f8757effa77ad80ae3dfbfc2da6e0cce4aab9a0a1c2f2972ac0ef565af79c6cc

Analysis

max time kernel
119s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f8757effa77ad80ae3dfbfc2da6e0cce4aab9a0a1c2f2972ac0ef565af79c6ccN.exe
Size

468KB
MD5

900c3ee9f55ddf80090549295c7fee30
SHA1

05c913338d00a422b9602991551988021020f881
SHA256

f8757effa77ad80ae3dfbfc2da6e0cce4aab9a0a1c2f2972ac0ef565af79c6cc
SHA512

a81cf2832b459b9a3f77b3e9be3331e89bf56e2322ae3bb82df5931be33ca7f2215ab7e96f9774eaf672ea5f2af7a88536f1e0f199f82cc499f9d1e68078ca19
SSDEEP

3072:BqobogCdj08U2bYBPz59ff8/5CK3IXpInmHevVpCck03ukYN0BlV:BqIoh5U2iP19ffP5S6ck6LYN0

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2944	Unicorn-54070.exe
2872	Unicorn-65227.exe
2784	Unicorn-11387.exe
2628	Unicorn-50915.exe
592	Unicorn-4537.exe
3024	Unicorn-63944.exe
1156	Unicorn-6161.exe
2128	Unicorn-32737.exe
1584	Unicorn-5087.exe
2044	Unicorn-33121.exe
2136	Unicorn-56400.exe
1508	Unicorn-4598.exe
672	Unicorn-44013.exe
768	Unicorn-10728.exe
2036	Unicorn-10728.exe
2188	Unicorn-56359.exe
572	Unicorn-45539.exe
952	Unicorn-10147.exe
1092	Unicorn-42.exe
296	Unicorn-34460.exe
1780	Unicorn-9571.exe
904	Unicorn-49627.exe
916	Unicorn-63163.exe
2088	Unicorn-63925.exe
1652	Unicorn-41149.exe
2972	Unicorn-57604.exe
2572	Unicorn-57869.exe
2792	Unicorn-38003.exe
1616	Unicorn-13115.exe
2728	Unicorn-21859.exe
2616	Unicorn-39250.exe
480	Unicorn-5160.exe
1504	Unicorn-29987.exe
964	Unicorn-5866.exe
2448	Unicorn-65273.exe
2300	Unicorn-29856.exe
1016	Unicorn-37963.exe
1324	Unicorn-42409.exe
628	Unicorn-62010.exe
1836	Unicorn-48051.exe
2276	Unicorn-12233.exe
2772	Unicorn-7210.exe
2056	Unicorn-25885.exe
336	Unicorn-7127.exe
2184	Unicorn-24040.exe
1236	Unicorn-4174.exe
1876	Unicorn-56639.exe
1864	Unicorn-48544.exe
1048	Unicorn-48544.exe
2488	Unicorn-14910.exe
1752	Unicorn-38958.exe
2476	Unicorn-58824.exe
328	Unicorn-3301.exe
2756	Unicorn-1839.exe
2272	Unicorn-9053.exe
2732	Unicorn-63655.exe
2600	Unicorn-34512.exe
2764	Unicorn-28381.exe
2568	Unicorn-35175.exe
1440	Unicorn-20361.exe
2608	Unicorn-25191.exe
1288	Unicorn-61201.exe
2580	Unicorn-13462.exe
2324	Unicorn-60625.exe

