dfa39967f1a5e82b4f9aa7db9ba09b3c44527c70cffb1d4794215f0314071809

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dfa39967f1a5e82b4f9aa7db9ba09b3c44527c70cffb1d4794215f0314071809N.exe
Size

468KB
MD5

c5b806b3f829a7700275c3735328bbb0
SHA1

8efdd9c77e50f4566d22a8bba9bf2a21347287d1
SHA256

dfa39967f1a5e82b4f9aa7db9ba09b3c44527c70cffb1d4794215f0314071809
SHA512

b18a2bf36fa8bff1502e51dc97332905ea0ef7914218db026cda8a0661cd44ecfc66310fa040e6050d2d8fab4cef4719b8d12ed024875c9b255722820526d8ba
SSDEEP

3072:KoApog0iUj5UtbYTX9tjcf9Lq9KvUgpucmHmGVs+0Wq8Dpp94AlU:KoCo7NUt4XPjcfEcDC0Wbdp94

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2084	Unicorn-32153.exe
1256	Unicorn-35141.exe
3012	Unicorn-13974.exe
3036	Unicorn-37130.exe
2912	Unicorn-22447.exe
2924	Unicorn-28578.exe
2672	Unicorn-1120.exe
2668	Unicorn-47576.exe
1036	Unicorn-28536.exe
2972	Unicorn-36777.exe
2384	Unicorn-1904.exe
1880	Unicorn-37784.exe
1496	Unicorn-61311.exe
1972	Unicorn-23455.exe
2928	Unicorn-31239.exe
2352	Unicorn-35319.exe
2264	Unicorn-64654.exe
1908	Unicorn-61935.exe
440	Unicorn-53389.exe
3048	Unicorn-21095.exe
1392	Unicorn-34010.exe
1320	Unicorn-53684.exe
1724	Unicorn-12843.exe
2216	Unicorn-58515.exe
904	Unicorn-26226.exe
2596	Unicorn-29756.exe
1028	Unicorn-62620.exe
2564	Unicorn-56490.exe
1832	Unicorn-56298.exe
2404	Unicorn-62163.exe
2288	Unicorn-34738.exe
1504	Unicorn-34738.exe
1580	Unicorn-8816.exe
2180	Unicorn-63200.exe
2876	Unicorn-28490.exe
2732	Unicorn-41872.exe
2196	Unicorn-4177.exe
2632	Unicorn-27912.exe
2456	Unicorn-11385.exe
2792	Unicorn-32552.exe
2620	Unicorn-36082.exe
2640	Unicorn-37928.exe
2308	Unicorn-11769.exe
1492	Unicorn-24768.exe
756	Unicorn-65417.exe
2960	Unicorn-13497.exe
596	Unicorn-2314.exe
2900	Unicorn-45385.exe
1512	Unicorn-43923.exe
2916	Unicorn-43923.exe
1700	Unicorn-64706.exe
2176	Unicorn-58842.exe
2240	Unicorn-39241.exe
2424	Unicorn-42771.exe
2452	Unicorn-47218.exe
2608	Unicorn-42579.exe
3032	Unicorn-34224.exe
3052	Unicorn-43155.exe
1100	Unicorn-45001.exe
1168	Unicorn-51131.exe
1680	Unicorn-10936.exe
2516	Unicorn-27813.exe
1048	Unicorn-27813.exe
1376	Unicorn-57724.exe

Loads dropped DLL 64 IoCs

pid	Process
1248	dfa39967f1a5e82b4f9aa7db9ba09b3c44527c70cffb1d4794215f0314071809N.exe
1248	dfa39967f1a5e82b4f9aa7db9ba09b3c44527c70cffb1d4794215f0314071809N.exe
1248	dfa39967f1a5e82b4f9aa7db9ba09b3c44527c70cffb1d4794215f0314071809N.exe
2084	Unicorn-32153.exe
2084	Unicorn-32153.exe
1248	dfa39967f1a5e82b4f9aa7db9ba09b3c44527c70cffb1d4794215f0314071809N.exe
1256	Unicorn-35141.exe
1256	Unicorn-35141.exe
1248	dfa39967f1a5e82b4f9aa7db9ba09b3c44527c70cffb1d4794215f0314071809N.exe
1248	dfa39967f1a5e82b4f9aa7db9ba09b3c44527c70cffb1d4794215f0314071809N.exe
3012	Unicorn-13974.exe
3012	Unicorn-13974.exe
2084	Unicorn-32153.exe
2084	Unicorn-32153.exe
2912	Unicorn-22447.exe
2912	Unicorn-22447.exe
1248	dfa39967f1a5e82b4f9aa7db9ba09b3c44527c70cffb1d4794215f0314071809N.exe
1248	dfa39967f1a5e82b4f9aa7db9ba09b3c44527c70cffb1d4794215f0314071809N.exe
2672	Unicorn-1120.exe
2672	Unicorn-1120.exe
3036	Unicorn-37130.exe
2084	Unicorn-32153.exe
3036	Unicorn-37130.exe
2084	Unicorn-32153.exe
2924	Unicorn-28578.exe
2924	Unicorn-28578.exe
1256	Unicorn-35141.exe
1256	Unicorn-35141.exe
3012	Unicorn-13974.exe
3012	Unicorn-13974.exe
2668	Unicorn-47576.exe
2668	Unicorn-47576.exe
2912	Unicorn-22447.exe
2912	Unicorn-22447.exe
1036	Unicorn-28536.exe
1036	Unicorn-28536.exe
1248	dfa39967f1a5e82b4f9aa7db9ba09b3c44527c70cffb1d4794215f0314071809N.exe
1248	dfa39967f1a5e82b4f9aa7db9ba09b3c44527c70cffb1d4794215f0314071809N.exe
2384	Unicorn-1904.exe
2384	Unicorn-1904.exe
3036	Unicorn-37130.exe
3036	Unicorn-37130.exe
1880	Unicorn-37784.exe
1880	Unicorn-37784.exe
2972	Unicorn-36777.exe
2972	Unicorn-36777.exe
2924	Unicorn-28578.exe
2924	Unicorn-28578.exe
2672	Unicorn-1120.exe
2672	Unicorn-1120.exe
2928	Unicorn-31239.exe
2928	Unicorn-31239.exe
1496	Unicorn-61311.exe
1256	Unicorn-35141.exe
1496	Unicorn-61311.exe
1256	Unicorn-35141.exe
3012	Unicorn-13974.exe
2084	Unicorn-32153.exe
2084	Unicorn-32153.exe
3012	Unicorn-13974.exe
2352	Unicorn-35319.exe
2264	Unicorn-64654.exe
2264	Unicorn-64654.exe
2352	Unicorn-35319.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3312	1680	WerFault.exe	91

