ce8ccb

SHA512
229f7ff5385aeadd1add8e42ebdb0f3d33a24fadaffda15f8e0abe9ef7680474c15e0751df0c3abc0ece2b91a45952be548dea8ed4569cf890e964c5bef1607d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49576.exe

Filesize
468KB

MD5
5a0f96e9747c6cba63362046e16a954c

SHA1
ee9d904d32e4be6f9fdde0bcbcef35b0334e12e5

SHA256
040bd8da8366f54e87fd71841487681405950a22fad6551e715ab14983115edb

SHA512
94c43e6a4f35d0a3a8b0ac712c88c9583cfb9a4e45718f92eb0c4244df17636ac6577d4b211a501e4b6cbf0dec57d848d7a7092ef8d66b97e22bdc955efc13b2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56718.exe

Filesize
468KB

MD5
7f8b7dd797a0e46e27aa35b074277774

SHA1
16a90b1a13e069993e4e340f3172601297833e37

SHA256
a3626d16dd5f68bd9c6b7d6060249728255218760c0bbbbe50900c59c1d5e0a1

SHA512
056811c10b78c4fa835d87b25db3b8ed4fb629bfbaf498c001f76faaaefe6105974c86a7e2c71624757b97a31b62c9e49148aab43f82bfb5ff3b25eef51d9e81

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62255.exe

Filesize
468KB

MD5
4704f0ab9cf022cc26101481865fee5b

SHA1
5ec0238b8bba4756aff57c0299d82b098f7eedd5

SHA256
2fe59f8225c62f7404636af7719272a96715d4592c1f33f3b8e6c7eb874f49f4

SHA512
cd09a88149408222059a53d63e2a1110df586ee530b912f1d66107806ea5556260a2913ae406ecbba1a8f3f3c401bbd0bcf5d9a45e5429300eb103a318182870

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63500.exe

Filesize
468KB

MD5
ab9c731d4412b89323eb51eed48d8ecb

SHA1
c65965a95d53176cc180b1bf35e13f4d23107bf6

SHA256
65bcca6b48306481a98a22a459a351a4ea25d64ae917ca8ecb2516d8151d1a22

SHA512
f1c88d4a24d972d37699eb869fffb67a814bf7b03fe0f6f889ea6c7e5d348010da42a832fc658888403b6b6e7ca8238983da331d6b0c8fad88a601df919d928a

Download Submit