Loads dropped DLL 64 IoCs

pid	Process
2480	f8757effa77ad80ae3dfbfc2da6e0cce4aab9a0a1c2f2972ac0ef565af79c6ccN.exe
2480	f8757effa77ad80ae3dfbfc2da6e0cce4aab9a0a1c2f2972ac0ef565af79c6ccN.exe
2480	f8757effa77ad80ae3dfbfc2da6e0cce4aab9a0a1c2f2972ac0ef565af79c6ccN.exe
2944	Unicorn-54070.exe
2480	f8757effa77ad80ae3dfbfc2da6e0cce4aab9a0a1c2f2972ac0ef565af79c6ccN.exe
2944	Unicorn-54070.exe
2872	Unicorn-65227.exe
2872	Unicorn-65227.exe
2480	f8757effa77ad80ae3dfbfc2da6e0cce4aab9a0a1c2f2972ac0ef565af79c6ccN.exe
2480	f8757effa77ad80ae3dfbfc2da6e0cce4aab9a0a1c2f2972ac0ef565af79c6ccN.exe
2784	Unicorn-11387.exe
2784	Unicorn-11387.exe
2944	Unicorn-54070.exe
2944	Unicorn-54070.exe
2628	Unicorn-50915.exe
2628	Unicorn-50915.exe
2872	Unicorn-65227.exe
2872	Unicorn-65227.exe
592	Unicorn-4537.exe
592	Unicorn-4537.exe
2944	Unicorn-54070.exe
2784	Unicorn-11387.exe
2784	Unicorn-11387.exe
2944	Unicorn-54070.exe
3024	Unicorn-63944.exe
2480	f8757effa77ad80ae3dfbfc2da6e0cce4aab9a0a1c2f2972ac0ef565af79c6ccN.exe
1156	Unicorn-6161.exe
2480	f8757effa77ad80ae3dfbfc2da6e0cce4aab9a0a1c2f2972ac0ef565af79c6ccN.exe
3024	Unicorn-63944.exe
1156	Unicorn-6161.exe
2128	Unicorn-32737.exe
2128	Unicorn-32737.exe
2628	Unicorn-50915.exe
2628	Unicorn-50915.exe
1584	Unicorn-5087.exe
1584	Unicorn-5087.exe
2872	Unicorn-65227.exe
2872	Unicorn-65227.exe
672	Unicorn-44013.exe
672	Unicorn-44013.exe
1508	Unicorn-4598.exe
1508	Unicorn-4598.exe
2784	Unicorn-11387.exe
2480	f8757effa77ad80ae3dfbfc2da6e0cce4aab9a0a1c2f2972ac0ef565af79c6ccN.exe
2480	f8757effa77ad80ae3dfbfc2da6e0cce4aab9a0a1c2f2972ac0ef565af79c6ccN.exe
2784	Unicorn-11387.exe
768	Unicorn-10728.exe
768	Unicorn-10728.exe
2036	Unicorn-10728.exe
2036	Unicorn-10728.exe
2944	Unicorn-54070.exe
2044	Unicorn-33121.exe
2044	Unicorn-33121.exe
2944	Unicorn-54070.exe
3024	Unicorn-63944.exe
592	Unicorn-4537.exe
3024	Unicorn-63944.exe
592	Unicorn-4537.exe
1156	Unicorn-6161.exe
1156	Unicorn-6161.exe
2188	Unicorn-56359.exe
2188	Unicorn-56359.exe
2128	Unicorn-32737.exe
2128	Unicorn-32737.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54050.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33121.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44239.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18952.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-865.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55490.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24600.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13869.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19734.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45385.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27270.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39355.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24583.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-358.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13869.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50431.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64279.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28728.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23745.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34869.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25009.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5826.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15314.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33182.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30437.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60712.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58442.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57116.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61399.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54800.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19502.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50232.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39686.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5826.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14841.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44239.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40115.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22014.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59096.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22862.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58442.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19502.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53220.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41754.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52126.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11956.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58442.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1839.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19502.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41754.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13869.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22155.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35841.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49627.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63163.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42756.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35573.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2480	f8757effa77ad80ae3dfbfc2da6e0cce4aab9a0a1c2f2972ac0ef565af79c6ccN.exe
2944	Unicorn-54070.exe
2872	Unicorn-65227.exe
2784	Unicorn-11387.exe
2628	Unicorn-50915.exe
592	Unicorn-4537.exe
3024	Unicorn-63944.exe
1156	Unicorn-6161.exe
2128	Unicorn-32737.exe
1584	Unicorn-5087.exe
2044	Unicorn-33121.exe
2136	Unicorn-56400.exe
768	Unicorn-10728.exe
1508	Unicorn-4598.exe
672	Unicorn-44013.exe
2036	Unicorn-10728.exe
2188	Unicorn-56359.exe
572	Unicorn-45539.exe
952	Unicorn-10147.exe
1092	Unicorn-42.exe
296	Unicorn-34460.exe
904	Unicorn-49627.exe
2088	Unicorn-63925.exe
1780	Unicorn-9571.exe
2972	Unicorn-57604.exe
1652	Unicorn-41149.exe
2792	Unicorn-38003.exe
916	Unicorn-63163.exe
2572	Unicorn-57869.exe
1616	Unicorn-13115.exe
2728	Unicorn-21859.exe
2616	Unicorn-39250.exe
480	Unicorn-5160.exe
1504	Unicorn-29987.exe
2448	Unicorn-65273.exe
964	Unicorn-5866.exe
2300	Unicorn-29856.exe
1016	Unicorn-37963.exe
628	Unicorn-62010.exe
1324	Unicorn-42409.exe
1836	Unicorn-48051.exe
2276	Unicorn-12233.exe
2772	Unicorn-7210.exe
1236	Unicorn-4174.exe
2056	Unicorn-25885.exe
336	Unicorn-7127.exe
2184	Unicorn-24040.exe
1876	Unicorn-56639.exe
1048	Unicorn-48544.exe
2488	Unicorn-14910.exe
1864	Unicorn-48544.exe
2476	Unicorn-58824.exe
1752	Unicorn-38958.exe
328	Unicorn-3301.exe
2756	Unicorn-1839.exe
2272	Unicorn-9053.exe
2732	Unicorn-63655.exe
2600	Unicorn-34512.exe
2764	Unicorn-28381.exe
2568	Unicorn-35175.exe
1440	Unicorn-20361.exe
2608	Unicorn-25191.exe
1288	Unicorn-61201.exe
2532	Unicorn-27304.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2944	2480	f8757effa77ad80ae3dfbfc2da6e0cce4aab9a0a1c2f2972ac0ef565af79c6ccN.exe	30
PID 2480 wrote to memory of 2944	2480	f8757effa77ad80ae3dfbfc2da6e0cce4aab9a0a1c2f2972ac0ef565af79c6ccN.exe	30
PID 2480 wrote to memory of 2944	2480	f8757effa77ad80ae3dfbfc2da6e0cce4aab9a0a1c2f2972ac0ef565af79c6ccN.exe	30
PID 2480 wrote to memory of 2944	2480	f8757effa77ad80ae3dfbfc2da6e0cce4aab9a0a1c2f2972ac0ef565af79c6ccN.exe	30
PID 2480 wrote to memory of 2872	2480	f8757effa77ad80ae3dfbfc2da6e0cce4aab9a0a1c2f2972ac0ef565af79c6ccN.exe	31
PID 2480 wrote to memory of 2872	2480	f8757effa77ad80ae3dfbfc2da6e0cce4aab9a0a1c2f2972ac0ef565af79c6ccN.exe	31
PID 2480 wrote to memory of 2872	2480	f8757effa77ad80ae3dfbfc2da6e0cce4aab9a0a1c2f2972ac0ef565af79c6ccN.exe	31
PID 2480 wrote to memory of 2872	2480	f8757effa77ad80ae3dfbfc2da6e0cce4aab9a0a1c2f2972ac0ef565af79c6ccN.exe	31
PID 2944 wrote to memory of 2784	2944	Unicorn-54070.exe	32
PID 2944 wrote to memory of 2784	2944	Unicorn-54070.exe	32
PID 2944 wrote to memory of 2784	2944	Unicorn-54070.exe	32
PID 2944 wrote to memory of 2784	2944	Unicorn-54070.exe	32
PID 2872 wrote to memory of 2628	2872	Unicorn-65227.exe	33
PID 2872 wrote to memory of 2628	2872	Unicorn-65227.exe	33
PID 2872 wrote to memory of 2628	2872	Unicorn-65227.exe	33
PID 2872 wrote to memory of 2628	2872	Unicorn-65227.exe	33
PID 2480 wrote to memory of 3024	2480	f8757effa77ad80ae3dfbfc2da6e0cce4aab9a0a1c2f2972ac0ef565af79c6ccN.exe	34
PID 2480 wrote to memory of 3024	2480	f8757effa77ad80ae3dfbfc2da6e0cce4aab9a0a1c2f2972ac0ef565af79c6ccN.exe	34
PID 2480 wrote to memory of 3024	2480	f8757effa77ad80ae3dfbfc2da6e0cce4aab9a0a1c2f2972ac0ef565af79c6ccN.exe	34
PID 2480 wrote to memory of 3024	2480	f8757effa77ad80ae3dfbfc2da6e0cce4aab9a0a1c2f2972ac0ef565af79c6ccN.exe	34
PID 2784 wrote to memory of 592	2784	Unicorn-11387.exe	35
PID 2784 wrote to memory of 592	2784	Unicorn-11387.exe	35
PID 2784 wrote to memory of 592	2784	Unicorn-11387.exe	35
PID 2784 wrote to memory of 592	2784	Unicorn-11387.exe	35
PID 2944 wrote to memory of 1156	2944	Unicorn-54070.exe	36
PID 2944 wrote to memory of 1156	2944	Unicorn-54070.exe	36
PID 2944 wrote to memory of 1156	2944	Unicorn-54070.exe	36
PID 2944 wrote to memory of 1156	2944	Unicorn-54070.exe	36
PID 2628 wrote to memory of 2128	2628	Unicorn-50915.exe	37
PID 2628 wrote to memory of 2128	2628	Unicorn-50915.exe	37
PID 2628 wrote to memory of 2128	2628	Unicorn-50915.exe	37
PID 2628 wrote to memory of 2128	2628	Unicorn-50915.exe	37
PID 2872 wrote to memory of 1584	2872	Unicorn-65227.exe	38
PID 2872 wrote to memory of 1584	2872	Unicorn-65227.exe	38
PID 2872 wrote to memory of 1584	2872	Unicorn-65227.exe	38
PID 2872 wrote to memory of 1584	2872	Unicorn-65227.exe	38
PID 592 wrote to memory of 2044	592	Unicorn-4537.exe	39
PID 592 wrote to memory of 2044	592	Unicorn-4537.exe	39
PID 592 wrote to memory of 2044	592	Unicorn-4537.exe	39
PID 592 wrote to memory of 2044	592	Unicorn-4537.exe	39
PID 2784 wrote to memory of 2136	2784	Unicorn-11387.exe	41
PID 2784 wrote to memory of 2136	2784	Unicorn-11387.exe	41
PID 2784 wrote to memory of 2136	2784	Unicorn-11387.exe	41
PID 2784 wrote to memory of 2136	2784	Unicorn-11387.exe	41
PID 2944 wrote to memory of 1508	2944	Unicorn-54070.exe	40
PID 2944 wrote to memory of 1508	2944	Unicorn-54070.exe	40
PID 2944 wrote to memory of 1508	2944	Unicorn-54070.exe	40
PID 2944 wrote to memory of 1508	2944	Unicorn-54070.exe	40
PID 2480 wrote to memory of 672	2480	f8757effa77ad80ae3dfbfc2da6e0cce4aab9a0a1c2f2972ac0ef565af79c6ccN.exe	43
PID 2480 wrote to memory of 672	2480	f8757effa77ad80ae3dfbfc2da6e0cce4aab9a0a1c2f2972ac0ef565af79c6ccN.exe	43
PID 2480 wrote to memory of 672	2480	f8757effa77ad80ae3dfbfc2da6e0cce4aab9a0a1c2f2972ac0ef565af79c6ccN.exe	43
PID 2480 wrote to memory of 672	2480	f8757effa77ad80ae3dfbfc2da6e0cce4aab9a0a1c2f2972ac0ef565af79c6ccN.exe	43
PID 3024 wrote to memory of 768	3024	Unicorn-63944.exe	42
PID 3024 wrote to memory of 768	3024	Unicorn-63944.exe	42
PID 3024 wrote to memory of 768	3024	Unicorn-63944.exe	42
PID 3024 wrote to memory of 768	3024	Unicorn-63944.exe	42
PID 1156 wrote to memory of 2036	1156	Unicorn-6161.exe	44
PID 1156 wrote to memory of 2036	1156	Unicorn-6161.exe	44
PID 1156 wrote to memory of 2036	1156	Unicorn-6161.exe	44
PID 1156 wrote to memory of 2036	1156	Unicorn-6161.exe	44
PID 2128 wrote to memory of 2188	2128	Unicorn-32737.exe	45
PID 2128 wrote to memory of 2188	2128	Unicorn-32737.exe	45
PID 2128 wrote to memory of 2188	2128	Unicorn-32737.exe	45
PID 2128 wrote to memory of 2188	2128	Unicorn-32737.exe	45