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29368.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12240.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49750.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37130.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41191.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15469.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11326.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28866.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20408.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27588.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52398.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5088.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62452.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49256.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21334.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59975.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6588.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35564.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53389.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4637.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59975.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45641.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20732.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25866.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59567.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44565.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36959.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18105.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20408.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1253.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8374.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45378.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40374.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36254.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27588.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43293.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45641.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26274.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25013.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12468.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51506.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30116.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17559.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6801.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20785.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6917.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17623.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12240.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26274.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6588.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1279.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62763.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18105.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44557.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19121.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1248	dfa39967f1a5e82b4f9aa7db9ba09b3c44527c70cffb1d4794215f0314071809N.exe
2084	Unicorn-32153.exe
1256	Unicorn-35141.exe
3012	Unicorn-13974.exe
2912	Unicorn-22447.exe
2672	Unicorn-1120.exe
3036	Unicorn-37130.exe
2924	Unicorn-28578.exe
2668	Unicorn-47576.exe
1036	Unicorn-28536.exe
2384	Unicorn-1904.exe
1880	Unicorn-37784.exe
2928	Unicorn-31239.exe
1972	Unicorn-23455.exe
2972	Unicorn-36777.exe
1496	Unicorn-61311.exe
2264	Unicorn-64654.exe
2352	Unicorn-35319.exe
1908	Unicorn-61935.exe
440	Unicorn-53389.exe
3048	Unicorn-21095.exe
1392	Unicorn-34010.exe
1320	Unicorn-53684.exe
1724	Unicorn-12843.exe
904	Unicorn-26226.exe
2216	Unicorn-58515.exe
2596	Unicorn-29756.exe
2564	Unicorn-56490.exe
1028	Unicorn-62620.exe
1832	Unicorn-56298.exe
2404	Unicorn-62163.exe
2288	Unicorn-34738.exe
1504	Unicorn-34738.exe
1580	Unicorn-8816.exe
2180	Unicorn-63200.exe
2732	Unicorn-41872.exe
2876	Unicorn-28490.exe
2196	Unicorn-4177.exe
2632	Unicorn-27912.exe
2456	Unicorn-11385.exe
2792	Unicorn-32552.exe
2620	Unicorn-36082.exe
2640	Unicorn-37928.exe
2308	Unicorn-11769.exe
1492	Unicorn-24768.exe
756	Unicorn-65417.exe
2960	Unicorn-13497.exe
596	Unicorn-2314.exe
2900	Unicorn-45385.exe
2916	Unicorn-43923.exe
1512	Unicorn-43923.exe
1700	Unicorn-64706.exe
2240	Unicorn-39241.exe
2176	Unicorn-58842.exe
2424	Unicorn-42771.exe
2452	Unicorn-47218.exe
2608	Unicorn-42579.exe
1100	Unicorn-45001.exe
3032	Unicorn-34224.exe
1168	Unicorn-51131.exe
3052	Unicorn-43155.exe
1680	Unicorn-10936.exe
2516	Unicorn-27813.exe
1048	Unicorn-27813.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 2084	1248	dfa39967f1a5e82b4f9aa7db9ba09b3c44527c70cffb1d4794215f0314071809N.exe	30
PID 1248 wrote to memory of 2084	1248	dfa39967f1a5e82b4f9aa7db9ba09b3c44527c70cffb1d4794215f0314071809N.exe	30
PID 1248 wrote to memory of 2084	1248	dfa39967f1a5e82b4f9aa7db9ba09b3c44527c70cffb1d4794215f0314071809N.exe	30
PID 1248 wrote to memory of 2084	1248	dfa39967f1a5e82b4f9aa7db9ba09b3c44527c70cffb1d4794215f0314071809N.exe	30
PID 2084 wrote to memory of 3012	2084	Unicorn-32153.exe	32
PID 2084 wrote to memory of 3012	2084	Unicorn-32153.exe	32
PID 2084 wrote to memory of 3012	2084	Unicorn-32153.exe	32
PID 2084 wrote to memory of 3012	2084	Unicorn-32153.exe	32
PID 1248 wrote to memory of 1256	1248	dfa39967f1a5e82b4f9aa7db9ba09b3c44527c70cffb1d4794215f0314071809N.exe	31
PID 1248 wrote to memory of 1256	1248	dfa39967f1a5e82b4f9aa7db9ba09b3c44527c70cffb1d4794215f0314071809N.exe	31
PID 1248 wrote to memory of 1256	1248	dfa39967f1a5e82b4f9aa7db9ba09b3c44527c70cffb1d4794215f0314071809N.exe	31
PID 1248 wrote to memory of 1256	1248	dfa39967f1a5e82b4f9aa7db9ba09b3c44527c70cffb1d4794215f0314071809N.exe	31
PID 1256 wrote to memory of 3036	1256	Unicorn-35141.exe	34
PID 1256 wrote to memory of 3036	1256	Unicorn-35141.exe	34
PID 1256 wrote to memory of 3036	1256	Unicorn-35141.exe	34
PID 1256 wrote to memory of 3036	1256	Unicorn-35141.exe	34
PID 1248 wrote to memory of 2912	1248	dfa39967f1a5e82b4f9aa7db9ba09b3c44527c70cffb1d4794215f0314071809N.exe	35
PID 1248 wrote to memory of 2912	1248	dfa39967f1a5e82b4f9aa7db9ba09b3c44527c70cffb1d4794215f0314071809N.exe	35
PID 1248 wrote to memory of 2912	1248	dfa39967f1a5e82b4f9aa7db9ba09b3c44527c70cffb1d4794215f0314071809N.exe	35
PID 1248 wrote to memory of 2912	1248	dfa39967f1a5e82b4f9aa7db9ba09b3c44527c70cffb1d4794215f0314071809N.exe	35
PID 3012 wrote to memory of 2924	3012	Unicorn-13974.exe	36
PID 3012 wrote to memory of 2924	3012	Unicorn-13974.exe	36
PID 3012 wrote to memory of 2924	3012	Unicorn-13974.exe	36
PID 3012 wrote to memory of 2924	3012	Unicorn-13974.exe	36
PID 2084 wrote to memory of 2672	2084	Unicorn-32153.exe	37
PID 2084 wrote to memory of 2672	2084	Unicorn-32153.exe	37
PID 2084 wrote to memory of 2672	2084	Unicorn-32153.exe	37
PID 2084 wrote to memory of 2672	2084	Unicorn-32153.exe	37
PID 2912 wrote to memory of 2668	2912	Unicorn-22447.exe	38
PID 2912 wrote to memory of 2668	2912	Unicorn-22447.exe	38
PID 2912 wrote to memory of 2668	2912	Unicorn-22447.exe	38
PID 2912 wrote to memory of 2668	2912	Unicorn-22447.exe	38
PID 1248 wrote to memory of 1036	1248	dfa39967f1a5e82b4f9aa7db9ba09b3c44527c70cffb1d4794215f0314071809N.exe	39
PID 1248 wrote to memory of 1036	1248	dfa39967f1a5e82b4f9aa7db9ba09b3c44527c70cffb1d4794215f0314071809N.exe	39
PID 1248 wrote to memory of 1036	1248	dfa39967f1a5e82b4f9aa7db9ba09b3c44527c70cffb1d4794215f0314071809N.exe	39
PID 1248 wrote to memory of 1036	1248	dfa39967f1a5e82b4f9aa7db9ba09b3c44527c70cffb1d4794215f0314071809N.exe	39
PID 2672 wrote to memory of 2972	2672	Unicorn-1120.exe	40
PID 2672 wrote to memory of 2972	2672	Unicorn-1120.exe	40
PID 2672 wrote to memory of 2972	2672	Unicorn-1120.exe	40
PID 2672 wrote to memory of 2972	2672	Unicorn-1120.exe	40
PID 3036 wrote to memory of 2384	3036	Unicorn-37130.exe	41
PID 3036 wrote to memory of 2384	3036	Unicorn-37130.exe	41
PID 3036 wrote to memory of 2384	3036	Unicorn-37130.exe	41
PID 3036 wrote to memory of 2384	3036	Unicorn-37130.exe	41
PID 2084 wrote to memory of 1496	2084	Unicorn-32153.exe	42
PID 2084 wrote to memory of 1496	2084	Unicorn-32153.exe	42
PID 2084 wrote to memory of 1496	2084	Unicorn-32153.exe	42
PID 2084 wrote to memory of 1496	2084	Unicorn-32153.exe	42
PID 2924 wrote to memory of 1880	2924	Unicorn-28578.exe	43
PID 2924 wrote to memory of 1880	2924	Unicorn-28578.exe	43
PID 2924 wrote to memory of 1880	2924	Unicorn-28578.exe	43
PID 2924 wrote to memory of 1880	2924	Unicorn-28578.exe	43
PID 1256 wrote to memory of 2928	1256	Unicorn-35141.exe	44
PID 1256 wrote to memory of 2928	1256	Unicorn-35141.exe	44
PID 1256 wrote to memory of 2928	1256	Unicorn-35141.exe	44
PID 1256 wrote to memory of 2928	1256	Unicorn-35141.exe	44
PID 3012 wrote to memory of 1972	3012	Unicorn-13974.exe	45
PID 3012 wrote to memory of 1972	3012	Unicorn-13974.exe	45
PID 3012 wrote to memory of 1972	3012	Unicorn-13974.exe	45
PID 3012 wrote to memory of 1972	3012	Unicorn-13974.exe	45
PID 2668 wrote to memory of 2352	2668	Unicorn-47576.exe	46
PID 2668 wrote to memory of 2352	2668	Unicorn-47576.exe	46
PID 2668 wrote to memory of 2352	2668	Unicorn-47576.exe	46
PID 2668 wrote to memory of 2352	2668	Unicorn-47576.exe	46