C:\Users\Admin\AppData\Local\Temp\f8757effa77ad80ae3dfbfc2da6e0cce4aab9a0a1c2f2972ac0ef565af79c6ccN.exe
"C:\Users\Admin\AppData\Local\Temp\f8757effa77ad80ae3dfbfc2da6e0cce4aab9a0a1c2f2972ac0ef565af79c6ccN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54070.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54070.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11387.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11387.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4537.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33121.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57869.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48544.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55018.exe
        8⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23745.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46181.exe
        8⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6537.exe
        8⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3337.exe
        8⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42274.exe
        8⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14011.exe
        8⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26216.exe
        7⤵
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60300.exe
        7⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29425.exe
        7⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12086.exe
        7⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41376.exe
        7⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47675.exe
        7⤵
        
        PID:7136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38958.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59673.exe
        7⤵
        
        PID:264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53228.exe
        8⤵
        
        PID:1356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9082.exe
        8⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40612.exe
        8⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35841.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15547.exe
        7⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39730.exe
        7⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4607.exe
        7⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57912.exe
        7⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6105.exe
        7⤵
        
        PID:7236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48556.exe
        6⤵
        
        PID:1168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27728.exe
        6⤵
        
        PID:1832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23579.exe
        6⤵
        
        PID:5552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28204.exe
        6⤵
        
        PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13115.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1839.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35304.exe
        7⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19502.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13869.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        7⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2495.exe
        7⤵
        
        PID:7448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41862.exe
        6⤵
        
        PID:2844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33237.exe
        6⤵
        
        PID:3316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44239.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52126.exe
        6⤵
        
        PID:6048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30609.exe
        6⤵
        
        PID:6408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28381.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23407.exe
        6⤵
        
        PID:684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        7⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19502.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13869.exe
        7⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        7⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47145.exe
        7⤵
        
        PID:7180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62968.exe
        6⤵
        
        PID:1564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33237.exe
        6⤵
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19734.exe
        6⤵
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45385.exe
        6⤵
        
        PID:6360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30609.exe
        6⤵
        
        PID:7152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54470.exe
        5⤵
        
        PID:1828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15314.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        6⤵
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45063.exe
        6⤵
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1040.exe
        6⤵
        
        PID:6916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47145.exe
        6⤵
        
        PID:7196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6384.exe
        5⤵
        
        PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36154.exe
        5⤵
        
        PID:4116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11599.exe
        5⤵
        
        PID:5388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24384.exe
        5⤵
        
        PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41696.exe
        5⤵
        
        PID:7344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56400.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42409.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39686.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57639.exe
        7⤵
        
        PID:1292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4030.exe
        7⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1040.exe
        7⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47145.exe
        7⤵
        
        PID:7172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36813.exe
        6⤵
        
        PID:1908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exe
        6⤵
        
        PID:4276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44239.exe
        6⤵
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52126.exe
        6⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30609.exe
        6⤵
        
        PID:7108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8859.exe
        5⤵
        
        PID:2592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59092.exe
        6⤵
        
        PID:1276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        6⤵
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13869.exe
        6⤵
        
        PID:5276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        6⤵
        
        PID:6440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47145.exe
        6⤵
        
        PID:7188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26347.exe
        5⤵
        
        PID:1904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52690.exe
        5⤵
        
        PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40645.exe
        5⤵
        
        PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6673.exe
        5⤵
        
        PID:6164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49627.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24040.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64247.exe
        6⤵
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43613.exe
        7⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1535.exe
        7⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60712.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31306.exe
        7⤵
        
        PID:6556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60986.exe
        6⤵
        
        PID:3928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exe
        6⤵
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59096.exe
        6⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57912.exe
        6⤵
        
        PID:6636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26992.exe
        6⤵
        
        PID:7504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34869.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52850.exe
        6⤵
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39355.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38642.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-244.exe
        5⤵
        
        PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46873.exe
        5⤵
        
        PID:4576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3867.exe
        5⤵
        
        PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37809.exe
        5⤵
        
        PID:7052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52682.exe
        5⤵
        
        PID:7864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56639.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11956.exe
        5⤵
        
        PID:800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        6⤵
        
        PID:5288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17486.exe
        6⤵
        
        PID:6536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-358.exe
        5⤵
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40664.exe
        5⤵
        
        PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27000.exe
        5⤵
        
        PID:5784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57912.exe
        5⤵
        
        PID:6808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30609.exe
        5⤵
        
        PID:6188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3026.exe
      4⤵
      PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24583.exe
        5⤵
        
        PID:1856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        5⤵
        
        PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13869.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        5⤵
        
        PID:6472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47145.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64654.exe
      4⤵
      PID:2720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20547.exe
      4⤵
      PID:4356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31734.exe
      4⤵
      PID:5924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31576.exe
      4⤵
      PID:6688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-505.exe
      4⤵
      PID:2400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6161.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6161.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10728.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41149.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7127.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8344.exe
        7⤵
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8936.exe
        8⤵
        
        PID:1352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        9⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19502.exe
        8⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55535.exe
        8⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10761.exe
        8⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2998.exe
        7⤵
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39103.exe
        7⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11069.exe
        7⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55557.exe
        7⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58017.exe
        7⤵
        
        PID:7808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9213.exe
        6⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63238.exe
        7⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23887.exe
        7⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22473.exe
        7⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59115.exe
        7⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13481.exe
        7⤵
        
        PID:7816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18452.exe
        6⤵
        
        PID:2496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61355.exe
        6⤵
        
        PID:4160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35573.exe
        6⤵
        
        PID:4640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4820.exe
        6⤵
        
        PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4174.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55695.exe
        6⤵
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35413.exe
        7⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        7⤵
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13869.exe
        7⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        7⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2495.exe
        7⤵
        
        PID:7488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15848.exe
        6⤵
        
        PID:3460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exe
        6⤵
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44239.exe
        6⤵
        
        PID:5156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52126.exe
        6⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30609.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58117.exe
        5⤵
        
        PID:2524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10519.exe
        6⤵
        
        PID:3108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9082.exe
        6⤵
        
        PID:4728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48780.exe
        6⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35841.exe
        6⤵
        
        PID:6240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57116.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4224.exe
        5⤵
        
        PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36104.exe
        5⤵
        
        PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39293.exe
        5⤵
        
        PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61842.exe
        5⤵
        
        PID:1204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21859.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58824.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36863.exe
        6⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22154.exe
        7⤵
        
        PID:620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25730.exe
        8⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        8⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38374.exe
        8⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60791.exe
        8⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47145.exe
        8⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60986.exe
        7⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22817.exe
        7⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28728.exe
        7⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57912.exe
        7⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51497.exe
        7⤵
        
        PID:7520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31390.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25704.exe
        7⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        7⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13869.exe
        7⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47145.exe
        7⤵
        
        PID:6584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59916.exe
        6⤵
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29425.exe
        6⤵
        
        PID:5048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23579.exe
        6⤵
        
        PID:5564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36372.exe
        6⤵
        
        PID:6332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58017.exe
        6⤵
        
        PID:7872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9213.exe
        5⤵
        
        PID:1800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40390.exe
        6⤵
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-672.exe
        6⤵
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20170.exe
        6⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58810.exe
        6⤵
        
        PID:7084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3263.exe
        5⤵
        
        PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61355.exe
        5⤵
        
        PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50431.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41376.exe
        5⤵
        
        PID:6724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3025.exe
        5⤵
        
        PID:7384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3301.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51640.exe
        5⤵
        
        PID:2040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-820.exe
        6⤵
        
        PID:1644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53751.exe
        6⤵
        
        PID:4660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3693.exe
        6⤵
        
        PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56689.exe
        5⤵
        
        PID:3340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exe
        5⤵
        
        PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44239.exe
        5⤵
        
        PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60294.exe
        5⤵
        
        PID:6148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30609.exe
        5⤵
        
        PID:7036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53295.exe
      4⤵
      PID:2884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30437.exe
      4⤵
      PID:3484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19038.exe
      4⤵
      PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60824.exe
      4⤵
      PID:5704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26144.exe
      4⤵
      PID:7100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4598.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4598.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9571.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34512.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24583.exe
        6⤵
        
        PID:2864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12334.exe
        6⤵
        
        PID:4624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54553.exe
        6⤵
        
        PID:7092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47675.exe
        6⤵
        
        PID:6700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4717.exe
        5⤵
        
        PID:1788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14841.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19673.exe
        5⤵
        
        PID:5952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31873.exe
        5⤵
        
        PID:7008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35175.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24583.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24600.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27270.exe
        5⤵
        
        PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38691.exe
        5⤵
        
        PID:6604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18452.exe
      4⤵
      PID:1728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61355.exe
      4⤵
      PID:4168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58983.exe
      4⤵
      PID:5808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41376.exe
      4⤵
      PID:6792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3025.exe
      4⤵
      PID:7544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57604.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57604.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12612.exe
      4⤵
      PID:2908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36954.exe
        5⤵
        
        PID:1956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36552.exe
        6⤵
        
        PID:6200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48161.exe
        6⤵
        
        PID:7648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29652.exe
        5⤵
        
        PID:3792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23559.exe
        5⤵
        
        PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19673.exe
        5⤵
        
        PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33914.exe
        5⤵
        
        PID:6980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64648.exe
      4⤵
      PID:444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61300.exe
        5⤵
        
        PID:7148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30437.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50232.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58442.exe
      4⤵
      PID:6848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26144.exe
      4⤵
      PID:7028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9053.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9053.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51889.exe
      4⤵
      PID:1268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19502.exe
      4⤵
      PID:3396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38374.exe
      4⤵
      PID:5180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
      4⤵
      PID:6456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2495.exe
      4⤵
      PID:7552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51504.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51504.exe
    3⤵
    PID:2780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30968.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30968.exe
    3⤵
    PID:3500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62871.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62871.exe
    3⤵
    PID:5792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31576.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31576.exe
    3⤵
    PID:6768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-505.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-505.exe
    3⤵
    PID:6596
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65227.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65227.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50915.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50915.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32737.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56359.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39250.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20361.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51889.exe
        8⤵
        
        PID:596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19502.exe
        8⤵
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48780.exe
        8⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35841.exe
        8⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62483.exe
        8⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57104.exe
        7⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33237.exe
        7⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28728.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57912.exe
        7⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51497.exe
        7⤵
        
        PID:7560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25191.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32367.exe
        7⤵
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        7⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38374.exe
        7⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        7⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47145.exe
        7⤵
        
        PID:7212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37778.exe
        6⤵
        
        PID:1536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61355.exe
        6⤵
        
        PID:4192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11069.exe
        6⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28849.exe
        6⤵
        
        PID:6292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3025.exe
        6⤵
        
        PID:7408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5160.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61201.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14771.exe
        7⤵
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15314.exe
        8⤵
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        8⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
        8⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10761.exe
        8⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62483.exe
        8⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60986.exe
        7⤵
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exe
        7⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40115.exe
        7⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11138.exe
        7⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14011.exe
        7⤵
        
        PID:7828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44491.exe
        6⤵
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15314.exe
        7⤵
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24600.exe
        7⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27270.exe
        7⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-865.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9184.exe
        6⤵
        
        PID:3828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61355.exe
        6⤵
        
        PID:4200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23579.exe
        6⤵
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36372.exe
        6⤵
        
        PID:6312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13462.exe
        5⤵
        Executes dropped EXE
        
        PID:2580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9009.exe
        6⤵
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24600.exe
        6⤵
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27270.exe
        6⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-865.exe
        6⤵
        