C:\Users\Admin\AppData\Local\Temp\dfa39967f1a5e82b4f9aa7db9ba09b3c44527c70cffb1d4794215f0314071809N.exe
"C:\Users\Admin\AppData\Local\Temp\dfa39967f1a5e82b4f9aa7db9ba09b3c44527c70cffb1d4794215f0314071809N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32153.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32153.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13974.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13974.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28578.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37784.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53684.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11769.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52369.exe
        8⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44565.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        9⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52398.exe
        9⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62991.exe
        8⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49446.exe
        8⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22853.exe
        8⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5088.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10246.exe
        7⤵
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25655.exe
        8⤵
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        8⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        8⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        8⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54387.exe
        7⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59975.exe
        7⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
        7⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11053.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24768.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17009.exe
        7⤵
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7761.exe
        8⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        8⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        8⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52398.exe
        8⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20785.exe
        7⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59975.exe
        7⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
        7⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11053.exe
        7⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10878.exe
        6⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9043.exe
        7⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        7⤵
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        7⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        7⤵
        
        PID:6324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25276.exe
        6⤵
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34774.exe
        6⤵
        
        PID:4720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18138.exe
        6⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22732.exe
        6⤵
        
        PID:6640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58515.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43155.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59567.exe
        7⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4113.exe
        7⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13960.exe
        7⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        7⤵
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22213.exe
        6⤵
        
        PID:2224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
        6⤵
        
        PID:3656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18105.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
        6⤵
        
        PID:6128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45001.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24279.exe
        6⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41332.exe
        7⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        7⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        7⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        7⤵
        
        PID:6332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46194.exe
        6⤵
        