        PID:6712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-747.exe
        5⤵
        
        PID:2408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52690.exe
        5⤵
        
        PID:4208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60071.exe
        5⤵
        
        PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45915.exe
        5⤵
        
        PID:6284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47031.exe
        5⤵
        
        PID:7528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45539.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29987.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20854.exe
        6⤵
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57639.exe
        7⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        7⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13869.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        7⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2495.exe
        7⤵
        
        PID:7472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36621.exe
        6⤵
        
        PID:1900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exe
        6⤵
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44239.exe
        6⤵
        
        PID:4776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53292.exe
        6⤵
        
        PID:7160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51650.exe
        6⤵
        
        PID:7688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35964.exe
        5⤵
        
        PID:1580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11956.exe
        6⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15314.exe
        7⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        7⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53231.exe
        7⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14807.exe
        7⤵
        
        PID:7044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60986.exe
        6⤵
        
        PID:3944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exe
        6⤵
        
        PID:4316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        6⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57912.exe
        6⤵
        
        PID:6664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30609.exe
        6⤵
        
        PID:7120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5826.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15314.exe
        6⤵
        
        PID:3960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48780.exe
        6⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35841.exe
        6⤵
        
        PID:6280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62483.exe
        6⤵
        
        PID:7836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15049.exe
        5⤵
        
        PID:3804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20017.exe
        5⤵
        
        PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11695.exe
        5⤵
        
        PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58442.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1640.exe
        5⤵
        
        PID:7244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65273.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60625.exe
        5⤵
        Executes dropped EXE
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56487.exe
        6⤵
        
        PID:492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        6⤵
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13869.exe
        6⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        6⤵
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2495.exe
        6⤵
        
        PID:7464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61510.exe
        5⤵
        
        PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exe
        5⤵
        
        PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19734.exe
        5⤵
        
        PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45385.exe
        5⤵
        
        PID:6344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27304.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:2532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62610.exe
        5⤵
        
        PID:2244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15314.exe
        6⤵
        
        PID:3872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        6⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45063.exe
        6⤵
        
        PID:5620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1040.exe
        6⤵
        
        PID:6892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47145.exe
        6⤵
        
        PID:6660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47255.exe
        5⤵
        
        PID:3400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exe
        5⤵
        
        PID:4364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61400.exe
        5⤵
        
        PID:5884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57912.exe
        5⤵
        
        PID:6784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53872.exe
      4⤵
      PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15314.exe
        5⤵
        
        PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53751.exe
        5⤵
        
        PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3693.exe
        5⤵
        
        PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30609.exe
        5⤵
        
        PID:6420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55386.exe
      4⤵
      PID:3772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53220.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37598.exe
      4⤵
      PID:5588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31576.exe
      4⤵
      PID:6776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25009.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5087.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5087.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10147.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5866.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12877.exe
        6⤵
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35413.exe
        7⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12334.exe
        7⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3693.exe
        7⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30609.exe
        7⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8858.exe
        6⤵
        
        PID:1776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exe
        6⤵
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44239.exe
        6⤵
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52126.exe
        6⤵
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51497.exe
        6⤵
        
        PID:7368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-988.exe
        5⤵
        
        PID:1760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54494.exe
        6⤵
        
        PID:1848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50691.exe
        6⤵
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64279.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10761.exe
        6⤵
        
        PID:7012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18452.exe
        5⤵
        
        PID:992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61355.exe
        5⤵
        
        PID:2208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35573.exe
        5⤵
        
        PID:1500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35590.exe
        5⤵
        
        PID:5212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3025.exe
        5⤵
        
        PID:7400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29856.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35929.exe
        5⤵
        
        PID:1328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64463.exe
        6⤵
        
        PID:1868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        6⤵
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61399.exe
        6⤵
        
        PID:5484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10761.exe
        6⤵
        
        PID:6956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62483.exe
        6⤵
        
        PID:7852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31634.exe
        5⤵
        
        PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44239.exe
        5⤵
        
        PID:2172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52126.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26992.exe
        5⤵
        
        PID:7416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22014.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3788.exe
        5⤵
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10519.exe
        6⤵
        
        PID:3080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        6⤵
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45063.exe
        6⤵
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1040.exe
        6⤵
        
        PID:6924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2495.exe
        6⤵
        
        PID:7432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-358.exe
        5⤵
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40664.exe
        5⤵
        
        PID:4948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19734.exe
        5⤵
        
        PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22155.exe
        5⤵
        
        PID:6588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14011.exe
        5⤵
        
        PID:7792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11691.exe
      4⤵
      PID:3012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58568.exe
        5⤵
        
        PID:3332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        5⤵
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61399.exe
        5⤵
        
        PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1040.exe
        5⤵
        
        PID:6908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2495.exe
        5⤵
        
        PID:7440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11293.exe
      4⤵
      PID:3664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21328.exe
      4⤵
      PID:4980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53265.exe
      4⤵
      PID:5872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49962.exe
      4⤵
      PID:6996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37963.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55830.exe
        5⤵
        
        PID:1520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12387.exe
        6⤵
        
        PID:3088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53751.exe
        6⤵
        
        PID:4700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3693.exe
        6⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30609.exe
        6⤵
        
        PID:6252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48220.exe
        5⤵
        
        PID:3172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exe
        5⤵
        
        PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19734.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22155.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43941.exe
      4⤵
      PID:2624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2548.exe
        5⤵
        
        PID:3188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25994.exe
        5⤵
        
        PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40612.exe
        5⤵
        
        PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35841.exe
        5⤵
        
        PID:6256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61955.exe
      4⤵
      PID:3160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53187.exe
      4⤵
      PID:4140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35573.exe
      4⤵
      PID:2076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43758.exe
      4⤵
      PID:5496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3025.exe
      4⤵
      PID:7512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62010.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62010.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29463.exe
      4⤵
      PID:2504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11956.exe
        5⤵
        
        PID:2460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15314.exe
        6⤵
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        6⤵
        
        PID:4472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61399.exe
        6⤵
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1040.exe
        6⤵
        
        PID:6932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2495.exe
        6⤵
        
        PID:7480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5838.exe
        5⤵
        
        PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exe
        5⤵
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40115.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11138.exe
        5⤵
        
        PID:6264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
      4⤵
      PID:1640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22014.exe
        5⤵
        
        PID:2068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55979.exe
        5⤵
        
        PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61399.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        5⤵
        
        PID:6480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22640.exe
        5⤵
        
        PID:6380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18452.exe
      4⤵
      PID:1408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61355.exe
      4⤵
      PID:4176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35573.exe
      4⤵
      PID:5124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35974.exe
      4⤵
      PID:6228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47675.exe
      4⤵
      PID:6676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
    3⤵
    PID:2912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43140.exe
      4⤵
      PID:1028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
      4⤵
      PID:4104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61399.exe
      4⤵
      PID:5444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
      4⤵
      PID:6464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47145.exe
      4⤵
      PID:6580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43906.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43906.exe
    3⤵
    PID:1632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53220.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53220.exe
    3⤵
    PID:3544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21262.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21262.exe
    3⤵
    PID:5660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31576.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31576.exe
    3⤵
    PID:6732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21392.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21392.exe
    3⤵
    PID:7352
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63944.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63944.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10728.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10728.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63925.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5826.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58018.exe
        6⤵
        
        PID:3488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53751.exe
        6⤵
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3693.exe
        6⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30609.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29466.exe
        5⤵
        
        PID:3652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52690.exe
        5⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25727.exe
        5⤵
        
        PID:5672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58442.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26144.exe
        5⤵
        
        PID:7060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63655.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36954.exe
        5⤵
        
        PID:2200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15314.exe
        6⤵
        
        PID:3904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        6⤵
        
        PID:4456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48780.exe
        6⤵
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27673.exe
        6⤵
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62483.exe
        6⤵
        
        PID:7744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47639.exe
        5⤵
        
        PID:4020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exe
        5⤵
        
        PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59096.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57912.exe
        5⤵
        
        PID:6704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51497.exe
        5⤵
        
        PID:7392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64648.exe
      4⤵
      PID:824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-509.exe
        5⤵
        
        PID:3096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-672.exe
        5⤵
        
        PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17176.exe
        5⤵
        
        PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        5⤵
        
        PID:6680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62483.exe
        5⤵
        
        PID:7844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57421.exe
      4⤵
      PID:3236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20759.exe
      4⤵
      PID:5076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3527.exe
      4⤵
      PID:5996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58442.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47031.exe
      4⤵
      PID:7576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38003.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38003.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7210.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55446.exe
        5⤵
        
        PID:2740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11956.exe
        6⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18952.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20407.exe
        7⤵
        
        PID:1636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-358.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40664.exe
        6⤵
        
        PID:4940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19734.exe
        6⤵
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45385.exe
        6⤵
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51497.exe
        6⤵
        
        PID:7360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21005.exe
        5⤵
        
        PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39103.exe
        5⤵
        
        PID:3364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23579.exe
        5⤵
        
        PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28204.exe
        5⤵
        
        PID:6248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58017.exe
        5⤵
        
        PID:7728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42845.exe
      4⤵
      PID:2424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59673.exe
        5⤵
        
        PID:996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19502.exe
        5⤵
        
        PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38374.exe
        5⤵
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        5⤵
        
        PID:6432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47145.exe
        5⤵
        
        PID:7204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15883.exe
      4⤵
      PID:2116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27728.exe
      4⤵
      PID:3540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35573.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35590.exe
      4⤵
      PID:6120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39507.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25885.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25885.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31684.exe
      4⤵
      PID:3000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50976.exe
        5⤵
        
        PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        5⤵
        
        PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48780.exe
        5⤵
        
        PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27673.exe
        5⤵
        
        PID:5284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62483.exe
        5⤵
        
        PID:7892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60986.exe
      4⤵
      PID:3912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exe
      4⤵
      PID:4284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44239.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60294.exe
      4⤵
      PID:6036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30609.exe
      4⤵
      PID:6544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3523.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3523.exe
    3⤵
    PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16347.exe
      4⤵
      PID:6092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20407.exe
      4⤵
      PID:7032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51750.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51750.exe
    3⤵
    PID:3600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21328.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21328.exe
    3⤵
    PID:4972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20592.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20592.exe
    3⤵
    PID:5964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36911.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36911.exe
    3⤵
    PID:6984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61842.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61842.exe
    3⤵
    PID:7228
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44013.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44013.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34460.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34460.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48051.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22198.exe
        5⤵
        
        PID:3028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15314.exe
        6⤵
        
        PID:4048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24600.exe
        6⤵
        
        PID:2924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27270.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-865.exe
        6⤵
        
        PID:6828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7571.exe
        5⤵
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exe
        5⤵
        
        PID:4348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40115.exe
        5⤵
        
        PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11138.exe
        5⤵
        
        PID:6196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14011.exe
        5⤵
        
        PID:7768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35580.exe
      4⤵
      PID:532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15314.exe
        5⤵
        
        PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12334.exe
        5⤵
        
        PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3693.exe
        5⤵
        
        PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30609.exe
        5⤵
        
        PID:6236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13055.exe
      4⤵
      PID:3368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61355.exe
      4⤵
      PID:4184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42263.exe
      4⤵
      PID:5684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41376.exe
      4⤵
      PID:6756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3025.exe
      4⤵
      PID:7376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12233.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12233.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14989.exe
      4⤵
      PID:2124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15314.exe
        5⤵
        
        PID:4028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53751.exe
        5⤵
        
        PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3693.exe
        5⤵
        
        PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30609.exe
        5⤵
        
        PID:7124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7571.exe
      4⤵
      PID:3264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30466.exe
      4⤵
      PID:4688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18604.exe
      4⤵
      PID:5900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49866.exe
      4⤵
      PID:6720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40956.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40956.exe
    3⤵
    PID:568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42756.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
      4⤵
      PID:4420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13869.exe
      4⤵
      PID:5328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
      4⤵
      PID:6528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2495.exe
      4⤵
      PID:7456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34515.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34515.exe
    3⤵
    PID:640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52690.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52690.exe
    3⤵
    PID:4224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33895.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33895.exe
    3⤵
    PID:5696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58442.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58442.exe
    3⤵
    PID:6872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47031.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47031.exe
    3⤵
    PID:7568
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63163.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63163.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48544.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48544.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
      4⤵
      PID:2952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19502.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22862.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10761.exe
      4⤵
      PID:6972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54800.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54800.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33237.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33237.exe
    3⤵
    PID:3352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61400.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61400.exe
    3⤵
    PID:5936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57912.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57912.exe
    3⤵
    PID:6816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30609.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30609.exe
    3⤵
    PID:6376
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14910.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14910.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11956.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11956.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33182.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9824.exe
      4⤵
      PID:5056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64279.exe
      4⤵
      PID:6060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1040.exe
      4⤵
      PID:6832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2495.exe
      4⤵
      PID:7536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-358.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-358.exe
    3⤵
    PID:3676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40664.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40664.exe
    3⤵
    PID:4956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19734.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19734.exe
    3⤵
    PID:5260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45385.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45385.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26992.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26992.exe
    3⤵
    PID:7424
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3556.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3556.exe
  2⤵
  PID:3052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28724.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28724.exe
    3⤵
    PID:2996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
    3⤵
    PID:4512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48780.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48780.exe
    3⤵
    PID:5572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27673.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27673.exe
    3⤵
    PID:5404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62483.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62483.exe
    3⤵
    PID:7756
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30479.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30479.exe
  2⤵
  PID:3412
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26354.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26354.exe
  2⤵
  PID:4132
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36463.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36463.exe
  2⤵
  PID:5596
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8040.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8040.exe
  2⤵
  PID:6800
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44610.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44610.exe
  2⤵
  PID:6368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10147.exe

Filesize
468KB

MD5
16c77a74c5ef22f7805ec3da9557fd10

SHA1
924028405747601a78e00eb05a25b09bcb0792ed

SHA256
01cb45458bca7b5ab926224ce742b1cee50ca8f165ba757d65aa5c641edecd46

SHA512
2c6a9c88e364b11fa91dab61c5bf01730264121407207ccb885ca6a2f779fea12c7f24fc724607e4e5efc646fef20b7e13da5765ac9468889a49423834d4e143