        PID:3380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15469.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18105.exe
        6⤵
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43733.exe
        6⤵
        
        PID:6936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7485.exe
        5⤵
        
        PID:2156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45732.exe
        6⤵
        
        PID:2252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49256.exe
        6⤵
        
        PID:3600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38040.exe
        6⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22853.exe
        6⤵
        
        PID:6048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5088.exe
        6⤵
        
        PID:6432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53522.exe
        5⤵
        
        PID:996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27319.exe
        5⤵
        
        PID:4068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8374.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18512.exe
        5⤵
        
        PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5453.exe
        5⤵
        
        PID:6156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23455.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65417.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24388.exe
        6⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        7⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60825.exe
        7⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        7⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
        7⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37511.exe
        6⤵
        
        PID:324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36383.exe
        6⤵
        
        PID:3144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18105.exe
        6⤵
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
        6⤵
        
        PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51314.exe
        5⤵
        
        PID:2660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        6⤵
        
        PID:2440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45641.exe
        6⤵
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        6⤵
        
        PID:5308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43733.exe
        6⤵
        
        PID:6828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27267.exe
        5⤵
        
        PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51840.exe
        5⤵
        
        PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53976.exe
        5⤵
        
        PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1253.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56298.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51131.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42956.exe
        6⤵
        
        PID:2904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40597.exe
        6⤵
        
        PID:1620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12240.exe
        6⤵
        
        PID:3212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        6⤵
        
        PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49214.exe
        5⤵
        
        PID:2548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
        5⤵
        
        PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18105.exe
        5⤵
        
        PID:2400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
        5⤵
        
        PID:5740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10936.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8233.exe
        5⤵
        
        PID:3024
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 236
        5⤵
        Program crash
        
        PID:3312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17559.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21724.exe
        5⤵
        
        PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22102.exe
        5⤵
        
        PID:6704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43655.exe
      4⤵
      PID:3660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41311.exe
      4⤵
      PID:4620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23847.exe
      4⤵
      PID:6004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1253.exe
      4⤵
      PID:5172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1120.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1120.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36777.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12843.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42771.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17009.exe
        7⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59567.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4113.exe
        8⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13960.exe
        8⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52398.exe
        8⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47102.exe
        7⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
        7⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18105.exe
        7⤵
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
        7⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62680.exe
        6⤵
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4300.exe
        7⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49256.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38040.exe
        7⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44848.exe
        7⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11053.exe
        7⤵
        
        PID:6372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1823.exe
        6⤵
        
        PID:3640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12839.exe
        6⤵
        
        PID:4580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45378.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39950.exe
        6⤵
        
        PID:6852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47218.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50309.exe
        6⤵
        
        PID:1484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49256.exe
        6⤵
        
        PID:3840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51809.exe
        6⤵
        
        PID:4224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11053.exe
        6⤵
        
        PID:5380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51579.exe
        5⤵
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29166.exe
        6⤵
        
        PID:7016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3319.exe
        5⤵
        
        PID:3648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12839.exe
        5⤵
        
        PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45378.exe
        5⤵
        
        PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6588.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26226.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13497.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16604.exe
        6⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15878.exe
        7⤵
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4308.exe
        7⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5439.exe
        7⤵
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20983.exe
        6⤵
        
        PID:3112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49446.exe
        6⤵
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22853.exe
        6⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5088.exe
        6⤵
        
        PID:7140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52763.exe
        5⤵
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59567.exe
        6⤵
        
        PID:1912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47889.exe
        6⤵
        
        PID:4140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22853.exe
        6⤵
        
        PID:6032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5088.exe
        6⤵
        
        PID:7132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53437.exe
        5⤵
        
        PID:1632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52785.exe
        6⤵
        
        PID:3120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29845.exe
        6⤵
        
        PID:4624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47648.exe
        6⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52398.exe
        6⤵
        
        PID:6744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23714.exe
        5⤵
        
        PID:3460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11160.exe
        5⤵
        
        PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11053.exe
        5⤵
        
        PID:5700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45385.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18789.exe
        5⤵
        
        PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49256.exe
        5⤵
        
        PID:3940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43581.exe
        5⤵
        
        PID:4996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53513.exe
        5⤵
        
        PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
        5⤵
        
        PID:6348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62763.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60191.exe
      4⤵
      PID:3624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24245.exe
      4⤵
      PID:4576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18388.exe
      4⤵
      PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43759.exe
      4⤵
      PID:7104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61311.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61311.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62620.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43923.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15451.exe
        6⤵
        
        PID:668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49256.exe
        7⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38040.exe
        7⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44848.exe
        7⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11053.exe
        7⤵
        
        PID:6524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21414.exe
        6⤵
        
        PID:3256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12070.exe
        6⤵
        
        PID:3440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        6⤵
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49750.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46214.exe
        5⤵
        
        PID:2684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12468.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        6⤵
        
        PID:4924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        6⤵
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52398.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59929.exe
        5⤵
        
        PID:3336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21334.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
        5⤵
        
        PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60254.exe
        5⤵
        
        PID:6400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39241.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15913.exe
        5⤵
        
        PID:2360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18371.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44557.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20785.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59975.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
        5⤵
        
        PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1279.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10686.exe
      4⤵
      PID:2824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21414.exe
        5⤵
        
        PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6917.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        5⤵
        
        PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43733.exe
        5⤵
        
        PID:6944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57129.exe
      4⤵
      PID:3352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17623.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18138.exe
      4⤵
      PID:5672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6588.exe
      4⤵
      PID:6148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62163.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62163.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42579.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7750.exe
        5⤵
        
        PID:1564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6801.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43581.exe
        6⤵
        
        PID:4948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53513.exe
        6⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43733.exe
        6⤵
        
        PID:6928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46194.exe
        5⤵
        
        PID:3396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36959.exe
        5⤵
        
        PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        5⤵
        
        PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
        5⤵
        
        PID:6244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30116.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24228.exe
        5⤵
        