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11387.exe

Filesize
468KB

MD5
cdcb0d1d0bfaaaec707330c8e1f85f23

SHA1
6a5f6203b6b63fba27d716a79f9da57613b1f585

SHA256
4f0d24d5b39adf0212b1551681035e9a6ac342b89dd1eaec818afcb21be438e6

SHA512
d7a83a3599f3300118d20b896012f61a7139686d047cefcc93e918100370317e29e8987bae663e97245ff37b78bf9b440954158956cfa04e66ad8cbbba875e8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4537.exe

Filesize
468KB

MD5
e8f1a7a38030aa22c2af8a5871e49d47

SHA1
3ffd08bb01aa0cf4fea78ff7f8cfa7198303cbf1

SHA256
42e191ceaada73f0bba3d8541c39ddd64ccb2f69de641c78d356949f99c7d219

SHA512
ca9ad2d04a5ee1559f78fcf9b55cc8aecf80c52e64f5b084ee35f493f8673ac676e22839dc698762f6c85a3bfdb6eb8310e2a7c40060eb1fadb39bcd288f59aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56359.exe

Filesize
468KB

MD5
c6fb9f9b42f1e6e656b4e595decf82ef

SHA1
abe343eb0486f55dd771d0df634c64b5604c8366

SHA256
aab9fcf62fa365a82676cec533fcbb27a5bec965db48db502e96ebe5000c0701

SHA512
ea24aa373c172938ca6b80e11e45e09fff99f7f145b1be0354a932d237f93f2d8c20b76aa2745109a36d12be0a687efc0acc8ea9bf9c6c498fe22811e8e9b33d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5866.exe

Filesize
468KB

MD5
95400cbfc1dc94f77ab9a156bb278702

SHA1
c11bd6f3338e8a1f44e0091df4dbd1452f196442

SHA256
d3bf24fda88600d6a04438ebb6f1c4593ca32ca51d274e08e82fd54a107436a7

SHA512
4966a7095c7aff8c5bd36a8ccd59fea17130879cd6bab8147e5ea9ae27afe633a85c781d980003ef65eee8f41e5850bd2444bc9fa476295d877745646bdbc550

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6161.exe

Filesize
468KB

MD5
d401dadd3ab859cb7fe0da986b36fc53

SHA1
357877799bc79cce37867370ecae842a8d38e6b9

SHA256
8d489e38d164de75ed1298eb463c66afac717a626e72f7ef90dcc38e4524dbc7

SHA512
bca55d9c953ef00c6a2beab7d2334b7f6faa0103fa59ef6f331395571d4d8e224de02c842851ff64340bfe276ddd47ba4eeec67b7a7cae2a9acffaac8a33a95d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-10728.exe

Filesize
468KB

MD5
d98639cb31d16935fc7047d7c26702a8

SHA1
6e5c8f4e098c90498b015a49afe8c83a8d16cde6

SHA256
0acc87663150a02af75c6cb62bf9b67cc44b2ce2d99587de1be2d111426c9798

SHA512
3d8bcf2b17033271f447d66a7237b70048e371d231026fb4537e670a20617a41debc0c04806e8dc712441d37341888c48ac6f8c24a0eb5df613fa527f3bb7702

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32737.exe

Filesize
468KB

MD5
ed126090e2b2175922dff1b4d14af926

SHA1
4bbf0557e1f9ef17589098e25e0902ac97b1dd1c

SHA256
5cc99c8d1fcd63dd910c18c4a151b20270f2b2a34bbc50b0ae32e7affb0a8066

SHA512
7a4b72315e20eeff316a68334df6883eebbf17d8350fa536cb0e2bc17cf867f2022ad5606db382e1799c7b4dad489bfb95e62debe28924063f91cbd44a7ee4ed

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33121.exe

Filesize
468KB

MD5
db276b4994446c36621ded68d4a444b7

SHA1
6cd7a02588b7dbd2cd8c107bb93261bef75184e0

SHA256
96eca2fc5420c24d24ff16240ac4a78b2102ad87ef10630f9dee4acc57c0aea4

SHA512
8d28bcfee39cecb8795fa0e311b62e40a636a4d8f78ef31c35c9c56f5d87fa8227510eaab1bc683442a61a269107097a111eeb3d769c6a0ae07233ff06eab5cc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-44013.exe

Filesize
468KB

MD5
61da441296054896b62e1ec7579456ea

SHA1
d0ebcee1053a3be4233cd0b8664d678347f285a4

SHA256
a77cf3328ff486c4a12df5ac9bc04ccfc8674b45c462d73f9854e0ab5bb117b5

SHA512
527ad4730ebbd15e8aebd26001b99227bcb6a15e9922e86764c4b489342a37811a404909865efef0e7747e603e20cf6edd73721aa4227ce8745a3307fb578e06

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45539.exe

Filesize
468KB

MD5
f7b94e4d920259939ea7d5f817a79a56

SHA1
0ddb91fbcccc21c2035c20ba4c786ae747b85ed1

SHA256
a59e4f2c195b9213802440220687005440765701afb3c5d65cd773e9b1ee02b3

SHA512
217c54a036743cf49485cb7c3cb03277997705265264c9342f3ab7a7b80e89e59a39d84e68bd7fa839cd002766e0af0d6b94411be9b7429e419a967b5599ed9b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4598.exe

Filesize
468KB

MD5
d602d67bf7dcd2821bb7ed1b713e78a7

SHA1
0c1589beec0af5fc1b7d2eec20a921e399985743

SHA256
f41251e228c15fae9c550a3e0ffedfc19bbd5a8108179355608c8f73dd95d81a

SHA512
f2678b64f13e187d11eaab843fc059bddb235f6bc5184118e8ac83a25b6cccabc7cbd830dac44e28520d7945ed109fdeff1796194a212246e39b702a996fd1d6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-5087.exe

Filesize
468KB

MD5
cfe78afc4245b8a5d3cf46be59dfbc55

SHA1
cb96a429ea2adecc92658e6e43d6c537b279817c

SHA256
1986217320fe9fd57128dcb6c3c3853be71911eceed51be1070d053eae2d64d8

SHA512
996fd117aaf6eb96fbde574d2f41f30aee1d2045ada9b22ba4b91762f1f1f75af8427b3693c09f93d39e43ce177e62a3f463ee460d460d0c7dd906c015bf9ab9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-50915.exe

Filesize
468KB

MD5
869636f7e00acdcd0b31507c6c04b19c

SHA1
6f0651da755de8594171e3900a16813d8bf23b5b

SHA256
d84843a2fda5104f6884930213ba44f478d16d46a4c187d1b35ff046d1193d55

SHA512
71faf74f0ee0d65df940a94d601c2361409c232283b41cbc81571c035d8bf0ec783844514d7a2ab5c450c1144a0231aa09b936132f8b221286e8fbab5f99c61d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54070.exe

Filesize
468KB

MD5
e8dcda5f39ec7acd99b04be7d441adc8

SHA1
01de08c5cee500e369cafdb7b5e326e90ef8a0c8

SHA256
c80adbe02a5240c9ffec7a2b5c2636c6679fb178038b2e247318f238384b29e3

SHA512
2702d21c59d8207ffa512faca725107e10fcb282c31fd2568c5583676dd0d8e3c97a7b38a01a0e0629a81065077a46ce9acbc7fa1e6cd46681e5d2e9e98a75ff

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56400.exe

Filesize
468KB

MD5
345749761c86ad09bbca9cc5eb7e2a77

SHA1
93497c3f9f862ea6eabed9d635cfc926c0eafa1b

SHA256
f4ef1adc24ea610f5d0d00dafc69d2fc85bba9c2df179fb297ac6192fbd8b295

SHA512
0c64658d3fd59061e3521b4713ae18d2c6ce2366e91db271a77e7ec7ff13ff8193b9a163c6da1ed91844a1819bb7551b7fb90418d8cfc8f620b5a87dd9256f1f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63944.exe

Filesize
468KB

MD5
b5952d77485d38cd04cd4d8adf268ed6

SHA1
9284f009132e34310fa6bbfaf4bdb9b1b844e8dc

SHA256
4b8e24a272ba34cc30597efbc081cfe68afc2466fdb04e576c9753fec436e806

SHA512
949b7e8459687cf5e19d0beac7bc8288d45f120113b359b37097eb1cb1ea2c4d11c201713a4e58e53fa0e78d80ab87bcc6135aa15bb69b846446c7f09ae06d9c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-65227.exe

Filesize
468KB

MD5
387b54049ca28a20a35245d02736d4cb

SHA1
294f8fa2bc7e0832d3423c5c1e0fe02d9cc2814e

SHA256
39fb2278f348a17e5e60bd3489a6ec1a8c7c55f666bba3930b162be11c304bda

SHA512
dea0c635cd0adcb063ad018faddfbaf2597f24c64a91a9d7951df9e617d2a978f98fae191192a5c3d8578a52edea8c7e27970610abdd78a4230d9e44f9b718bf

Download Submit
memory/296-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/480-363-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/572-208-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/572-372-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/572-371-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/592-316-0x0000000002480000-0x00000000024F5000-memory.dmp

Filesize
468KB

Download
memory/592-122-0x0000000002480000-0x00000000024F5000-memory.dmp

Filesize
468KB

Download
memory/592-119-0x0000000002480000-0x00000000024F5000-memory.dmp

Filesize
468KB

Download
memory/592-73-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/592-314-0x0000000002480000-0x00000000024F5000-memory.dmp

Filesize
468KB

Download
memory/672-238-0x00000000024E0000-0x0000000002555000-memory.dmp

Filesize
468KB

Download
memory/672-242-0x00000000024E0000-0x0000000002555000-memory.dmp

Filesize
468KB

Download
memory/672-167-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/768-272-0x0000000002900000-0x0000000002975000-memory.dmp

Filesize
468KB

Download
memory/768-284-0x0000000002900000-0x0000000002975000-memory.dmp

Filesize
468KB

Download
memory/768-172-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/904-267-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/916-269-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/952-222-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/952-382-0x0000000001E90000-0x0000000001F05000-memory.dmp

Filesize
468KB

Download
memory/952-383-0x0000000001E90000-0x0000000001F05000-memory.dmp

Filesize
468KB

Download
memory/964-384-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1092-233-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1156-320-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1156-80-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1156-342-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1156-169-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1156-157-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1504-373-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1508-158-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1508-252-0x0000000001E70000-0x0000000001EE5000-memory.dmp

Filesize
468KB

Download
memory/1508-251-0x0000000001E70000-0x0000000001EE5000-memory.dmp

Filesize
468KB

Download
memory/1584-221-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1584-220-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1584-110-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1584-400-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1584-394-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1616-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1652-288-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1780-253-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2036-287-0x00000000031C0000-0x0000000003235000-memory.dmp

Filesize
468KB

Download
memory/2036-286-0x00000000031C0000-0x0000000003235000-memory.dmp

Filesize
468KB

Download
memory/2044-121-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2044-300-0x0000000001F40000-0x0000000001FB5000-memory.dmp

Filesize
468KB

Download
memory/2044-298-0x0000000001F40000-0x0000000001FB5000-memory.dmp

Filesize
468KB

Download
memory/2088-285-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2128-194-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/2128-97-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2128-361-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/2128-193-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/2128-362-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/2136-154-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2188-352-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2188-195-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2188-351-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2300-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2448-391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2480-32-0x00000000007C0000-0x0000000000835000-memory.dmp

Filesize
468KB

Download
memory/2480-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2480-166-0x00000000007C0000-0x0000000000835000-memory.dmp

Filesize
468KB

Download
memory/2480-156-0x00000000007C0000-0x0000000000835000-memory.dmp

Filesize
468KB

Download
memory/2480-11-0x00000000007C0000-0x0000000000835000-memory.dmp

Filesize
468KB

Download
memory/2480-10-0x00000000007C0000-0x0000000000835000-memory.dmp

Filesize
468KB

Download
memory/2480-62-0x00000000007C0000-0x0000000000835000-memory.dmp

Filesize
468KB

Download
memory/2480-390-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2480-265-0x00000000007C0000-0x0000000000835000-memory.dmp

Filesize
468KB

Download
memory/2480-408-0x00000000007C0000-0x0000000000835000-memory.dmp

Filesize
468KB

Download
memory/2480-268-0x00000000007C0000-0x0000000000835000-memory.dmp

Filesize
468KB

Download
memory/2572-302-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2616-353-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2628-206-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2628-385-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2628-207-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2628-95-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2728-343-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2784-130-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/2784-37-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2784-266-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/2784-264-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/2784-152-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/2792-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2872-230-0x0000000002480000-0x00000000024F5000-memory.dmp

Filesize
468KB

Download
memory/2872-231-0x0000000002480000-0x00000000024F5000-memory.dmp

Filesize
468KB

Download
memory/2872-36-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2872-49-0x0000000002480000-0x00000000024F5000-memory.dmp

Filesize
468KB

Download
memory/2944-129-0x0000000000490000-0x0000000000505000-memory.dmp

Filesize
468KB

Download
memory/2944-301-0x0000000000490000-0x0000000000505000-memory.dmp

Filesize
468KB

Download
memory/2944-153-0x0000000000490000-0x0000000000505000-memory.dmp

Filesize
468KB

Download
memory/2944-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2944-294-0x0000000000490000-0x0000000000505000-memory.dmp

Filesize
468KB

Download
memory/2972-303-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3024-155-0x0000000002850000-0x00000000028C5000-memory.dmp

Filesize
468KB

Download
memory/3024-315-0x0000000002850000-0x00000000028C5000-memory.dmp

Filesize
468KB

Download
memory/3024-74-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3024-168-0x0000000002850000-0x00000000028C5000-memory.dmp

Filesize
468KB

Download
memory/3024-313-0x0000000002850000-0x00000000028C5000-memory.dmp

Filesize
468KB

Download