        PID:3812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        5⤵
        
        PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        5⤵
        
        PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        5⤵
        
        PID:6356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29368.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59975.exe
      4⤵
      PID:4868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
      4⤵
      PID:5316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11053.exe
      4⤵
      PID:2064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34224.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34224.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7750.exe
      4⤵
      PID:912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59567.exe
        5⤵
        
        PID:1884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23906.exe
        6⤵
        
        PID:3604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43581.exe
        6⤵
        
        PID:4980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39389.exe
        6⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53560.exe
        6⤵
        
        PID:7112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53625.exe
        5⤵
        
        PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54110.exe
        5⤵
        
        PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        5⤵
        
        PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
        5⤵
        
        PID:6268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30957.exe
      4⤵
      PID:1148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
      4⤵
      PID:4092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18105.exe
      4⤵
      PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35564.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24516.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24516.exe
    3⤵
    PID:884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24098.exe
      4⤵
      PID:3788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
      4⤵
      PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12240.exe
      4⤵
      PID:5192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-749.exe
      4⤵
      PID:6968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27099.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27099.exe
    3⤵
    PID:3468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30309.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30309.exe
    3⤵
    PID:4952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15969.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15969.exe
    3⤵
    PID:5760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5453.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5453.exe
    3⤵
    PID:6188
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35141.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35141.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37130.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37130.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1904.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21095.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11385.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38996.exe
        7⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62452.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24751.exe
        8⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38040.exe
        8⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44848.exe
        8⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11053.exe
        8⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39701.exe
        7⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17848.exe
        7⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19825.exe
        7⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
        7⤵
        
        PID:5072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59971.exe
        6⤵
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7709.exe
        7⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29004.exe
        7⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12240.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52398.exe
        7⤵
        
        PID:6752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51247.exe
        6⤵
        
        PID:2508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17743.exe
        6⤵
        
        PID:4120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
        6⤵
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11053.exe
        6⤵
        
        PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32552.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9032.exe
        6⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4300.exe
        7⤵
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        7⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        7⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        7⤵
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12592.exe
        6⤵
        
        PID:3924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54110.exe
        6⤵
        
        PID:4916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        6⤵
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
        6⤵
        
        PID:6252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64630.exe
        5⤵
        
        PID:1440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65353.exe
        6⤵
        
        PID:1824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63680.exe
        6⤵
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        6⤵
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        6⤵
        
        PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27642.exe
        5⤵
        
        PID:3520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51310.exe
        5⤵
        
        PID:4688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58442.exe
        5⤵
        
        PID:2408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44263.exe
        5⤵
        
        PID:6632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34010.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36082.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19121.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3584.exe
        7⤵
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32174.exe
        7⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53513.exe
        7⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
        7⤵
        
        PID:6408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2779.exe
        6⤵
        
        PID:4052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54110.exe
        6⤵
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        6⤵
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49750.exe
        6⤵
        
        PID:6904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51279.exe
        5⤵
        
        PID:2076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8851.exe
        6⤵
        
        PID:3780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        6⤵
        
        PID:4664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        6⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52398.exe
        6⤵
        
        PID:6760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6338.exe
        5⤵
        
        PID:3096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59975.exe
        5⤵
        
        PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
        5⤵
        
        PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19029.exe
        5⤵
        
        PID:6508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37928.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17009.exe
        5⤵
        
        PID:1672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60517.exe
        6⤵
        
        PID:3188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        6⤵
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61441.exe
        6⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        6⤵
        
        PID:6380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28076.exe
        5⤵
        
        PID:3128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59975.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
        5⤵
        
        PID:5560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11053.exe
        5⤵
        
        PID:6228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16743.exe
      4⤵
      PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24420.exe
        5⤵
        
        PID:4040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        5⤵
        
        PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55240.exe
        5⤵
        
        PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        5⤵
        
        PID:6364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48224.exe
      4⤵
      PID:3736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34774.exe
      4⤵
      PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18138.exe
      4⤵
      PID:5132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6588.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31239.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31239.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29756.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2314.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57050.exe
        6⤵
        
        PID:2472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49256.exe
        6⤵
        
        PID:3856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38040.exe
        6⤵
        
        PID:4160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44848.exe
        6⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27197.exe
        6⤵
        
        PID:6660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53905.exe
        5⤵
        
        PID:2652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40948.exe
        6⤵
        
        PID:3888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        6⤵
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12240.exe
        6⤵
        
        PID:5184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52398.exe
        6⤵
        
        PID:6728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18372.exe
        5⤵
        
        PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43255.exe
        5⤵
        
        PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
        5⤵
        
        PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11053.exe
        5⤵
        
        PID:6532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64706.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57335.exe
        5⤵
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4300.exe
        6⤵
        
        PID:3080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        6⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        6⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        6⤵
        
        PID:6436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46603.exe
        5⤵
        
        PID:3104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40781.exe
        5⤵
        
        PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28312.exe
        5⤵
        
        PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45285.exe
        5⤵
        
        PID:6900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10878.exe
      4⤵
      PID:2192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49256.exe
        5⤵
        
        PID:3872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43581.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53513.exe
        5⤵
        
        PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
        5⤵
        
        PID:6460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56889.exe
      4⤵
      PID:3744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51310.exe
      4⤵
      PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1073.exe
      4⤵
      PID:5352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28119.exe
      4⤵
      PID:5420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56490.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56490.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43923.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49681.exe
        5⤵
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16252.exe
        6⤵
        
        PID:3964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        6⤵
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55769.exe
        6⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        6⤵
        
        PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37288.exe
        5⤵
        
        PID:3716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54110.exe
        5⤵
        
        PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        5⤵
        
        PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
        5⤵
        
        PID:6260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15975.exe
      4⤵
      PID:2444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11326.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41332.exe
        6⤵
        
        PID:3564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        6⤵
        
        PID:4672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        6⤵
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52398.exe
        6⤵
        
        PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28866.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54110.exe
        5⤵
        
        PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        5⤵
        
        PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49750.exe
        5⤵
        
        PID:6820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5196.exe
      4⤵
      PID:1876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21142.exe
      4⤵
      PID:4504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
      4⤵
      PID:5600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11053.exe
      4⤵
      PID:6196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58842.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58842.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7527.exe
      4⤵
      PID:844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32458.exe
        5⤵
        
        PID:3916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        5⤵
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12240.exe
        5⤵
        
        PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52398.exe
        5⤵
        
        PID:6736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49972.exe
      4⤵
      PID:4084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54110.exe
      4⤵
      PID:4812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50970.exe
      4⤵
      PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43733.exe
      4⤵
      PID:6952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64518.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64518.exe
    3⤵
    PID:1660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42141.exe
      4⤵
      PID:2496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49256.exe
      4⤵
      PID:3912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43581.exe
      4⤵
      PID:4964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53513.exe
      4⤵
      PID:5976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
      4⤵
      PID:6484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23691.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23691.exe
    3⤵
    PID:700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60721.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60721.exe
    3⤵
    PID:3588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19780.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19780.exe
    3⤵
    PID:4588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18512.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18512.exe
    3⤵
    PID:5708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5453.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5453.exe
    3⤵
    PID:5388
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22447.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22447.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47576.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47576.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35319.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34738.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27813.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43293.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49256.exe
        7⤵
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38040.exe
        7⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22853.exe
        7⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5088.exe
        7⤵
        
        PID:6456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25866.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60198.exe
        6⤵
        
        PID:3712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9440.exe
        6⤵
        
        PID:1864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11053.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33027.exe
        5⤵
        
        PID:480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17009.exe
        6⤵
        
        PID:636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45641.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18105.exe
        7⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43733.exe
        7⤵
        
        PID:6836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3604.exe
        6⤵
        
        PID:404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51506.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
        6⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1279.exe
        6⤵
        
        PID:6892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10878.exe
        5⤵
        
        PID:1228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15878.exe
        6⤵
        
        PID:896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51454.exe
        6⤵
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12240.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20156.exe
        6⤵
        
        PID:7032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65088.exe
        5⤵
        
        PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9078.exe
        5⤵
        
        PID:4108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1073.exe
        5⤵
        
        PID:5656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28119.exe
        5⤵
        
        PID:6180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8816.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38607.exe
        5⤵
        
        PID:812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36023.exe
        6⤵
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40597.exe
        6⤵
        
        PID:2888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12240.exe
        6⤵
        
        PID:1856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56998.exe
        5⤵
        
        PID:2764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39782.exe
        5⤵
        
        PID:4468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        5⤵
        
        PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49750.exe
        5⤵
        
        PID:6612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10878.exe
      4⤵
      PID:1588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48794.exe
        5⤵
        
        PID:3844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        5⤵
        
        PID:4764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12240.exe
        5⤵
        
        PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52398.exe
        5⤵
        
        PID:6720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56889.exe
      4⤵
      PID:3728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51310.exe
      4⤵
      PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1073.exe
      4⤵
      PID:5632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28119.exe
      4⤵
      PID:6164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64654.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64654.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34738.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27813.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47481.exe
        6⤵
        
        PID:1748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54469.exe
        6⤵
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        6⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        6⤵
        
        PID:6340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61549.exe
        5⤵
        
        PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42740.exe
        5⤵
        
        PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18105.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35564.exe
        5⤵
        
        PID:6556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57724.exe
      4⤵
      Executes dropped EXE
      PID:1376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11710.exe
        5⤵
        
        PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40597.exe
        5⤵
        
        PID:3076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5196.exe
      4⤵
      PID:2852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48605.exe
      4⤵
      PID:3204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9440.exe
      4⤵
      PID:2148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1279.exe
      4⤵
      PID:6860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63200.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63200.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41191.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23854.exe
        5⤵
        
        PID:1980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45641.exe
        5⤵
        
        PID:4384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        5⤵
        
        PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10615.exe
      4⤵
      PID:3172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6917.exe
      4⤵
      PID:3432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
      4⤵
      PID:6132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24014.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24014.exe
    3⤵
    PID:1804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32608.exe
      4⤵
      PID:1656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40597.exe
        5⤵
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12240.exe
        5⤵
        
        PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        5⤵
        
        PID:5716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40843.exe
      4⤵
      PID:3508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54110.exe
      4⤵
      PID:4680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18105.exe
      4⤵
      PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
      4⤵
      PID:1932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40720.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40720.exe
    3⤵
    PID:2312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37779.exe
      4⤵
      PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25013.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48237.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48237.exe
    3⤵
    PID:3424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34928.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34928.exe
    3⤵
    PID:5104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62145.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62145.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17397.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17397.exe
    3⤵
    PID:6604
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28536.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28536.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61935.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61935.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28490.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14958.exe
        5⤵
        
        PID:1132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57377.exe
        6⤵
        
        PID:1628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22647.exe
        6⤵
        
        PID:3724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        6⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        6⤵
        
        PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21414.exe
        5⤵
        
        PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6917.exe
        5⤵
        
        PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18105.exe
        5⤵
        
        PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46214.exe
      4⤵
      PID:1084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7984.exe
        5⤵
        
        PID:916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42382.exe
        5⤵
        
        PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12240.exe
        5⤵
        
        PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        5⤵
        
        PID:5724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59929.exe
      4⤵
      PID:3328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59160.exe
      4⤵
      PID:4212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9440.exe
      4⤵
      PID:5032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11053.exe
      4⤵
      PID:6172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41872.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41872.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32748.exe
      4⤵
      PID:2460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4637.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37390.exe
        5⤵
        
        PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
        5⤵
        
        PID:6316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45488.exe
      4⤵
      PID:2448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11878.exe
      4⤵
      PID:3540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
      4⤵
      PID:5592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
      4⤵
      PID:6220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10089.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10089.exe
    3⤵
    PID:1552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
      4⤵
      PID:2412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45641.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
      4⤵
      PID:5260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43733.exe
      4⤵
      PID:6920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23205.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23205.exe
    3⤵
    PID:1032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39940.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39940.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58442.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58442.exe
    3⤵
    PID:4136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36095.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36095.exe
    3⤵
    PID:6424
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53389.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53389.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4177.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4177.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14107.exe
      4⤵
      PID:952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        5⤵
        
        PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4308.exe
        5⤵
        
        PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        5⤵
        
        PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20732.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12540.exe
      4⤵
      PID:1768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65189.exe
      4⤵
      PID:3488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18105.exe
      4⤵
      PID:928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43634.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43634.exe
    3⤵
    PID:1916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11326.exe
      4⤵
      PID:2856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50935.exe
      4⤵
      PID:4408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
      4⤵
      PID:5360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52398.exe
      4⤵
      PID:6712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17339.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17339.exe
    3⤵
    PID:2172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22045.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22045.exe
    3⤵
    PID:3220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9440.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9440.exe
    3⤵
    PID:5068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11053.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11053.exe
    3⤵
    PID:5752
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27912.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27912.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49359.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49359.exe
    3⤵
    PID:580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4300.exe
      4⤵
      PID:1508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
      4⤵
      PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
      4⤵
      PID:5456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
      4⤵
      PID:6292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46194.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46194.exe
    3⤵
    PID:3388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36959.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36959.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
    3⤵
    PID:5648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
    3⤵
    PID:6204
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33175.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33175.exe
  2⤵
  PID:2992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49256.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49256.exe
    3⤵
    PID:3908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43581.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43581.exe
    3⤵
    PID:4984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53513.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53513.exe
    3⤵
    PID:5952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
    3⤵
    PID:6476
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36128.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36128.exe
  2⤵
  PID:3344
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51870.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51870.exe
  2⤵
  PID:4272
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61010.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61010.exe
  2⤵
  PID:5212
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51230.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51230.exe
  2⤵
  PID:6500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-13974.exe

Filesize
468KB

MD5
3622e41e4c4827b673272cb2230eeec5

SHA1
d201d0bb4c3b45c0852fcf259ac9c6a95c65a3f2

SHA256
4a657d07eaec731f3989a76867a77dba5b9b0caa39a1beb7014c0ef61fd5d009

SHA512
a49856bdee38c6dfbf663c0580b05bfeff56129c70babc0a1872add49aad4f49d5902451d68d2b0300736c9572f6efa3ee5ff1ae0e34eba39d7d98483c1c45fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1904.exe

Filesize
468KB

MD5
452531bd78a20d83578beb947c82e6ea

SHA1
e1108adb22c42dfab0f9657c7950f2398250a7c8

SHA256
3628be51404bcf80dbb44cc5cea3f59b22bc5406db59d7c83d808783c1d533fa

SHA512
833873ee340256b6accef26e81f492c7d96c2ac92cc47b58c5788b43862ff2a08c7d037a33cb3e795e396652df388af994ab68cd16fd78387017c8e90a3ea608

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20156.exe

Filesize
468KB

MD5
328416cf9f4448260c1fa1f65d8c54ba

SHA1
37e71ffd69493e5bb125c421113533997fee2707

SHA256
c76ff76577fdcf8d6d8e71b2852f8d6047c4e8da7772e4c42bfe152dad2d6767

SHA512
049042175b0e2cd6c4a4c6200308f2c1f16fa161f1aab26296dd66664a94554eebd853e887f6c95bd78e06bb3ed5722589a111550a107f094f703319c12565aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22447.exe

Filesize
468KB

MD5
448855262ca55a8575198cbcb608658c

SHA1
bdf8cd48b90c8d73f8d0cc4d546287210efca5ec

SHA256
2e4dd6c788c304d217596094e73018016e21eb546035e703c41dcf0dde3770d8

SHA512
e597622bb009f121201a4286f16370251bf674d1b0dc6e32092062ee298f5ab00811f4a515bea52a2d610069c32983cebe6c3c8c6b7c2bffa04932245861a62d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23455.exe

Filesize
468KB

MD5
645d15d28582ddb17e36ec05fe52e436

SHA1
b7992373fa3fa3112192d382f7942e5f95a5fb12

SHA256
79af1a200dfe32c651faeda4b47386c099e6a5a39c8eae5a12ef3682403d69ca

SHA512
6d7f802a6be7b2ea82d0655eb30773c54daf76a6f32705dfe4e565ec5dae2bdfa299fc09b8a385cd69c6517f713b8c2cee5003b7b9f4c85c82bec4cbd15b688e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35141.exe

Filesize
468KB

MD5
fdeae7a8623167867edf5feccdd72415

SHA1
970227b06d5a83f69f2978c60c02578f9c01f00b

SHA256
03751b5c9c9270ea422fe82e09505dc1fd64bce707897bb52728b3d17b629e50

SHA512
032fd9931b4811510772e434ae69225cc83bc1d1cb0e287ea49bef30684421ebb05850523132ae5c87b08ca29f479a68faaddeb9164b0e18921df707200ff09d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36777.exe

Filesize
468KB

MD5
10aa0b76f2fe25e6bd1edfb04ae8d71c

SHA1
4c56235cb02c86ab755e5ec173576487877c3f35

SHA256
e804b5b8028aaf9f8ff36e698f01fa2ec00bfc2175786536f45ac9ae00b21b34

SHA512
63f599d0e016ac19c2fdb45db39cc854ffdde31fd7e4f988646b38953082e3060df2ce8b57aa823b348418ea0ec235b58489e10bcba5616bbc890b6283c4111b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37130.exe

Filesize
468KB

MD5
3176d6e0184778039bc0564c6cccabc4

SHA1
e51924b3cf27af5c6754a61a228f9a96173e6b56

SHA256
df6a13cc343130decd7d96876f26e640b9c7bd8e5b3942a9aebf9af2280acb13

SHA512
564b9da5015dfdf35f249126bcdc8f1aacd40841cfab1721fa6224a2503a8032efd033025915e33b74892ebd5f9c1203f01ff6a5b98b3a5b0f6f94627c09626c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37784.exe

Filesize
468KB

MD5
3b4bbcf28311cf0a58d84f23f98138bc

SHA1
2821903f16c4175fdb10a588c4d9fbab024ab340

SHA256
244d261204090ec0c3af64ce4defb882e9c2e3737f3ed632e81b7e72b3be3860

SHA512
403fe8a23b6bd875f65de1993e36254486652deac1cded644081a57779ca7420a1554113eed6523a4608b09f941d1f2899db63e2459c5914347da9d32cfc6a94

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61311.exe

Filesize
468KB

MD5
e6794c3c3c421cc2eeef653dad715535

SHA1
ad1eda4485af46fd1359fa4a3f903cecac90a475

SHA256
d27769be75233089d1ddf98fc01969b3fb9bedd4a71585cd674b974ef59c871e

SHA512
7a05a0d5fae1d5ddd4f6d5864367f20d541eccc7c15814c28868b3971dbfc6091cd618abb6a47451fe132da206889fa2e31bf22e9efe0fac9c0201876d6fd72b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64654.exe

Filesize
468KB

MD5
41d987c0dd1e2faae8b9b29c346c36be

SHA1
b617d37b7849bdd1d7b4021100d80ccf95d823b8

SHA256
935032fd43a84b029784ad9a7f55112d4682c42888d7edbb307efbd7eb9a0995

SHA512
91718103101ffc0f0f3c7dfc1eca37430b58f89a1a4848d36acfecf23cfd2eb5a2ded4cdbe714006a7dd5cc82551d4a194bf0d2ec56bef262f1ec77a64fc5891

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1120.exe

Filesize
468KB

MD5
841f79ca8e03db5f88065d640ca0ff56

SHA1
782a267f5142565103be22a171cbd794a6254eab

SHA256
f2cca886bef40a6d9c3fb77b144fef3a2e2cdb2da9279b4a56ff23fc5988e341

SHA512
0b8d4559327897ba7ce14ce6680eb39d597ae1280a3df924101a9191f8eadf2787d373a103f11d6d14a8a079a7588abc6196d6a52cf912e2f3b8f6b50caa15d5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28536.exe

Filesize
468KB

MD5
ba9de9af1dab0eee34256d17f978e0c6

SHA1
42e2ef71a60ac1e609a1d40385951e9d6847aa9b

SHA256
d901c4864f6b34665ff8961714ab545b9d45233ce2e7d94ffaaa3841392ccea6

SHA512
92545267515679b35a895fc0c01ea1ae0d76edb9da82cfe1f38e9894b7dcdbf5e725286e3994bc0cfe000e55a9a564d90047099a059922d6a976adb2801e8a84

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28578.exe

Filesize
468KB

MD5
fa66f3bee7df438e69e37e262530fcb0

SHA1
d715d459130d08b5f6ae125cc83602e5a6d89197

SHA256
e6e3e61b4c45d91b277bf4f0e967447bb2ab50667b84058c1d9383a3ea5cdc64

SHA512
0bebab485e681eb3d8dc6d3358afa89b91f5ae860f7c797655dcc02b3aab44c97fe1ec6faaa10248b9aab46a5dc4c09640d42b5e60efcb7146b043052e0fb4ca

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31239.exe

Filesize
468KB

MD5
c2a56029b2f7502f95f05c5414fa9e94

SHA1
fe82ebabf25776a7b1e05c967721355a9bf212bc

SHA256
94d99f80c1ff80f9643e53e167510615463014eb3c290eb0ebc3a0189768d596

SHA512
a967509fa02954d34e6e0c0c7d3e1f090f5567bbb0d87439b48cd9aa4ecb8fe0d150c0e7a28418306d955ca3a30a99278f65b0bc70713b7b36741668d8ab0366

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32153.exe

Filesize
468KB

MD5
0fbe815d9a53951cf5cac93319b99776

SHA1
b58f136b8041a3dfef4082bae4d5378ae7df7e3c

SHA256
e77444f25b08b2e8650022395103cb383462902e71b506d9b5ba6cfa51fa17c1

SHA512
5e5feac1a2aa7d3a05613776e54ed663ab0eeb50ee46bccd1fd05e1dcb7f464eb7162c625b8d8c180fc11102384a71c9f51b2395cfa28de01252e08c912c73e8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-35319.exe

Filesize
468KB

MD5
c1a0aaddb3e1f0324ee549abce80818d

SHA1
6f6a5626af30734483543ca8d6ba2bed56f9bc8b

SHA256
40ec5ae544705d7dcd0fbed37271ce8ea614524b64dfefd9dd1d621d2fb1e864

SHA512
69f5b7fec3fdbc41e939076196487e647268abbec34e124bf9af9e1f13cc88b80d0dce3959c5a1bd6d2e275055008fdb534d6617461154d5e37c1412f5844aa3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47576.exe

Filesize
468KB

MD5
4d96fa4358d22952d228f19eff6dcf2a

SHA1
b31f9ccfd61c6dc3c56ca8162ccd1356a5ff8fbc

SHA256
cdb41fe04f8016e14a024ec7e647a2abf317f9e838f5b88c2c77459a20f68050

SHA512
78994739c9044caf80ff134cd23d40b6c16f99c25e6f24001f5ed4863406b47187df4d2addd1174c4db3cca72b50bb5c8000f05300b9db053f1dd92a0d2a3ca4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53389.exe

Filesize
468KB

MD5
99536e9cb3de91048fd1bc205a1fc434

SHA1
4b36bf131b3f11ca86bf93c58703fd7addd3ab56

SHA256
792f9b104b5a65706c24d09806918cfc9dbad9d55fb6656b28309250ff34c3cd

SHA512
11af6e4066a5065cdc42b082e30302694ba061f609d44b51533b898b872b156d4c7b4258f93d057a541f3de1630dfc274bd5cbae5cbbf56556ad6f4bf26b8c49

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61935.exe

Filesize
468KB

MD5
f567f7bc7c78cd4b15327c1d1f3ad602

SHA1
4d54f97ec6b9e84726f1e871f5eb64f2e306273e

SHA256
789dfac2d1597e541e2dc7ffbe235747e4358446b8009bf78608117827515b09

SHA512
681598cc5b8c32eecae94f614d517c745254f0f96f4009144292982e842e920c31dd09b61ff419bc3930b1cfbf15f23f6b66181d5a27dbff74d86192a19a4baf

Download Submit